Live data from Hacker News

Ask HN: Gmail account security

news.ycombinator.com

631–640 of 807 posts

Re: Ask HN: Gmail account security

#631
post #615

Earlier quoted context omitted.

Haven't used Tinder in ages, but don't they have a "Travel" option to find matches are a location of your choice?

It’s a paid feature but yes

What about spoofing your GPS location to the front desk of the FB offices? Should work with Androids in Developer mode?!?

Re: Ask HN: Gmail account security

#632
Interesting question for you hn people. My email domain is my website domain and I just use Google’s email servers. If Google ever nuked my account is it trivial for services to resolve that my email pointed to a new provider?

Re: Ask HN: Gmail account security

#633

Once upon a time I worked at Google. I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales. They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only h…

It's pretty crazy to think about the fact that your email is de-facto your online identity, as it is the universal second factor that is used as a fallback if other login mechanisms fail. An email service is two things: a global name user@emailprovider.tld, which is really your online identity, and an email service that hosts the SMTP, IMAP and DNS services required for the identity to function. People are willing to…

I fully agree. Over the years I've been reading about people being locked out of their Gmail accounts, and the YEARS of pain they had to go through to try to regain access to the countless connected services. You don't realise how many hundreds of services require access to your email account until you lose access. The final straw was reading the heartbreaking account of someone who lost decades worth of personal pictures, critical emails, and access to everything that mattered to him. Google's response was worse than "get lost."

So I bought my own domain and have spent the last year slowly migrating everything over. I'm still only ~30% of the way there. My whole life was centered around that Gmail address, and I could have lost it in an instant for any and no reason at all. It's horrifying, and happens to perhaps thousands of people every day. As we continue to SaaSify everything this problem is going to come to the fore sooner rather than later. Our entire lives live in the cloud now and it can be deleted without cause or notice.

At the very least I would like to see governments issue people a free state email address which can be hosted anywhere. Email is now a necessity.

Re: Ask HN: Gmail account security

#634
post #332

Earlier quoted context omitted.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

I agree with the advice to get your own domain, and then use a service to manage email for it. But don't use GSuite/Google Workspaces/whatever they're calling it now. Your Google account will be somewhat crippled and will be missing a bunch of features, because Google has just decided GSuite accounts should not have those features. And you can't convert your account to a regular Google account. I really want to untan…

>export your Google Photos sharing settings and import them into a new account. I have hundreds of GPhotos albums, with many of them shared with various people, and if I migrate to a new, regular Google account, I'll have to manually set up all those sharing settings again.

If you think this is bad you should check out iCloud. They're all as scummy as each other about locking in users so the friction to leave is sufficiently high.

Re: Ask HN: Gmail account security

#635
post #611

Earlier quoted context omitted.

Use private mode exclusively. You will start getting into the captcha hell in a day or two.

I configured Firefox to delete all cookies on exit, except few whitelisted sites. So most of the time I have to accept Google privacy policy if I search there. Other than that, I never got into the captcha hell when trying to do a Google Search. There are some sites I can't login at all unless I change the browser. SoundCloud is one of them.

Could be that IP Address/ISP reputation is also a factor for the variation in results.

Re: Ask HN: Gmail account security

#636

Earlier quoted context omitted.

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (sin…

The issue with running your own domain is that it could be blacklisted by google (and Facebook) if you get hacked, and then you're fucked big time. I encountered that because of an outdated Wordpress. Domain was blacklisted everywhere on the internet. Luckily I didn't have email set up on it.

>Domain was blacklisted everywhere on the internet.

Well this is horrifying. Of course, not much worse than Google unilaterally and permanently banning a Gmail account.

Re: Ask HN: Gmail account security

#637

Earlier quoted context omitted.

Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason. It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.

I use google constantly— sometimes hundreds of times per day— both logged in and out, almost exclusively in Firefox or Firefox developer edition and I've never encountered this. I'd bank on it being a network thing— VPN, overcrowded proxy, etc.

I have had the same experience the previous commenter had when I'm on my phone. It would happen quite randomly and sometimes the captcha hell would resolve and I could go back to normal search, while other times it would go into infinite loop. Check back in an hour and you're fine. It's a disaster and at times like these I am so glad there's at least some competition I can go to for search.

Re: Ask HN: Gmail account security

#638

Earlier quoted context omitted.

Even when you have paid Google products that come with support, it is really awful. They once asked me to submit a business case justifying how answering my support question benefited Google. Just a simple clarification of something in their documentation. I was already under pressure to migrate to Office360, I stopped fighting after that. My employer is a huge AWS user and Google is constantly chasing us with a trea…

I've first hand experience with managing a google workspace (50 users) and an Azure AD (30 users). With google workspace, the chat is two click away and the guys now their stuff. With Azure AD, no support, no chat, except "here is a list of consultant in your area that provide support". And I pay twice as much to microsoft ...

I work at a company with >1000 google workspace users.

That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed.

The support may be good if you're asking questions they've heard before - or if you need something like an account lock reset, which the support folks have a button for. But if the problem you're encountering requires a code change? Not so much.

(If you're wondering, the bug is "in Google Drive, users with third-party cookies disabled get stuck in a redirect loop when downloading files or viewing videos, as the cross-origin request to googleusercontent.com attempts to redirect to get an auth cookie that never arrives" )

Re: Ask HN: Gmail account security

#639
post #470

Once upon a time I worked at Google. I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales. They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only h…

You are actually pointing out a tremendous opportunity that Google has internally and externally. I work at Google and recently tried to file a bug about the calculator embedded in search. It was dastardly difficult to find how to file the ticket. It took me maybe an hour. A better system for filing tickets internally and for filing and triaging tickets from external users would be a tremendous asset for Google.

Maybe they don't want you to file the bug too easily?

I imagine Google would getting 10,000s bugs per day if it was too easy.

Re: Ask HN: Gmail account security

#640

Earlier quoted context omitted.

To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transactio…

U2f key ? Works for me.

Are there best practice process diagrams to support the correct usage of these with b2c services?

how should the initial verifiacation happen? what happens when i loose/corrupt/break the device? should this represent me as a human or the keys to an account? - should a human hold the permissions ultimately (if so how to i override a key?)

Post reply on HN