Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

331–340 of 807 posts

Re: Ask HN: Gmail account security

#331

Post by heavyset_go »

parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

Interesting how the brand of security companies like Google keep telling us is in our best interests always seems to secure their corporate revenue streams first, while the security and freedom of users are an afterthought.

Re: Ask HN: Gmail account security

#332

Post by kelnos »

alerighi wrote: post #188
Andrew_nenakhov wrote: post #8

Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as I used to always access it, no less. Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in. Needless to say, I will never again use gmail for critically important things.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

I agree with the advice to get your own domain, and then use a service to manage email for it. But don't use GSuite/Google Workspaces/whatever they're calling it now. Your Google account will be somewhat crippled and will be missing a bunch of features, because Google has just decided GSuite accounts should not have those features.

And you can't convert your account to a regular Google account. I really want to untangle all this, but there's no way to (for example) export your Google Photos sharing settings and import them into a new account. I have hundreds of GPhotos albums, with many of them shared with various people, and if I migrate to a new, regular Google account, I'll have to manually set up all those sharing settings again. And this is just one of many difficulties; I'm assuming I'll also lose all my Hangouts/Chat history as well, with no ability to import the old history.

But I'll be doing all this sometime soon, as Google has decided to finally pull the rug out from under those of us who signed up for GSuite when it was free (well, "Google Apps for Your Domain", as it was known back then), and will start charging later this year.

This is all incredibly frustrating, and the level of lock-in is pretty severe after more than a decade of having this account. If I could do it all over again, knowing what I know now, I would have created a Google account without GMail[0], using my email on my custom domain, and hosted my mail somewhere else. Though, admittedly, back when GMail was first a thing, webmail otherwise universally sucked.

[0] https://accounts.google.com/signupwithoutgmail?hl=en

Re: Ask HN: Gmail account security

#333

Post by heavyset_go »

Wowfunhappy wrote: post #295
parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

Huh. I'm using a little-known Chromium fork[0] and I haven't had any trouble logging into Google services. 0: https://github.com/blueboxd/chromium-legacy

It might just pass as Chromium to their browser fingerprinting.

Re: Ask HN: Gmail account security

#334

Post by taxyz23 »

goodlinks wrote: post #259
AshamedCaptain wrote: post #85

One day I logged in to my Amazon account from a different country. Mind you, I have 2FA/OTP enabled in my account, and I entered it correctly. They also made me click on a link they sent via email to "verify my login". A couple hours later my account was blocked due to "suspicious login(s)" (i.e. mine), and the order I placed cancelled. They had me wait 24h until I could contact someone at support that could unblock…

To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transactio…

U2f key ? Works for me.

Re: Ask HN: Gmail account security

#335

Post by empressplay »

shitloadofbooks wrote: post #243
empressplay wrote: post #215

Earlier quoted context omitted.

Try using a VPN to log in from the location you last used the account

Logging in from a known VPN IP will likely flag the activity as even MORE suspicious from Google's AI's POV.

That has not been my experience. I was able to recover two google accounts by using a VPN

Re: Ask HN: Gmail account security

#336

Post by megous »

empressplay wrote: post #215
anter wrote: post #25

Yep, have had that issue for over a year now, I am completely unable to access my old gmail account despite having the password, recovery email and everything else. Just says "you can’t sign in" and that's it: https://i.imgur.com/4YrElkJ.png

Try using a VPN to log in from the location you last used the account

Not sure why you're downvoted. Setting up VPN on my home router and using that VPN on my next travel will be the first thing I'll do prepping for a vacation. Using VPN is a right solution.

All the geo-IP nonsense is absolutely crazy, including these random login blocks and "security" checks. You also get UI reset to languages you don't understand, because no, websites can't use the language you set in your browser, they have to use some geo-IP nonsense to select a language (especially funny with IPv6). And there's no persistent switch if you use private mode, because they don't respect UA settings.

Re: Ask HN: Gmail account security

#337

Post by DarylZero »

parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

Synth looks cool but why can't it just be an extension?

Re: Ask HN: Gmail account security

#338

Post by emodendroket »

parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic.

OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?

Re: Ask HN: Gmail account security

#339

Post by orangepurple »

drra wrote: post #255
josephg wrote: post #112

Earlier quoted context omitted.

A plug from a very satisfied customer: I pay $5/month for Fastmail. I've emailed support before and reached a human within hours. They helped me with my problem, because it was their job and I'm paying them to do it. Email is too important to rely on a free service which has a history of shutting people out, at any time, for any reason.

Still the problem with Fastmail is the same as with Google. Leaning on 3rd party service that you have no control of. There are so many things that could go wrong there, they can be hacked, go bankrupt, closed by authorities, insided. Everyone should have an appropriate personal disaster recovery plan that includes stuff like recovering from loss of service supplier.

Fastmail has been extremely responsive to any random minor issues that have cropped up for me or the several people I got to transition to their service over the last 7 years.

Re: Ask HN: Gmail account security

#340

Post by [deleted] »

2bitencryption wrote: post #18

Oh god, have you had the M.C. Escher-esque experience of trying to sign in to an email account, and it hits you with a two-factor-auth prompt that sent the code to another email address? Imagine the insanity if the email account that received the code in turn asks for a code sent a code to the first one.

[deleted]
Post reply on HN