Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

781–790 of 807 posts

Re: Ask HN: Gmail account security

#781

This is a long shot, but if you have a spare Android phone lying around consider doing a factory reset on it and signing in with that account during the initial setup. My situation was somewhat different. I had a rarely-used account with no recovery email/phone. When I entered the password correctly using a web browser, I was asked to provide a (new) phone number so I could be sent a verification code before continui…

And a suggestion from https://support.google.com/mail/thread/123734419/i-am-locked... (written by a community member who is labelled as a "Product Expert"):

> Try letting the account sit for a full week with NO sign in or account recovery attempts. Just leave it idle for a week. This may help any suspicious activity flags to clear allowing you to attempt account recovery with more success.

Re: Ask HN: Gmail account security

#782

Earlier quoted context omitted.

I think that was part of the point. Google made Go and then when OP wanted to use Go, their bosses said “use Java” (and took a month to do something that could be done in a few days)

I disagree with OP on this. Their boss in my opinion made the right call. I'd say for a few reasons: 1. Why did OP do this without talking through it first 2. Introducing a new language to a team is not some small decision, and IMO typically not a good idea 3. Why would it take a month in Java to do what takes a few days in Go 4. If it made this one task faster, the burden it will put on the team in the future can be…

> Their boss in my opinion made the right call. I'd say for a few reasons:

Well you don't have enough context to say it was the right call.

> 1. Why did OP do this without talking through it first

I was tasked to prototype / MVP / "tracer dart" and prove that it was feasible. As proven, it took 2 days in Go. If it was done with Unix commands, the pieces can be jumbled together in a day. The point was having a self-contained "documentation via code" example of the exact business logic in such a program. The same can be achieved with a shell scripting language, but it wouldn't have been as readable. Go is about readibility, which is exactly the reason why it was invented Google, because Google prioritizes readibility. Java is readable if you know what idioms and style it's in, but it's also verbose, which is distracting. One, communicating with the source and sink. Two, get an initial picture of nuances in the Protobufs and data format. It happens to be that the Go prototype was 85-90% close to a final solution. In Java, after being able to actually bundle and consume the libraries had undocumented idiosyncrasies. Java is more powerful and thus more flexible, so a Hello World solution could might be in the wrong direction. You have options, no pun intended, on how you handle async.

> 2. Introducing a new language to a team is not some small decision, and IMO typically not a good idea

There was already half a dozen programming languages on the team's codebase, include a Go server which we inherited. So in effect, we should know Go anyways. As much as Google is Java shop, engineers are polyglot and not hired for a single language, in theory.

> 3. Why would it take a month in Java to do what takes a few days in Go

The language itself. Async code is verbose. Opinionated debates over variables should use the keyword final. Debating whether to use inheritance, delegation, function, or whatever composition / code-reuse pattern. It's been empirically shown Java programs are more verbose than other languages, both in tokens and in LoC. Complexity and entropy doesn't scale linearly, either. This is reflected in both client code and library code, which in the case of Google for many libraries is stale and misleading. One such library is authentication. For Java, Google has multiple competing libraries, or you can carve authentication features out of another feature library, but that is wrapped around and pegged to an older version. Something like JavaScript, there is 3 public sets of documentation on OAuth2 in JavaScript, and like 2.5 clients. With Go, there is a single canonical version, and so just figuring out what library you should use is a fraction of the troubles.

Then there is the ecosystem as a whole. You have options for logging library, and getting Gradle and the building system to pull in the dependencies, especially when you are on internal networks, is one thing. Aligning the Gradle build to be consistent with idiosyncrasies of the team's existing codebase is another. You can do inheritance with Gradle, and that's what was involved to be "consistent", because copy-and-pasting code is a no go.

> 4. If it made this one task faster, the burden it will put on the team in the future can be bad in the long run

That's a strawcut. What you are referring to is taking shortcuts, choosing a suboptimal solution because it saved time. Go was purpose built for middleware and microservices. It was the tool for the job, independent of how long it took to build the MVP. Beyond that, tess code is always better. If there was less code needed to build it, there is less code to maintain.

Google cares about code readability. This is exactly why Go was invented. Go is built readable language. Readability is what engenders low maintenance cost burden.

> Perhaps the team would benefit a move to Go (I doubt that)

No, it was not about a wholesale migration to Go. It was about using the right tool for the job, in one specific microservice, instead of having the Java and turning everything into a nail. Imagine if a company was a PHP shop and said everything had to be written in PHP. Frontends, backends, MapReduce jobs. This is the whole point about federating to microservices instead of monoliths. Or JavaScript, JavaScript everything. Hey, that's not bad, Coinbase was built solely on JavaScript. The argument might make sense if this was an esoteric language or a Lisp, but this is Go, which is, in theory, an official programming language at Google.

Re: Ask HN: Gmail account security

#783
post #771

Earlier quoted context omitted.

