Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

Post reply on HN
Print view View original

351–360 of 807 posts

Re: Ask HN: Gmail account security

#351

Post by kadoban »

drzaiusapelord wrote: post #309
parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

Its craziness all the way down. I have a google voice number which is my "default" number with my gmail accounts. All my gmail accounts were automatically migrated to use 2FA with this number which means if I lose all my google devices and I try to log into voice, I'll get 2FA I can't see because of the catch-22 situation of not being able to log into voice. The only reason I caught this is because they send me a not…

> Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone."

The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years.

For SMS from real people it works fine ofc.

Re: Ask HN: Gmail account security

#352

Post by [deleted] »

lucb1e wrote: post #344
supermatou wrote: post #91

Yep, and it was even more aggravating. > have three gmail accounts > primary, name.surname@gmail.com > secondary, name.surname.purchases@gmail.com > tertiary, name.surname.work@gmail.com > secondary and tertiary have primary as a recovery address > log in/out once a week in 2nd and 3rd > last August, try to log into name.surname.work > "Password is incorrect" > WTH?! of course it's correct. > try several times, Googl…

Are you quoting from somewhere or is this bullet points? (I only know this bullet points style from 4chan so not sure if this might be a quote instead.)

[deleted]

Re: Ask HN: Gmail account security

#353

Post by gitgud »

smitop wrote: post #189
parhamn wrote: post #67

They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few). If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties. This feels very anti-competitive to me. Not…

I'd guess that it's because they (incorrectly) think it's an embedded Webview, which get blocked (see https://developers.googleblog.com/2021/06/upcoming-security-... and https://developers.google.com/identity/protocols/oauth2/poli... ). You could try creating an issue in the Cloud Identity issue tracker (Cloud Identity is Google's API for letting websites have a "Login with Google" thing): https://issuetracker.google…

This is a problem I've encountered too, people are unable to login to a Google account when using insecure Webview browsers... which includes; Messenger, Facebook, Instagram... etc.

But Gmail Webviews allow Google logins though :/

Re: Ask HN: Gmail account security

#354

Post by kadoban »

Osiris wrote: post #318
Masema wrote: post #287

Earlier quoted context omitted.

I did this! Kind of. I bought a domain and was lucky enough to get in to a custom domain email (and more) service with a big company years ago when they had a free version. Unfortunately... it was Google (so kind of hiring the wolf to care for my sheep, as it turns out). And now they're cutting off all of us free tier folks. Which I can't fault them for, but still blame them for. Because I'm petty and entitled or wha…

Same here and it's a massive problem because nearly all of my digital presence is associated with, not just that email address, but that Google account specifically. I'll lose important things like my Google Voice number that I've had for a decade unless I pay for a business account.

You can port your number out. I'm working on doing that myself. I think Google charges like $3 for some reason to do it, but whatever.

Re: Ask HN: Gmail account security

#356

Post by megous »

fn-mote wrote: post #179
b112 wrote: post #108

Earlier quoted context omitted.

Set up a real email provider, forward your mail from google to them, and transition over. If you want real identity security, reg your own domain, and move it with you.

> If you want real identity security, reg your own domain, and move it with you. I'm pretty confident that Gmail is more secure than the domain registrar if you're really attacked. At least do your research carefully on this one. Domains do get stolen. As always, consider your own threat model. But if you're a civilian? Wow, just hope you can walk away from the lockout.

Maybe. I guess it depends on the TLD. My country's TLD manager allows owners to lock their domains against transfers by registrars, or against changing the NS sets.

At that point, registrar can't do much to harm you.

Choosing your country's TLD for the most important domain is probably a good idea, if your country has well functioing and fair TLD manager. I certainly feel I have more of a chance when someone steals my country's domain, rather than some .com or .org. Country domain can be registered only to citizens, and so both the TLD manager and the thief will at least be in the same jurisdiction as me.

Re: Ask HN: Gmail account security

#357

Post by rattray »

pkulak wrote: post #251
exolymph wrote: post #7

Wasn't aware of this, but can't say I'm surprised. Personally, I'm still happy with Fastmail, which uses customer subscriptions fees to fund a professional support department, as well as contributing to email-related FOSS. (Among other things, obviously.)

I moved my family to Fastmail a couple months ago and it’s been wonderful. Never knew I wanted “shared contacts”, but it’s the best feature ever. Once I figured out it existed, I spent a couple days making really good cards for family members and family friends, and all that work is shared with the whole family.

for others curious what this feature is: https://www.fastmail.help/hc/en-us/articles/1500000279721-Sh...

> Sharing contacts is an easy way to let all users in an account have access to common address book entries.

> Businesses can share their corporate directory easily. Families can share contact information of extended family members.

Re: Ask HN: Gmail account security

#358

Post by Spooky23 »

Osiris wrote: post #318
Masema wrote: post #287

Earlier quoted context omitted.

I did this! Kind of. I bought a domain and was lucky enough to get in to a custom domain email (and more) service with a big company years ago when they had a free version. Unfortunately... it was Google (so kind of hiring the wolf to care for my sheep, as it turns out). And now they're cutting off all of us free tier folks. Which I can't fault them for, but still blame them for. Because I'm petty and entitled or wha…

Same here and it's a massive problem because nearly all of my digital presence is associated with, not just that email address, but that Google account specifically. I'll lose important things like my Google Voice number that I've had for a decade unless I pay for a business account.

Keep in mind you can port out a Google Voice number, also if you pay for Apple services domain hosting is free for iCloud+ users now, although you don’t get as many addresses.

It is very frustrating. I did a lot with Google Apps on that domain, and migrating that stuff out to a consumer account is a painful process.

Re: Ask HN: Gmail account security

#359

Post by lucb1e »

mikotodomo wrote: post #211

They have calculated that overall, a non-negligible amount of users will be hacked unless they have their system the way it is. Sure some accounts will get locked out, but overall it's a net benefit. There are hidden variables.

Based on what I see while consulting, I feel like more strange company behavior is attributed to cleverness than the real amount of stupidity/randomness that goes on. Here, too, there are so many variables and unknowns, this is not a calculable number. And even if they could, I am not sure they necessarily would. Bigcorps are not infallible and do not get everything correct with meticulous calculations on boatloads of data, much as they might try to give that impression.

Re: Ask HN: Gmail account security

#360

Post by somehnguy »

Masema wrote: post #287
alerighi wrote: post #188

Earlier quoted context omitted.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

I did this! Kind of. I bought a domain and was lucky enough to get in to a custom domain email (and more) service with a big company years ago when they had a free version. Unfortunately... it was Google (so kind of hiring the wolf to care for my sheep, as it turns out). And now they're cutting off all of us free tier folks. Which I can't fault them for, but still blame them for. Because I'm petty and entitled or wha…

Same situation here. Have you done the research yet to decide on a new service, or are you planning on starting to pay?

For me ideally I would like to move to something else (even paid) just because someday Google deciding to block me for whatever reason scares me quite a bit after having everything for the last decade attached to this account. I would like to export my emails, switch my domain to the new service, and import everything - but I have no idea how realistic that will be yet.

Post reply on HN