Tell HN: A stranger is using my YouTube account and Google can't log them out

Hi HN,

I believe Google has a grave authentication issue and I cannot burst the impenetrable tier-1 support wall to solve it. Hopefully I'm wrong, but for the life of me and the support reps I talked to, we cannot get a stranger logged out of my YouTube account.

The stranger is using my YouTube account through my old Smart TV that I gave away (my bad for not logging out, but there should be recourse for this).

Once I discovered this, I have changed passwords and revoked auth tokens on all relevant services (Spotify, Disney+, etc.). All services no longer show the stranger accessing them - with the exception of YouTube.

The actions I've taken multiple times (as instructed by Google support): - Changed my Google account's password - Revoked all "devices I trust" under my 2FA settings - Logged out of all devices in the "Your Devices" list

This did force me to log back in on my own devices (phone, TV), but I still see new videos that the stranger watched in my YouTube history. This has been happening for weeks.

Google support walked me through these steps and then gave generic "make sure your password are strong" article links, but of course, refuse to escalate this.

If you wish, you can view the support transcripts here (I admittedly got a little short during the 2nd conversation, which I regret): https://pastebin.com/GypwBPFj

---

Some details:

- The videos in my view history are in Arabic, so I know it's the stranger who watches them

- I know the stranger has access through my old TV because I saw their activity on all apps I had installed on my TV, and I saw my old TV signed in from a distant city under "Your Devices" list

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys.

(I ran into a similar issue with the Oculus/Meta Quest 2 and Facebook login tokens. I reported it as a vulnerability in the Facebook account system and it was fixed eventually.)

This should help:

"1. Open https://myaccount.google.com/device-activity on any device.

2. Select the device you’d like to sign out of.

3. Select Sign out.

You can also remove YouTube on TV access for a Google Account by opening https://myaccount.google.com/permissions > select YouTube on TV > Remove Access."

https://support.google.com/youtube/answer/7612539?hl=en

I'm guessing this smart TV is using some kind of weird nonstandard auth scheme that has fallen through the cracks.

Maybe it's storing some kind of non-expiring login token that isn't invalidated using the regular process.

How then?