I think that was part of the point. Google made Go and then when OP wanted to use Go, their bosses said “use Java” (and took a month to do something that could be done in a few days)

It could be part of the point but it does not sound like it. It could say - Google is bad in that and that BUT it has Go. Or it could say - Google designed Go and is interested in its adoption BUT its own managers don't think that Google developers want to learn Go. But instead it says that Google documentation "does not teach you how to fish" and "you're not sure how to proceed" and at the same time Go somehow gets…

> It could say - Google is bad in that and that BUT it has Go. Or it could say - Google designed Go and is interested in its adoption BUT its own managers don't think that Google developers want to learn Go.

It's implied. In fact, Go is an "officially" supported language, meaning there is a dedicated team to maintain tooling around the Go ecosystem, sweep for security issues, keep "runtimes" (in this case the compiler and binaries) up to date.

> But instead it says that Google documentation "does not teach you how to fish" and "you're not sure how to proceed" and at the same time Go somehow gets away with it - "At least with the Go libraries it's feasible to read the entire source code and flesh out things on the edge of documentation".

If documentation is going to be equally bad either ways ( that's something I've resigned with), then all else being equal the library implementation which is easier to read would be preferred.

That said, Go being idiomatic also means generated documentation is more standardized. Java has JavaDoc, but that's not enforced or culturally as consistent as Go.

Re: Ask HN: Gmail account security

#784

Earlier quoted context omitted.

I'm also a developer and an educator using Classroom for a small class. Your insight makes it crystal clear why I always thought that Classroom was completely insane, to the point where I was wondering why nobody else said anything and maybe I just wasn't "getting it" - no, it's because it's basically a clever hack that's a Googler's side project (that maybe now has a small team around it).

As a fun exercise, I'd encourage you to peruse even their apps script APIs and see how quickly you can actually get something like "google classroom" up and running for yourself, minus some of the UI candy. Truth-be-told their documentation and what they expose to you is pretty rich, and along the way you then start seeing exactly why "Google Classroom" things are the way they are hehehe.

This is enlightening.

I do see they have a marketing / landing page which makes me feel there is a product charter beyond half-a-SWE: https://edu.google.com/products/classroom/

Re: Ask HN: Gmail account security

#785

Earlier quoted context omitted.

I've first hand experience with managing a google workspace (50 users) and an Azure AD (30 users). With google workspace, the chat is two click away and the guys now their stuff. With Azure AD, no support, no chat, except "here is a list of consultant in your area that provide support". And I pay twice as much to microsoft ...

I work at a company with >1000 google workspace users. That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed. The support may be good if you're asking questions they've heard before - or if you need something like an account lock reset, which the support folks have a button for. But if the problem you…

> I work at a company with >1000 google workspace users.

> That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed.

I will try to remember that the next time I deal with an open-source project, either as a user raising an issue, or as a project contributor helping solve such issues.

Often, we do not realize how lucky we are that contributors to open-source projects help fix the bugs which we report.

Re: Ask HN: Gmail account security

#786

Earlier quoted context omitted.

I’m sure that in the mind of Google they are doing a favor by letting us give them money, wanting support is just ungrateful. Wanting a bug fix is just obscene. They have 150,000 PhDs, aren’t we bold to question them!

This stems from Google not being a service company. Support for products is mostly like this. You can submit a bug report but that does not mean they will help you. We have a saying here that goes something like "don't buy pizza at a burger joint"... Don't buy services from a advertising / products company.

>Don't buy services from a advertising / products company.

I will remember this. Thanks.

Re: Ask HN: Gmail account security

#787
post #627

Earlier quoted context omitted.

The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account). Even if google had customer support agents, what do you want them to do in cases like this? They can't actually…

In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.

Same in the Netherlands with DigiD. The name is an awful pun. Very Dutch.

Re: Ask HN: Gmail account security

#788
When my kids were born I created gmail accounts for them to save the name for when they become old enough to use it. This worked well when I did it from home, but for my last born I created his account *on the hospital wifi*, saved pass in 1pass. A couple years later I tried to login to his account from home and got thrown into this recovery hell. I visited that same hospital wing a year later to try "a prior location", but it didn't work.

As a result I unintentionally caused the very problem I was trying to prevent.

Re: Ask HN: Gmail account security

#789

Earlier quoted context omitted.

> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?

How do you know what people 'intend' to use? Making it inconvenient to use alternative browsers especially when they compete with your own is manufactured consent not intention. I use FF on Linux and have to go through that crap every time FF updates even though nothing else has changed.

It seems to me that packaging a malicious browser to look like a familiar one is actually an attack vector

Re: Ask HN: Gmail account security

#790

Earlier quoted context omitted.

> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?

Yes, in part thanks to their efforts to make it harder to use other browsers...

I think you are overestimating the inclination anybody has to use those.
Post reply on HN