Live data from Hacker News

How likely is losing a Google account?

jefftk.com

121–130 of 305 posts

Re: How likely is losing a Google account?

#121
post #29

Earlier quoted context omitted.

"I can reach a human" is a huge security vuln. I don't want people social engineering my identity provider.

> I can reach a human" is a huge security vuln Google's algorithms make entirely too many errors. "I can't get my account back unless a viral account of my problem makes the front page of HN" is an unacceptable risk.

I'm not sure how you can make that judgement without extra context (that is almost certainly tightly held within google). For example, what actually is the error rate? How does that compare to improper access that is successfully prevented?

Obviously any real person losing access to their account is a rubbish experience for that person, but an error rate of 0% is not possible with any system (including those with plenty of humans involved) when there are billions of users involved. I think a much more interesting question is "what's the acceptable error rate?"

Re: How likely is losing a Google account?

#122
post #108
post #69

Earlier quoted context omitted.

Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. The former companies have a direct incentive to keep giving you service as part of their core business. The latter are really only paying attention to the money they get from advertisers.

"is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. " Not necessarily, and in fact this case I would disagree. I trust Google's security 10x more than that of FastMail. The 'advertising company' reaps in billions of $ with which they can get all sorts of good engineers for 0-day research, exploits, updates. They have a lot more of a reputation to defend.…

>> Except for the bit where they read my email and advertise to me on that basis, which is admittedly an ugly tradeoff.

If you are paying for google apps this is not a trade-off. I dislike how (as a paying) customer they continually push me towards google-only but they don't require it.

Re: How likely is losing a Google account?

#123
post #108
post #69

Earlier quoted context omitted.

Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. The former companies have a direct incentive to keep giving you service as part of their core business. The latter are really only paying attention to the money they get from advertisers.

"is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. " Not necessarily, and in fact this case I would disagree. I trust Google's security 10x more than that of FastMail. The 'advertising company' reaps in billions of $ with which they can get all sorts of good engineers for 0-day research, exploits, updates. They have a lot more of a reputation to defend.…

gary_0 seems to be using "security" to mean "sureness of their continued existence", as in "food security". I don't think there's any question that Gmail is more secure in the computing sense.

> Except for the bit where they read my email and advertise to me on that basis, which is admittedly an ugly tradeoff.

Iirc, Google reads your email, but explicitly says they do not use what they read to personalize your ads.

Re: How likely is losing a Google account?

#124
This boils down to not having all your eggs in one basket. Instead of relying on Google to provide all these services you could split them up between different parties. These parties will often do a better job for their speciality.

I found that migrating and managing my credentials with Bitwarden has brought a lot of clarity and independence. I can now use these credentials with any browser, any mobile platform, and desktop platform. If I ever need to migrate away from Bitwarden I have the credentials periodically backed-up in JSON format, so they can be transformed into any other format.

Not logging in with Google SSO everywhere and relying on plain old username + password credentials wherever possible (+2fa for important stuff) has also been very liberating. Using a good password manager makes this trivial.

Same with email, having your own domain means you can switch providers in an hour or so if something bad happens. It's also worth keeping a backup of all emails in a common format like Maildir; so they can be restored to the new provider even if you lose access to the old account.

Which brings me to the last point which you've probably figured out by now - backups. Keep backups of everything locally + somewhere remote if you can. Backup emails, google drive contents, google photos, contacts, email filters, etc. Everything! B2 or S3-compatible storage is cheap.

Re: How likely is losing a Google account?

#125
post #75

What is usually not mentioned is that enabling two factor authentication is a mayor reason for people getting locked out of their accounts.

Actually, in my experience it can also bite the other way around:

I was locked out of my Google account after using it in Italy and coming back to Germany. Unable to login: It would first ask username, password, then send me an a-mail, then ask for the code from the e-mail (which I provided) and then either tell me to enter a phone number (Google is not going to get it from me!) or alternatively:

“You're trying to sign in on a device Google doesn't recognize, and we don't have enough information to verify that it's you. For your protection, you can't sign in here right now.”

If that isn't dystopian.

I interpreted the phone number requirement as a signal that “had I setup 2FA, it would not have asked for the phone number but maybe just the second factor?”. Then I went on an odyssey to setup a Google account without linking it to a phone and with 2FA enabled (also not linked to a phone!). Seems OK so far, but the procedure is highly complicated and partially luck-dependent. I am probably going to publish it, because there are tons of articles about how to setup Google account without phone number, but none of them worked for me at the time :)

I still do not rely on Google for anything but the search engine which still works without any login...

