Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

341–350 of 807 posts

Re: Ask HN: Gmail account security

#341

Post by KennyBlanken »

klabb3 wrote: post #257
parhamn wrote: post #187

Earlier quoted context omitted.

It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.

> it is definitely doing non-trivial fingerprinting Can confirm. To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output ho…

> To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level.

Total coincidence that it's also "you're not being a good little data source", I'm sure.

I use a privacy-oriented browser on my cell phone to load amazon's website to get that stupid whole foods QR code for the checkout, because I'm not installing their fucking app so it can collect more data on me.

Guess what? Every single time, I'm presented with a "we've emailed you a link" error, and that link is difficult to open in my preferred browser because iOS doesn't offer it as a choice for opening links...

Re: Ask HN: Gmail account security

#342

Post by snowwrestler »

alanh wrote: post #258

Reminder: Google paid for an ad campaign with this gist: A father creates a Gmail account for his daughter when she is born, and sends her important photos and mementos as she grows up. Sweet. Reality: At least one person tried this in real life, and the child's account was automatically deleted without recourse. https://tech.slashdot.org/story/11/12/18/2046221/why-google-...

You can do this with a regular Gmail account. The kid just can’t log into it until they are 13 or older.

Google also now offers child Google accounts for kids under 13, which are limited and tied to a parent’s account through an app called Family Link. This is how you can set up a Chromebook for a kid, for example.

This limit of age 13 is not arbitrary by Google; it’s their way of complying with a U.S. federal law called COPPA.

Re: Ask HN: Gmail account security

#343

Post by Wowfunhappy »

heavyset_go wrote: post #333
Wowfunhappy wrote: post #295

Earlier quoted context omitted.

Huh. I'm using a little-known Chromium fork[0] and I haven't had any trouble logging into Google services. 0: https://github.com/blueboxd/chromium-legacy

It might just pass as Chromium to their browser fingerprinting.

I suppose, but then how would they detect a Chromium build with a keylogger?

Re: Ask HN: Gmail account security

#344

Post by lucb1e »

supermatou wrote: post #91

Yep, and it was even more aggravating. > have three gmail accounts > primary, name.surname@gmail.com > secondary, name.surname.purchases@gmail.com > tertiary, name.surname.work@gmail.com > secondary and tertiary have primary as a recovery address > log in/out once a week in 2nd and 3rd > last August, try to log into name.surname.work > "Password is incorrect" > WTH?! of course it's correct. > try several times, Googl…

Are you quoting from somewhere or is this bullet points? (I only know this bullet points style from 4chan so not sure if this might be a quote instead.)

Re: Ask HN: Gmail account security

#345

Post by rswail »

Lately I've noticed that Google wants me to "open the youtube app on your phone" even though I've configured 2FA. This is a work account, I have no interest in associating it to the youtube app on my phone.

My own email is with fastmail. They do what they do particularly well and are worth it.

Re: Ask HN: Gmail account security

#346

Post by parhamn »

DarylZero wrote: post #337
parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

Synth looks cool but why can't it just be an extension?

Well, for one, nonsense like this is why I set out to build a browser in the first place :) More generally, the user experience is, naturally, worlds apart from extensions.

Re: Ask HN: Gmail account security

#347

Post by weare138 »

emodendroket wrote: post #338
parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?

How do you know what people 'intend' to use? Making it inconvenient to use alternative browsers especially when they compete with your own is manufactured consent not intention. I use FF on Linux and have to go through that crap every time FF updates even though nothing else has changed.

Re: Ask HN: Gmail account security

#348

Post by rdschouw »

kelnos wrote: post #332
alerighi wrote: post #188

Earlier quoted context omitted.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

I agree with the advice to get your own domain, and then use a service to manage email for it. But don't use GSuite/Google Workspaces/whatever they're calling it now. Your Google account will be somewhat crippled and will be missing a bunch of features, because Google has just decided GSuite accounts should not have those features. And you can't convert your account to a regular Google account. I really want to untan…

Yea it is odd that not all Google accounts are the same.

My favorite is that I cannot migrate my Nest account to a Google account because it does not support Google Workspaces accounts. I use it with my own domain and it is my private Google account.

Re: Ask HN: Gmail account security

#349

Post by throwaw123x3 »

dTal wrote: post #296

Hit this over XMas. Dad got a new fire stick. Wanted to use the YouTube app. Wanted to sign in to YouTube for channel subscriptions. Had a GMail account he'd not used in years. Tried to recover it with the whole send-a-code-to-secondary-email rigmarole. Google went to the trouble of sending a code, but upon successful entry decided that it just wasn't good enough. Maddening. Gmail account gone forever. Can't sign up…

> "phone number used too many times"

Reminds me of that time we did a project for google. They couldn't give us accounts which was required to do the job for them, too much hassle even for them internally. We bought a dozen phone numbers and invoiced them instead. (There is some humor in invoicing Google for circumventing a Google security system.) Each phone number is good for a handful of accounts per ~2 years iirc.

This is in a country with ID verification for a new phone number (no, it's not russia/iran/china... it is germany). The person behind the counter was not happy when I showed up to a busy post office with a stack of ID verification requests. (I couldn't have gone at a quiet time: they scale employees and I queue for 15-20 minutes every time also for a 20-second package pickup, no matter which day of the week, which time of day, or which city I go in.)

Re: Ask HN: Gmail account security

#350

Post by itchyjunk »

This happened to me. I had half given up on my account since I didn't have a phone attached. Knowing my password and recovery email doesn't help. I emailed to some support email for google partnered people. I am not sure who I emailed but they responded that I was emailing the wrong person but they checked the status and it looked all good. I tried longing and it worked without any issue.

Edit: I was super happy to see a human response at that point and was very hopeful when I tried to sign in again.

Post reply on HN