Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 807 posts

Re: Ask HN: Gmail account security

#311

Post by mekoka »

Those of us who move around quite often can attest to how frustrating the security of online services has gotten.

It can get even worse if you provide a phone number for "added security" and find yourself in a different country with a different phone. I've witnessed a few fellow travelers getting locked out of accounts because they couldn't access the SMS sent to their home phone number and the app was ignoring the code sent via email. Yahoo, Amazon, Gmail. I've even seen someone unable to use their Airbnb account for this very reason, which is odd considering that the service caters to travelers (that was 6 years ago, so maybe things have changed).

If you travel and change phone numbers often, avoid giving it for security if you can.

Re: Ask HN: Gmail account security

#312

Post by egberts1 »

commoner wrote: post #217
noicebrewery wrote: post #76

Earlier quoted context omitted.

I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.

Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed. [1] https://github.com/andOTP/andOTP [2] https://getaegis.app/ I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues…

FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them.

my fall-back is Microsoft Authenticator.

Re: Ask HN: Gmail account security

#313

Post by jfoster »

alerighi wrote: post #188
Andrew_nenakhov wrote: post #8

Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as I used to always access it, no less. Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in. Needless to say, I will never again use gmail for critically important things.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

And be careful not to have your domain recovery procedure tied to the same email account that you might need to recover.

Re: Ask HN: Gmail account security

#314

Post by markdown »

matheusmoreira wrote: post #202
pronlover723 wrote: post #130

Earlier quoted context omitted.

FYI, google has customer service if you're paying them. I pay $6 a month for gsuite. I've contacted customer service 3 times. Got them instantly.

I've read stories here on HN about non-existent Google customer support from people who worked at companies that were paying Google millions .

I live in a third world country on little island in the middle of the Pacific Ocean, yet have had Google respond within minutes every time I've had an issue (multiple times over the past decade). They have provided support both by phone and chat. I pay them 2 figures a month.

Re: Ask HN: Gmail account security

#315

Post by moralestapia »

Google is absolute trash now compared to what it was.

Most accurate search engine is now almost useless even for VERBATIM queries; queries that took milliseconds earlier (they even built a product around that, Google Instant), now take 2-3 seconds on average.

Best email service, now feels clunky and slow plus the spam algorithm not only stopped working, but is now working backwards.

Everything just worked and it was simple to grasp and to work with, now we have issues everywhere with their draconian 2FA among other "wise" decisions in the name of "security".

All this while on Android, basic stuff like calling 911 so you don't die is not possible because of all the other "features" they keep adding to the platform, see: https://news.ycombinator.com/item?id=29492884

Re: Ask HN: Gmail account security

#316

Post by rattray »

supermatou wrote: post #91

Yep, and it was even more aggravating. > have three gmail accounts > primary, name.surname@gmail.com > secondary, name.surname.purchases@gmail.com > tertiary, name.surname.work@gmail.com > secondary and tertiary have primary as a recovery address > log in/out once a week in 2nd and 3rd > last August, try to log into name.surname.work > "Password is incorrect" > WTH?! of course it's correct. > try several times, Googl…

Is it possible that your secondary/tertiary accounts were victims of account takeover? Did you have 2FA on them?

Re: Ask HN: Gmail account security

#317

Post by markdown »

evandale wrote: post #223
zozbot234 wrote: post #164

Earlier quoted context omitted.

They're supposed to have paid customer service for non-business users too if you pay for Google One, no idea how effective that is.

I was wondering that as well because I have Google One. When I go to the support page it claims 24/7 support for phone and chat in 2-3 minutes and e-mail support within 24 hours.

I have no idea what Google One is, but I get that level of support for the $12/month I pay them for Google Suite and have had great support experiences multiple times over the past decade.

Re: Ask HN: Gmail account security

#318

Post by Osiris »

Masema wrote: post #287
alerighi wrote: post #188

Earlier quoted context omitted.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

I did this! Kind of. I bought a domain and was lucky enough to get in to a custom domain email (and more) service with a big company years ago when they had a free version. Unfortunately... it was Google (so kind of hiring the wolf to care for my sheep, as it turns out). And now they're cutting off all of us free tier folks. Which I can't fault them for, but still blame them for. Because I'm petty and entitled or wha…

Same here and it's a massive problem because nearly all of my digital presence is associated with, not just that email address, but that Google account specifically.

I'll lose important things like my Google Voice number that I've had for a decade unless I pay for a business account.

Re: Ask HN: Gmail account security

#320

Post by golem14 »

rrrhys wrote: post #100
donalhunt wrote: post #72

Earlier quoted context omitted.

Any particular reason?

1. In a thread about being locked out of google services because of AI black box, it makes sense to reduce dependence anywhere possible 2. If you get a new device, you need to un-enrol and re-enrol in all 2fa providers with g authenticator - it's a nightmare. Very hard if the old device got fatally dropped in a pool! I know at least with Authy you can carry the tokens to a new device.

I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to. Stick the old phone in a safe and make sure it's still working every so often (2x/year?)

This is relatively new - a few years ago Authenticator did not support this.

Oh, and make sure before you use the emergency device, time is synced - codes won't work otherwise.

Post reply on HN