Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

681–690 of 807 posts

Re: Ask HN: Gmail account security

#681
post #487

Why the heck is running a your own email server so complex?! I run my own email servers, as does my company, and they can be an absolute pain at times. Once you've got everything settled, they're okay, but still, they're unnecessarily fiddly things to get working. It should be easier, much much easier. Then we can all stop relying on external providers for substandard email services.

It's pretty simple if you use Docker and the mailserver images.

Re: Ask HN: Gmail account security

#682
post #475

Earlier quoted context omitted.

And replacing the spaces in the subject with %20 will fix it on more browsers, at least it's at the end :)

And providing no email at all and using form submission with captcha will annoy a bunch people but will save you from a lot of spam ¯\_(ツ)_/¯

You could even power the captcha with Google!

Re: Ask HN: Gmail account security

#683

Earlier quoted context omitted.

If you have a google workspace account and need google support, you can go in the admin console, help section in the top right, there is a contact form with phone and chat options.

What if you can't log in?

Then there's this magic link: https://support.google.com/a/contact/recovery_form (calling it magic because it's not very obvious how to find it; I had to look it up in the HN comments)

Re: Ask HN: Gmail account security

#684

Earlier quoted context omitted.

Actually, I specifically declined setting up a recovery phone number because I accessed it from the location where receiving codes would be impossible on my phones. I always accessed it from the same IP using my own VPN server, entered the correct password, and still Google decided that they are 'not sure that it is not really me, try again later'. No thanks.

What about downloaded back up codes ? Phone push approval? U2f key? Authenticator app? Can't imagine complaining about being shut out if you didn't have at least one or all of these set up. Google even nags you about setting these up.

Why can't you imagine that? This gatekeeping you're doing is rude and doesn't make sense. 2FA's very purpose is to increase shut outs when enabled.

Re: Ask HN: Gmail account security

#685
post #257

Earlier quoted context omitted.

It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.

> it is definitely doing non-trivial fingerprinting Can confirm. To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output ho…

> say unusual browser, small country, rare language, use a vpn etc

> Basically it's these massive bayesian filters that output how suspicious some activity is.

It almost feels like the digital equivalent of racism, xenophobia, homophobia, and other prejudices; people are suspicious of anything that stands out as being somehow "different." Now computers are suspicious and prejudiced because your digital appearance looks out of norm.

> This approach is understandable from a business perspective, but imo deeply troubling for an open society.

Agreed.

Re: Ask HN: Gmail account security

#686

Once upon a time I worked at Google. I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales. They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only h…

Once we were having trouble with GKE hosted in Asia, it was causing out business a major outage and it wasn't something which I had the power to fix, from memory, half way through a cluster upgrade, Google ran out of compute so the upgrade was stuck half and the control plane ended up in a bad state and some how this impacted the networking (it shouldn't but it happened). I was unable to provision a new cluster due t…

I'm certainly far from finding excuses for Google, but I have strong doubts when reading stories like this. I wonder how is this possible? If you check their support packages at https://cloud.google.com/support/, they provide different options based on how much you are willing to pay. The premium package gives you 15 minute response time and a personal TAM. What am I missing here? They promise a service, but it doesn't work?

AWS seems to also have support packages: https://aws.amazon.com/premiumsupport/plans/, and their response times are also not supposed to be instant.

Re: Ask HN: Gmail account security

#687
gmail security is infuriating, particularly if you are off travelling the world. You enter your password correctly, you use MFA, and still google can be like nope no email for you. Its incredibly frustrating, and there is no recourse, no one you can call.

I get its trying to help protect people, but you know, if it creates friction for the user, you have fucked up. And google's automate everything is admirable, but where there are no feedback loops, it is worse than useless, as no-one knows something is broken and needs fixing.

Re: Ask HN: Gmail account security

#688

Earlier quoted context omitted.

Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.

I use google constantly— sometimes hundreds of times per day— both logged in and out, almost exclusively in Firefox or Firefox developer edition and I've never encountered this. I'd bank on it being a network thing— VPN, overcrowded proxy, etc.

That would make sense, Google can easily track you if you always use the same IP. It's their business, they track you and sell your data so they can provide their product for "free".

Re: Ask HN: Gmail account security

#689

Earlier quoted context omitted.

>about how he paid Google something for some service >I'd frequently tell my co-workers, "If you're not paying for it, you're the product." it seems even if he did pay he was the product, which frankly jibes with my experience of paying for things at Google.

If you pay for it, you simply like it like this.

As a normal rule I don't know what customer service is like at a company I'm paying for things at, until I have something go wrong and I realize it sucks.

Re: Ask HN: Gmail account security

#690
post #672
post #659

Earlier quoted context omitted.

> I think it's definitely not unique to big corps, but an emergent property of a distributed and homogenous system of self interested agents, probably. It feels very game theoretical, at least. What's clear is these systems are becoming ubiquitous rapidly. Not sure the homogenity is necessary? To an extent, the market delivers what people are demanding. For most people, Google's package of cheap or even free services…

> Not sure the homogenity is necessary? Oh, nice catch, I actually meant to write heterogeneous. > I'd bet that more people lose their local data than get locked out of Google? Probably. There's definitely some low hanging fruit/middle ground though. We desperately need to have ownership of the address itself, so we can transfer to different providers. Either with your own domain, or a domain provided by a truly neut…

Not sure about phone numbers. You can get them hijacked relatively easily, at least temporarily.
Post reply on HN