Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 807 posts

Re: Ask HN: Gmail account security

#241

Post by mlac »

jacekm wrote: post #169
alecco wrote: post #142

Earlier quoted context omitted.

> using YubiKey for 2FA Today Google/Gmail suddenly logged me out and asked me for the hardware key, and I thought no problem as I have OTP with my Password Manager, but OTP didn't work . I had the key somewhere else. Luckily after insisting a bit Google gave me the option to use my mobile Gmail app to verify it's me (note it was not Google Authenticator, why did they made me install it?). All this hassle even though…

I once had a situation where I didn't have access to my YubiKey but I had backup codes (not from the authenticator app but the 10 codes you are given when you set up 2FA for the first time). I could log in but I thought I'll remove the YubiKey from the account and set up TOTP (Authenticator) instead. It turns out you cannot do this using only backup codes, you have to have the key! So if you loose your key and run ou…

They do recommend having two keys associated with the account. It’s not cheap, but you can pick up a USB-C small format one and leave it in your computer & get one for your key ring that does NFC / Bluetooth. One is always with you, one is conveniently on your main computer.

You can get the least expensive model as a third, off-site backup.

Re: Ask HN: Gmail account security

#242

Post by ilrwbwrkhv »

parhamn wrote: post #187
bpye wrote: post #176

Earlier quoted context omitted.

Wow, that's awful. I wonder who's idea it was? Is it doing anything more than checking user agent (trivial to spoof), because if not that seems entirely hostile.

It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.

What did min browser have?

Re: Ask HN: Gmail account security

#243

Post by shitloadofbooks »

empressplay wrote: post #215
anter wrote: post #25

Yep, have had that issue for over a year now, I am completely unable to access my old gmail account despite having the password, recovery email and everything else. Just says "you can’t sign in" and that's it: https://i.imgur.com/4YrElkJ.png

Try using a VPN to log in from the location you last used the account

Logging in from a known VPN IP will likely flag the activity as even MORE suspicious from Google's AI's POV.

Re: Ask HN: Gmail account security

#244

Post by dumbfounder »

hilbert42 wrote: post #148
PaulHoule wrote: post #40

Earlier quoted context omitted.

With Google’s nonexistent customer service I’d be afraid of being locked out for any arbitrary reason and having no recourse no matter what recovery procedures I prepared for. Contrast that to my bank where I can go to the branch, show ID, and get problems logging in resolved.

"With Google’s nonexistent customer service..." What's needed is enough of these cases to bring a class action against Google. It's over a decade since I've used a Google account and I was similarly ignored even back then.

I have a few thousand dollars I earned with Adsense a bunch of years ago. They suspended my account and prevented me from getting the money. Every now and then I get a letter from some auditor that says I can claim the money. Just need to login to my google account. Needless to say google customer service hasn’t helped. Definitely need some class action suits to change their behavior, and I hate class action suits.

Re: Ask HN: Gmail account security

#245

Post by whoknew1122 »

As a security professional, this is something we deal with daily. Security is too lax? Why didn't you protect my data. Security is too strong? I can't easily access my data!

Can someone show me the Goldilocks zone for internet security? It's a moving target.

Re: Ask HN: Gmail account security

#246

Post by alisonatwork »

Andrew_nenakhov wrote: post #8

Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as I used to always access it, no less. Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in. Needless to say, I will never again use gmail for critically important things.

This is exactly my experience too. My Google accounts just randomly decide to stop working from time to time, and if I no longer have the same phone number that I did before (or if I'm traveling overseas and cannot get a "confirmation call"), there is no way at all to get in. Usually after a mysterious and unexplained period of time, my account gets un-flagged again and I can log in as per normal.

The first time this happened I completely lost all access to my Google account. I transferred all of my important email correspondence over to a Microsoft account and I have never looked back. Unfortunately I still need to maintain another Google account for my phone (Android) to work properly, so there are times I still get bitten by it. It's absolutely infuriating when you get a new phone and specifically need to log in with your Google account to be able to do anything, that's exactly the time Google blocks you from being able to get into your account, because it's apparently detected the new phone and decided you're a hacker.

This also happens to me regularly with PayPal, almost always when I am traveling overseas, at exactly the moments that I really need PayPal to work so I can pay for something related to my travel. It's so annoying. Tech support never, ever solve the problem. All you can do is wait and try again later until magically it works. Sometimes weeks later.

The only thing I can say for certain is to never try log into your account over open wifi or over a VPN connection, because somehow Google (and PayPal) seem to flag that as a hack attempt no matter how many times you correctly confirm your identity. And once you've been flagged once, your account gets caught in some kind of loop where even after you get back onto an apparently blessed IP address, you're still locked out for some unspecified period.

Re: Ask HN: Gmail account security

#247

Post by enobrev »

This reminds me of a story from a couple years ago (pre-covid). I dropped my brand new phone before my case arrived in the mail and cracked the screen. We were on our way to the movie theater and so I decided to drop off my phone to get it fixed before the movie and then we would pick it up on the way home. Perfect plan!

Except I bought the tickets through an app and now I didn't have that app. Nor did I know the password, because I use a pw manager. The person at the booth said I could use the confirmation email, so I tried on my wife's phone. It wouldn't let me log in to gmail from her phone no matter what I tried.

Different browsers, desktop mode, etc. There was no getting in. We were about to miss the start of the movie so I just went ahead and bought two more tickets and got a refund later.

Re: Ask HN: Gmail account security

#248

Post by jounker »

nextos wrote: post #192
xvector wrote: post #107

Earlier quoted context omitted.

The amount of trust that providers put in phone numbers is absolutely insane.

I agree. I change my phone number often and this is annoying. It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP. I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable. Gmail has locked me out very often for no clear reason. Besides they…

Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.

Re: Ask HN: Gmail account security

#249

Post by [deleted] »

hilbert42 wrote: post #148
PaulHoule wrote: post #40

Earlier quoted context omitted.

With Google’s nonexistent customer service I’d be afraid of being locked out for any arbitrary reason and having no recourse no matter what recovery procedures I prepared for. Contrast that to my bank where I can go to the branch, show ID, and get problems logging in resolved.

"With Google’s nonexistent customer service..." What's needed is enough of these cases to bring a class action against Google. It's over a decade since I've used a Google account and I was similarly ignored even back then.

[deleted]

Re: Ask HN: Gmail account security

#250

Post by alanh »

Yes, this happened to me with a throwaway gmail address I once had. Correct name and (strong) password, BS about a different device. I never regained access. Luckily nothing of real value was lost.

My primary email account is on Fastmail these days, and I like them.

Post reply on HN