Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: A stranger is using my YouTube account and Google can't log them out

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#21

Post by urbandw311er »

japanman425 wrote: post #8
jimrandomh wrote: post #3

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys. (I ran into…

Not really. It’s just a long lived refresh token. You can revoke the app it’s associated to but OP seems unaware.

OP has listed the steps they took to revoke connected devices, what additional revocation are you referring to?

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#22

Post by Liebnitz »

maerF0x0 wrote: post #14
filoleg wrote: post #13

Earlier quoted context omitted.

Unless there is a kind of DID that also makes you speak arabic (which you normally don't know how to) and shows your logged-in TV that you sold being located in a distant random location, I seriously doubt your theory.

[flagged]

[flagged]

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#24

Post by sdiacom »

jimrandomh wrote: post #3

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys. (I ran into…

Why shouldn't tier-1 support be able to forward this to someone who is the slightest bit technical, who can then make the call to report this to the relevant security team?

There's no reason why tier-1 support has to be this irredeemably useless. Just put someone in the loop who knows when _not_ to blindly follow a script. It really isn't that hard.

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#25

Post by creakingstairs »

aliqot wrote: post #18
creakingstairs wrote: post #12

Earlier quoted context omitted.

I do find it ridiculous that getting Google support has gotten to a point where people need to post for help on a forum in which they are hinted to go to another community and look for a person who has “in” with a team. I really should move off Gmail.

> I really should move off Gmail. Just curious, what's the line, if not this? Hypothetically of course, I'm okay with it if you're responding with "I'd rather not say" or "I don't know"

I’m not sure what you mean by “what’s the line” but if it means “what’s the alternative”:

First start using personal domain so that when I switch away I can do it without having to update all contact details. I’ve already been doing this.

Then after some research, switch to a paid email provider. I’m thinking of ProtonMail or Zoho at the moment but I need to look into it more.

It’s going to be painful because I used to use Google OAuth whenever it was available in the past. But I would like to start having my eggs in different baskets.

EDIT: re: "whats the line"

There is no concrete line. It's mostly me getting old enough to worry about not losing access to a lot of services on algorithms' whim and I keep seeing these posts on HN (Google or not). I know the chance of it happening is slim, but I think the damage would be big enough to diversify away.

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#26

Post by PeledYuval »

jimrandomh wrote: post #3

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys. (I ran into…

Thank you - I will be trying this

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#27

Post by PeledYuval »

saurik wrote: post #2

I know this is going to sound ridiculous , but go to this random support forum and try to get ahold of Didi; they seem to have some kind of "in" with the account hijacking team and can get your account moved into a different kind of support queue. https://support.google.com/youtube/community

Thanks! This does sound ridiculous, but maybe it will work? Worth a shot

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#28

Post by PeledYuval »

robgibbons wrote: post #23

Just delete your YT account, and create a new one. From what I just read, it should be possible to delete YT without deleting your whole Google account.

This is a solution of last resort that I still don't want to go for

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#29

Post by PeledYuval »

feklest wrote: post #4

In Google's OAuth 2.0 for TV and Limited-Input Device Applications page, https://developers.google.com/identity/protocols/oauth2/limi... , it says: "Note that there are limits on the number of refresh tokens that will be issued; one limit per client/user combination, and another per user across all clients. You should save refresh tokens in long-term storage and continue to use them as long as they remain valid. If y…

I think the risk of getting banned due to misuse is not worth it... But I like your hacker mentality!

Re: Tell HN: A stranger is using my YouTube account and Google can't log them out

#30

Post by PeledYuval »

mindcrash wrote: post #5

This should help: "1. Open https://myaccount.google.com/device-activity on any device. 2. Select the device you’d like to sign out of. 3. Select Sign out. You can also remove YouTube on TV access for a Google Account by opening https://myaccount.google.com/permissions > select YouTube on TV > Remove Access." https://support.google.com/youtube/answer/7612539?hl=en

I've done both of these things - to no avail! This is really weird
Post reply on HN