Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ask HN: Gmail account security
1508 points by caseyf7 on Jan 23, 2022 | hide | past | favorite | 774 comments
I have a gmail account that I rarely use, but I know the password. I enter it correctly and get the following message:

You’re trying to sign in on a device Google doesn’t recognize, and we don’t have enough information to verify that it’s you. For your protection, you can’t sign in here right now. Try again from a device or location where you’ve signed in before.

Even if I get the code from the recovery email account, it won't work. Is this the AI hell Google throws you into if you get a new phone and computer in the same year? Has anyone else on HN run into this and found a solution?



Once upon a time I worked at Google.

I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales.

They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only human beings at Google the user was able to get in touch with, via something like "Press 3 for Corporate Sales." Of course these poor Google corporate sales people had absolutely no way to help this user even if they wanted to. Google literally did not have any GMail account phone support (at least at the time).

I could hear the poor guy screaming through their headsets about how he paid Google something for some service and was entitled to phone support and he demanded someone help him, but they just kept saying, "This is corporate sales. We do not offer consumer account support. If you want support, please visit the Google Support Forums at www dot..."

After they hung up on him 3 or 4 times, eventually a manager got on the phone and told him (between his screams), "Look, you're not getting any phone support because it doesn't exist. There's nowhere for us to transfer you. There's nobody who can call you back about this. Your only option is to search the forums for an answer to your problem. I am going to terminate this call now. Sir, I'm going to terminate this call. No, we can't help you. Nobody at Google can help you. I am terminating this call now. We asked you to stop calling this number. Do not call us again. <click>"

I'd frequently tell my co-workers, "If you're not paying for it, you're the product." That experience underscored that notion for me.


Even when you have paid Google products that come with support, it is really awful. They once asked me to submit a business case justifying how answering my support question benefited Google. Just a simple clarification of something in their documentation. I was already under pressure to migrate to Office360, I stopped fighting after that.

My employer is a huge AWS user and Google is constantly chasing us with a treasure chest of free credit to migrate over, their prices are significantly cheaper, but everyone agrees it’s worth the premium to stay with AWS simply because they answer the phone.

(If you have never used AWS’s enterprise support, those guys are worth every penny.)


I've first hand experience with managing a google workspace (50 users) and an Azure AD (30 users). With google workspace, the chat is two click away and the guys now their stuff. With Azure AD, no support, no chat, except "here is a list of consultant in your area that provide support". And I pay twice as much to microsoft ...


I work at a company with >1000 google workspace users.

That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed.

The support may be good if you're asking questions they've heard before - or if you need something like an account lock reset, which the support folks have a button for. But if the problem you're encountering requires a code change? Not so much.

(If you're wondering, the bug is "in Google Drive, users with third-party cookies disabled get stuck in a redirect loop when downloading files or viewing videos, as the cross-origin request to googleusercontent.com attempts to redirect to get an auth cookie that never arrives" )


I’m sure that in the mind of Google they are doing a favor by letting us give them money, wanting support is just ungrateful. Wanting a bug fix is just obscene. They have 150,000 PhDs, aren’t we bold to question them!


This stems from Google not being a service company. Support for products is mostly like this. You can submit a bug report but that does not mean they will help you.

We have a saying here that goes something like "don't buy pizza at a burger joint"... Don't buy services from a advertising / products company.


>Don't buy services from a advertising / products company.

I will remember this. Thanks.


Turns out, having a PhD is a negative when it comes to closing bugs.


> I work at a company with >1000 google workspace users.

> That's enough that someone at Google will acknowledge what you're reporting is a bug on their end, and that they can reproduce it. But it's not enough to get the bug fixed.

I will try to remember that the next time I deal with an open-source project, either as a user raising an issue, or as a project contributor helping solve such issues.

Often, we do not realize how lucky we are that contributors to open-source projects help fix the bugs which we report.


That must have been fixed. I got a message to enable third party cookies for drive.google.com. Even with a link to docs on how to do it iirc.


I just tested, and it's not fixed.


I hesitated to post this comment, another anecdote with zero recourse... Then realised the fact I hesitated is more concerning.

Google hold too much control over the internet and the majority of internet users lives, to the point where it's almost authoritarian: They can screw with your personal life and potentially your business without any recourse, causing the effects such as the one I just experienced. I'm not suggesting some large conspiracy against those who oppose Google's affect on the web, and many of us will continue to complain openly and loudly about them because that is our culture. But the effect their position has on freedom of speech is still present, it's a natural instinct, it increases the chances of a large portion of the population to remain silent out of personal fear - and that is concerning.


> Even when you have paid Google products that come with support, it is really awful

Once I subscribed to YouTube Music (paid!) family plan, but my wife's account would always say that she is in another country and can not join the plan. I tried everything - the support never even bothered to reply to my emails. I cancelled the plan and since then I keep seeing the same ads for the premium service every time I open the YT mobile app.


FWIW I had the same problem a few months ago, and they did eventually sort me out. This surprised me, given Google's reputation. I was on the 1-month "free trial" membership, and always planned to switch to the single-person membership if they didn't get it sorted out, so I wasn't really out any money during that time.

(And in fact, what actually happened was they hadn't sorted me out by the time the free trial was up, so I cancelled it and switched to the individual membership. They managed to get things sorted out a week or two after that, but I'm still on the individual membership; my wife just shares my account ID.)


