Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

801–807 of 807 posts

Re: Ask HN: Gmail account security

#801

Post by lucb1e »

gruez wrote: post #501
lucb1e wrote: post #365

Earlier quoted context omitted.

I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. It didn't have a problem logging in with the same laptop from another place in Germany earlier that day. There are surely more facto…

> I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. 1. even though people travel, I suspect it's far more likely that a random russian IP accessing an american account is because the…

"whether you're logging in from a new device or not (via cookies and/or fingerprinting)" Every login is a new 'device' because I don't have Google tracking me across the web. Fingerprinting, sure it can see I'm a firefox on linux with the usual browser features and fonts. All is as it usually is, nothing suspicious in this category.

"whether your other devices have moved to the new country" I don't have any device pinging the mothership about my every movement so that can't be taken into account.

"I wouldn't be surprised if it scanned your email" lol and I definitely don't have email from google, so that's also not a factor. I also highly doubt they're actually this clever, especially over six years ago. Huge amount of work to parse the email formats of the thousands of popular travel companies from around the world in fifty different languages.

Re: Ask HN: Gmail account security

#802

Post by cassidoo »

kilroy123 wrote: post #695
exolymph wrote: post #7

Wasn't aware of this, but can't say I'm surprised. Personally, I'm still happy with Fastmail, which uses customer subscriptions fees to fund a professional support department, as well as contributing to email-related FOSS. (Among other things, obviously.)

I too have used Fastmail for over a year now, but I do wish they would add a few much needed features.

Would you mind sharing which features are missing that you miss?

Re: Ask HN: Gmail account security

#803

Post by BigRedDog1669 »

chaxor wrote: post #555
RubyRidgeRandy wrote: post #461

Earlier quoted context omitted.

only tangentially related but that phrase is a pet peeve of mine. You are always the product if you are using software - free or paid. Netflix is sure as hell going to use your data the same way youtube would. The only exception of course is most but not all FOSS.

Self hosted is the only good future

I kind of agree and would like to try selfhosting stuff for myself, but in the future where should the self hosting lie? Not everyone can self host (your mother, cousin, etc, people with disabilities, etc) So if it is the future, would level of society would host it reliably? Family, government, etc. Everything seems problematic either in terms of practicality and security.

Re: Ask HN: Gmail account security

#804

Post by kilroy123 »

cassidoo wrote: post #802
kilroy123 wrote: post #695

Earlier quoted context omitted.

I too have used Fastmail for over a year now, but I do wish they would add a few much needed features.

Would you mind sharing which features are missing that you miss?

- A phone app that can handle being offline. (the biggest issue IMO)

- I want better parsing of dates, so I can click on them, and add to my calendar.

- The calendar needs to be able to show more than one timezone at the same time.

- Have a way to create a secondary icon on your phone to go to the calendar. (You have to click multiple buttons)

- An iOS calendar widget would also be great.

Re: Ask HN: Gmail account security

#805

Post by dimitrisscript »

Hnrobert42 wrote: post #381
kelnos wrote: post #332

Earlier quoted context omitted.

I agree with the advice to get your own domain, and then use a service to manage email for it. But don't use GSuite/Google Workspaces/whatever they're calling it now. Your Google account will be somewhat crippled and will be missing a bunch of features, because Google has just decided GSuite accounts should not have those features. And you can't convert your account to a regular Google account. I really want to untan…

What features does GSuite lack?

Can't share Google home access with another user.

Re: Ask HN: Gmail account security

#806

Post by jounker »

nextos wrote: post #277
jounker wrote: post #248

Earlier quoted context omitted.

Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.

That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.

It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.

Re: Ask HN: Gmail account security

#807

Post by Groxx »

Silhouette wrote: post #543
Gigachad wrote: post #525

Earlier quoted context omitted.

The chance of someone stealing your physical token, and knowing your email + password are almost impossibly low.

But if you lose your 2FA device then you lose access to everything if there is no alternative recovery mechanism. I recently started working with a client that uses cloud-hosted everything and mandates 2FA for all accounts. They asked me to install Google's authenticator app for that purpose. So far, so reasonable. However of those different services, only one provides recovery codes as a standard part of its 2FA reg…

tbh I think that's basically reasonable for corporate-controlled accounts. They can verify that you are you, and recover the account (or get you a new equivalent one) pretty much no matter what you screw up. It might take a couple days, but it'll happen eventually.

Individuals do not have that kind of power over their own accounts. So if you screw up, you're screwed for good. 2FA means third parties can screw me over at any time, I see no reason to take that increased risk.

Post reply on HN