Re: How likely is losing a Google account?

#126
post #64

Earlier quoted context omitted.

but there is not process or person that has ever existed that has been infallible, therefore you are arguing that Google scale does not work?

That's correct. Google boasts that it doesn't do customer service because it can't scale to meet the demands of their user base. That can only work if their systems and processes never cause a user to have to go further than an FAQ page or community support. Given that Google are fallible, you end up in a situation where users' have a poor experience and cannot contact someone to resolve it.

I suspect you mean infallible rather than fallible.

Re: How likely is losing a Google account?

#127
post #108
post #69

Earlier quoted context omitted.

Any company with a business model that takes your money and gives you service is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. The former companies have a direct incentive to keep giving you service as part of their core business. The latter are really only paying attention to the money they get from advertisers.

"is inherently more secure than one that sells your eyeballs to advertisers in exchange for giving you free stuff. " Not necessarily, and in fact this case I would disagree. I trust Google's security 10x more than that of FastMail. The 'advertising company' reaps in billions of $ with which they can get all sorts of good engineers for 0-day research, exploits, updates. They have a lot more of a reputation to defend.…

On the other hand, if FastMail has a more focused product, less surface area for exploits.

Re: How likely is losing a Google account?

#128
post #29

It's true that every service has to deal with the same policy and lockout problems, but that doesn't lead to the conclusion that the risk is the same. I pay for FastMail because 1. if something goes wrong, I can reach a human without needing to write a viral blog post first. Other services pay for a customer service department. 2. I trust FastMail more to not shut down their product because they got bored. Sure Gmail…

"I can reach a human" is a huge security vuln. I don't want people social engineering my identity provider.

A critical question is what threat models you're worried about:

Are you worried about an individual interested specifically in you, Jeff B, to get something worth many thousands of dollars that they know you have? Don't put a human in the loop, they're going to track you across Facebook/LinkedIn/local government resources, they're going to know more about your car registrations and when you bought your home than you know about yourself, and they're going to be able to very convincingly social engineer a human in the loop if one exists.

Or are you worried about a group of hackers continuously crawling the web for a database dump from some service you and ten thousand other people signed up for, or some flaw in the authentication sequence to automatically sign everyone in the database and all their contacts a spam network for pennies per person? Their scheme falls apart if they have to call a human, because it's just not worth the time to look up your public records and talk to a human about you.

Second, what happens after you get hacked? Are you more concerned whether you no longer have access to something very important to you? For example, if you've distributed business cards or have contacts stretching back decades with jeffb@gmail.com, losing that account might mean an old friend or business contact fails to find you again. Having a human in the loop for the last-resort password reset can prevent completely losing access.

Or are you more worried about someone getting access to the data behind your login? You've presumably got backups, so you'd rather no one ever had access again than some malicious third party got the password to your crypto wallet, SSH keys to your website, or other private data.

Those have very different ideal responses. Unfortunately, most people tie both categories together in their single Google account, or in an Amazon account tied to both shopping and AWS resources.

Re: How likely is losing a Google account?

#129

> For example, in HN discussions people will often recommend Fastmail or Protonmail, but they've had their problems too (FM: 2017, 2020, 2022, PM: 2018, 2019, 2021). I think this is a bit dismissive of Fastmail: in all three of the linked reports (2017, 2020, and 2022) Fastmail has apologized and reinstated the account or provided some other mitigation. Nobody is perfect, any service will have bugs causing lockouts a…

In cases where someone was able to get their Google account back only after taking their case public (ex: [1][2]) I'm still counting this as a lockout, under the assumption that if they hadn't been able to draw attention to the situation they would have been stuck. Are the Fastmail cases different, or was taking it public and getting noticed a necessary part of the resolution process?

[1] https://techcrunch.com/2017/12/22/that-time-i-got-locked-out...

[2] https://news.ycombinator.com/item?id=2794529

Re: How likely is losing a Google account?

#130
post #99

Earlier quoted context omitted.

Used fastmail (and proton) for a year or two. Had to go back to google because there’s just too much spam otherwise

I've been on Fastmail for several years and I've had no spam in my inbox at all. Not a single email. That's a better track record than Gmail for me.

Same experience here. Fastmail is amazing.
Post reply on HN