Google announces account security updates, including requiring JavaScript be enabled when using a Google sign-in page in order to run a risk assessment
October is Cybersecurity Awareness Month and Google is announcing a slew of new features related to the sign-in process and account usage.
Context & Ripple Effects
This lands mid-arc in Google's slow rebuild of the sign-in flow. The My Account hub centralized security settings back in 2015; advanced protection then made high-risk users carry a hardware key; and the June 2018 refreshed Google Account added proactive hints and better search over security state.
The JavaScript requirement is the next step in that sequence: instead of adding another user-facing setting or key, Google is making the login page itself compute a risk assessment before granting access — and framing the whole batch under Cybersecurity Awareness Month, the same umbrella as the earlier G Suite warnings that followed the Docs phishing wave.
First-order effects
- Users who browse with JavaScript disabled — a common hardening choice — can no longer complete a Google sign-in without re-enabling it, turning a privacy preference into an authentication blocker.
- Google gains a client-side signal at every login, letting its risk engine evaluate the session rather than just the password or key.
Second-order effects
- Privacy tooling built around script-blocking faces a forced trade-off on Google properties: whitelist the sign-in domain or break logins, which pressures extension makers to add per-site exceptions.
- Other identity providers watching this will feel pull to embed their own in-page risk checks, since Google is normalizing computation-at-login as table stakes rather than an opt-in like advanced protection.
Third-order effects
- Authentication drifts from verifying credentials to evaluating the session itself — the direction already visible in Cross Account Protection and breach-alert tooling like Password Checkup — where the browser becomes part of the trust decision.
- Users who harden their browsers end up structurally distinguishable from default-profile users, raising the question of whether script-blocking itself becomes a risk signal in these assessments.
The trend: Account security is moving from static credentials and optional hardware keys toward continuous, in-browser risk assessment computed at every sign-in.