For critically important accounts, host it somewhere where you have the chance of talking to a human if things go boom.
Google is not one of these.
Ask HN: Gmail account security
131–140 of 807 posts
Re: Ask HN: Gmail account security
#132I stopped using gmail. I pay for my own domain (approx $10 per year and subscribe a hosting service that costs about $4/month). The total cost is not much different from a paid google email which is about $50/year. If I happened to forget/lose all passwords (lost laptop, burned house etc.), I would probably need to deal with the hosting company who would try to identify me with my credit card or some other way (phone…
In most cases it’s easy to social engineer hosting company staff into granting unauthorized access (even the major ones) all it takes is a bit of know-how and maybe a photoshopped ID. The weakest link in any security stack is always the human element. The fact that Google makes it impossible to get in touch with a human is why I trust it.
The biggest risk I think is falling a victim of the scam. I usually get emails purportedly from my hosting provider (sometimes from my bank etc.) that I need to verify payment or something like that. Obviously they are fake but I can understand that even an attentive person can have a bad day and click on a malicious link and enter all required details. Google is probably better in filtering out such scam. And yet I wonder if it still happens often enough that they actively block login attempts if they are from unusual locations.
Re: Ask HN: Gmail account security
#133You think that’s bad trying recovering a missing Microsoft outlook account. I have to wait on some verification and send my address previous addresses used, etc.
Good luck.
Re: Ask HN: Gmail account security
#134Wasn't aware of this, but can't say I'm surprised. Personally, I'm still happy with Fastmail, which uses customer subscriptions fees to fund a professional support department, as well as contributing to email-related FOSS. (Among other things, obviously.)
Do they offer an api?
You mean IMAP and SMTP protocols, right?
Re: Ask HN: Gmail account security
#135Immediate solution to try: Use a mail client to access your mailbox with IMAP or POP3; GMail may be more tolerant that way. Long-term solution: Stop using Google. Why? Not just because of this type of shenanigans, but because Google spies on you: * It keeps a copy of all of your correspondence, even if you delete it. * (Rephrased) The US National Security Agency (NSA) has gotten access to much of your correspondence,…
> It send the US National Security Agency (NSA) a copy of all of your correspondence Google did no such thing. What Snowden revealed was that the NSA knew at that time the SSL connections from a user to Google were terminated at the GFE, and all the traffic between Google data centers were in cleartext. That includes, for example, a request from an application to store some user data in a database or storage system,…
I stand corrected and have edited my answer.
Re: Ask HN: Gmail account security
#136Yep, and it was even more aggravating. > have three gmail accounts > primary, name.surname@gmail.com > secondary, name.surname.purchases@gmail.com > tertiary, name.surname.work@gmail.com > secondary and tertiary have primary as a recovery address > log in/out once a week in 2nd and 3rd > last August, try to log into name.surname.work > "Password is incorrect" > WTH?! of course it's correct. > try several times, Googl…
I had something like this happen becasue I was logging in to some microsoft service, and thought I was supposed to be giving them my microsoft account password but apparently they wanted my gmail password for whatever they were up to. And doing a password reset on this microsoft service actually reset my stupid gmail account. Then once I figured out what happened, google wouldn't let me use an old password to set it back.
Re: Ask HN: Gmail account security
#137Woo.. This happens to credit cards a lot, but in these cases, you can at least call the bank.
Last time I use Google services I can't delete my credit card too. So I cancelled that. Now all my accounts are somethingfunny.anumber@ just for comment music in YT.YT i good, I wonder how they will trash it.
Re: Ask HN: Gmail account security
#138Google/Gmail is a nightmare to use for me as someone who travels overseas to visit family. Logging into Gmail from a different device is a harrowing experience. SMS 2FA doesn't work with many providers even with international roaming turned on. So you're dead in the water and face a potential account ban that can never be recovered.
Years ago, I had my account suspended when I was implementing an Adsense integration into a site for no discernible reason. I have too many ancient financial institution's login tied up to my primary email. That was the last time I signed up for anything related to Google. At my workplace, I'm a strong advocate against the Google ecosystem. A few of us fought hard to keep our cloud systems away from Google and move to Azure. I've seen similar sentiments from quite a few devs in the last few years.
Re: Ask HN: Gmail account security
#139Earlier quoted context omitted.
The amount of trust that providers put in phone numbers is absolutely insane.
Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)
My phone number is probably the least valuable thing Amazon knows about me, I figure.
Re: Ask HN: Gmail account security
#140Edit: I just got back in! I had to give a real phone # for the SMS step. It pretended to accept a Google Voice # but would never send a code and I just got stuck in the loop I describe below. I've now closed the account. Oh, the irony...
Yup, I've got an old gmail account that Google won't let me into. First I get:
"This device isn’t recognized. For your security, Google wants to make sure it’s really you."
With options for "Confirm your recovery email" and "Get a verification code at ."
Regardless of which I choose, it then asks me for a phone # for an SMS code. So I give it one, just to get:
"Unavailable because of too many failed attempts. Try again in a few hours."
Except, "a few hours" is a lie. I last tried this weeks ago. I get a "Try another way" option which prompts me "Enter the last password you remember using with this Google Account." at which point I'm at a dead end because this account only ever had one password.
The best part is that shortly after going through this exercise I get an email to the recovery address:
"Sign-in attempt was blocked. Someone just used your password to try to sign in to your account. Google blocked them, but you should check what happened."
With a "Check Activity" button that takes me right back to the Google sign page...
Buttle? Tuttle?
The irony in all of this is that I'd forgotten about the account until Google sent an "new terms of service" email to the recovery email address and decided I wanted to close the account. But I can't login to do so.
Anyway, I switched my primary email away to Fastmail years ago and I'm still happy with that decision.