Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

711–720 of 807 posts

Re: Ask HN: Gmail account security

#711

Post by alecco »

AnonC wrote: post #453
mlac wrote: post #241

Earlier quoted context omitted.

They do recommend having two keys associated with the account. It’s not cheap, but you can pick up a USB-C small format one and leave it in your computer & get one for your key ring that does NFC / Bluetooth. One is always with you, one is conveniently on your main computer. You can get the least expensive model as a third, off-site backup.

All hardware dies at some point. What if both the Yubikeys die? What if the third one was already dead before and it wasn’t noticed because it wasn’t used recently? This sounds like too deep a maze for I don’t know how much benefit.

I don't know why they removed OTP. I like handling ALL my logins through a single Password Manager.

Re: Ask HN: Gmail account security

#712

Post by mavhc »

ulrikrasmussen wrote: post #656
creato wrote: post #627

Earlier quoted context omitted.

The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account). Even if google had customer support agents, what do you want them to do in cases like this? They can't actually…

In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.

Did they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID yet?

Re: Ask HN: Gmail account security

#713

Post by tomxor »

zxcvbn4038 wrote: post #586
steelframe wrote: post #445

Once upon a time I worked at Google. I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales. They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only h…

Even when you have paid Google products that come with support, it is really awful. They once asked me to submit a business case justifying how answering my support question benefited Google. Just a simple clarification of something in their documentation. I was already under pressure to migrate to Office360, I stopped fighting after that. My employer is a huge AWS user and Google is constantly chasing us with a trea…

I hesitated to post this comment, another anecdote with zero recourse... Then realised the fact I hesitated is more concerning.

Google hold too much control over the internet and the majority of internet users lives, to the point where it's almost authoritarian: They can screw with your personal life and potentially your business without any recourse, causing the effects such as the one I just experienced. I'm not suggesting some large conspiracy against those who oppose Google's affect on the web, and many of us will continue to complain openly and loudly about them because that is our culture. But the effect their position has on freedom of speech is still present, it's a natural instinct, it increases the chances of a large portion of the population to remain silent out of personal fear - and that is concerning.

Re: Ask HN: Gmail account security

#714

Post by michaelt »

blfr wrote: post #696
michaelt wrote: post #638

Earlier quoted context omitted.

I work at a company with >1000 google workspace users. That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed. The support may be good if you're asking questions they've heard before - or if you need something like an account lock reset, which the support folks have a button for. But if the problem you…

That must have been fixed. I got a message to enable third party cookies for drive.google.com. Even with a link to docs on how to do it iirc.

I just tested, and it's not fixed.

Re: Ask HN: Gmail account security

#715

Post by zenexer »

joshuamorton wrote: post #104
zenexer wrote: post #77

Earlier quoted context omitted.

I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious. This happens to me f…

If you're entering a code, the 2FA method you're using is still susceptible to mitm-style phishing attacks, which is what this kind of location based check is securing against. You'd need a push notification or yubikey based 2fa check to get the same level of security.

I have several YubiKeys linked to my account. It will decline those as well. It demands that I sign in from Android sometimes, seemingly for no reason.

Re: Ask HN: Gmail account security

#716

Post by zenexer »

fleddr wrote: post #174
zenexer wrote: post #77

Earlier quoted context omitted.

I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious. This happens to me f…

If we reason from good faith and consider that this is intentional and not a bug, have you considered that Google did not implement "blocking suspicious 2FA" just to mess with you? That perhaps this deals with a very real threat? Google has no incentive to make it difficult for you to log in, it's the exact opposite.

I have no doubt it deals with a real threat. That doesn’t change the fact that I’m regularly unable to log into my Google account.

Usually it happens when I’m using multiple devices simultaneously—for example, Android and iOS. It’s understandable that Google considers that to be suspicious, but if Google isn’t going to learn on its own, there needs to be some way for me to confirm that nothing is amiss. It’ll ignore everything from TOTP codes to YubiKeys.

Re: Ask HN: Gmail account security

#717

Post by muthuraj57 »

Had similar issue before. My and my friends are traveling to a different city and one of my friend's mobile went missing during our trip. The contact we were about to stay in the city is in that mobile (saved in his Google Contact thankfully). When he tried to login his account in my mobile to access it, Google wouldn't let him. He had to use the secondary email he registered with email(which is from Yahoo) to send a verification code and use that to login to the Google account. He also forgot the password for the secondary mail id and finding that was another story.

Re: Ask HN: Gmail account security

#718

Post by sbst32 »

alephnan wrote: post #552
graderjs wrote: post #500

Earlier quoted context omitted.

I guess this is why Amazon is playing the long game with their obsessive focus on customers. I don't know how that really plays out where the rubber meets the road but that's what Jeff bezos always keeps talking about.

I worked at both Amazon and Google. It was only at Amazon where I was exposed to the Craft of software development. Personally, I feel there is a nuanced difference to the role at Amazon being SDE ( Software Development Engineer ) whereas Google is SWE ( Software Engineer ). It's almost like Google thinks Software Developers are lower tier than Software Engineers, but I'd like to think of myself as doing more than ju…

It's a bit ironic that you're bashing Google and praising Go in the same paragraph, never mentioning that Go is designed and supported by Google.

Re: Ask HN: Gmail account security

#719

Post by neycoda »

steelframe wrote: post #445

Once upon a time I worked at Google. I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales. They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only h…

Google makes money on Gmail. That means they can pay for customer support.

Re: Ask HN: Gmail account security

#720

Post by bamboozled »

evercast wrote: post #686
bamboozled wrote: post #668

Earlier quoted context omitted.

Once we were having trouble with GKE hosted in Asia, it was causing out business a major outage and it wasn't something which I had the power to fix, from memory, half way through a cluster upgrade, Google ran out of compute so the upgrade was stuck half and the control plane ended up in a bad state and some how this impacted the networking (it shouldn't but it happened). I was unable to provision a new cluster due t…

I'm certainly far from finding excuses for Google, but I have strong doubts when reading stories like this. I wonder how is this possible? If you check their support packages at https://cloud.google.com/support/ , they provide different options based on how much you are willing to pay. The premium package gives you 15 minute response time and a personal TAM. What am I missing here? They promise a service, but it does…

Have you ever tried to get one of those packages ? You need to have an interview etc.It’s not straight forward or cheap. We tried to sign up and have a TAM assigned but gave up. It was a lot of effort.

Amazon gives great support at an affordable price.

Post reply on HN