I can second that. Lots of G services think I'm in another country (Spain specifically), so the sites load in Spanish by default, along with other minor headaches.


I work for a small company and we used to use AWS. I think their support sucks. Especially since there is no group accounts and the bills went to another persons account that ended his job at the company.

I had to login to both mine and his account in order to complete my support request or they wouldn't help me. When I called them it was like any crappy indian support team which I barely could understand.

Compare that to DigitalOcean for example, there you can actually group resources for an org and their support is actually knowledgeable about their products and can answer questions even about implementation details. Also, you don't need a PhD in order to understand the UI which is a great plus.


> They once asked me to submit a business case justifying how answering my support question benefited Google.

I find that extremely difficult to believe without more context. Google support isn’t that bad. I’ve had a mediocre-to-good experience with it over the years.

With that said, while I agree that aws business and enterprise support is worth the hundreds to thousands of dollars a month, so is the five bucks a month for a google workspace account that includes support.


A few years back I wanted to call then but didn’t find a number. How do you contact Google’s support?


If you have a google workspace account and need google support, you can go in the admin console, help section in the top right, there is a contact form with phone and chat options.


What if you can't log in?


Then there's this magic link: https://support.google.com/a/contact/recovery_form (calling it magic because it's not very obvious how to find it; I had to look it up in the HN comments)


Can confirm. Despite strong reservations about moving from one behemoth to another, the support from Amazon has been light years better (both on the consumer side and AWS). Embarassingly better.


> Google is constantly chasing us with a treasure chest of free credit to migrate

The only item in Google's business playbook...


You are actually pointing out a tremendous opportunity that Google has internally and externally. I work at Google and recently tried to file a bug about the calculator embedded in search. It was dastardly difficult to find how to file the ticket. It took me maybe an hour. A better system for filing tickets internally and for filing and triaging tickets from external users would be a tremendous asset for Google.


I guess this is why Amazon is playing the long game with their obsessive focus on customers. I don't know how that really plays out where the rubber meets the road but that's what Jeff bezos always keeps talking about.


It plays out with Amazon absolutely crushing Google when it tried to be a consumer marketplace, and even trouncing Google at providing web infrastructure services.

If, somehow, an antitrust ruling split ads from the rest of Google the non-ads remainder wouldn't last more than a few years.


Alphabet as a whole is an organization built by the immense money that comes from monopolizing digital advertising (through some very... unscrupulous means) and then run by people deluding themselves into thinking they can do anything else. There's a reason everything is "killed by google" - I'm not exactly sure anyone there knows how to do damn near anything that isn't propped up by investor hype and the money they make from ads and other strictly profitable ventures such as GCP. Alphabet only has the ability to do immensely stupid things because their core business gives them damn near infinite money to play with.

You are 100% correct in that ads are the ONLY thing propping up google as a business. This is probably a very bold prediction, but I think that when money starts getting more expensive, when rich billionaires are more reluctant to just throw money at inane, borderline speculative bullshit, there will be a massive hemorrhaging of unnecessary business. And maybe this is a little out there but... you know how YouTube doesn't actually make any fucking money?

Interesting things to think about for sure.


The YouTube thing is false as of a few years ago. If you have noticed, they've crammed it full of ads.

https://www.theverge.com/2021/7/27/22596592/google-q2-2021-r...

I think it's projected to earn 20 billion this year.


Thanks for this. I've heard recently that, in its current form, digital advertising is extremely overpriced and propped up by misleading metrics [1] and might take a downturn in the future, but I also don't really know much about it and and that point it's just speculation.

[1] https://hbr.org/2021/02/what-digital-advertising-gets-wrong


Not sure about that... It could be a blessing for the tech community if that happens. Let's consider 3 parts: Ads, Cloud and Labs. Alphabet could fund Labs as research arm (basically what it is anyway, with all the exploratory projects) and could like see a revival of the golden days times of Bell Labs, Xerox Park, etc.


Really?

I am locked out of my (10+ years old) account for almost two years, due to "security reasons" (I have valid OTP so I call this BS and my credit card has changed in between so the account is useless for anyone), they want me to call some number in states, but I am not giving my phone number away, which is also the reason why I don't create new account.

I have calculations, in last two years I have bought 4378 EUR online. This could be collected by Amazon - but now it isn't.

I am still waiting when they will come to their senses and figure out that locking out users (especially if they made quite a few purchases) longer than few months is counterproductive.

Meanwhile they are losing money they could earn. Good job.


I'm not sure how you came to be in this unfortunate situation but this is one of the reasons I purposely memorize my passwords rather than store them in a password locker or Auto filler that I could lose access to. I guess if I lose access to my brain I'm not going to be worrying about what I might owe for those instances that I never killed on that cloud service.


Just use a phone number from a service like temp-number.org. After logging in you will be able to remove it from your account.


I worked at both Amazon and Google. It was only at Amazon where I was exposed to the Craft of software development. Personally, I feel there is a nuanced difference to the role at Amazon being SDE ( Software Development Engineer ) whereas Google is SWE ( Software Engineer ). It's almost like Google thinks Software Developers are lower tier than Software Engineers, but I'd like to think of myself as doing more than just engineering and tweaking things which already exist.

The team I was on at Amazon every line of code felt purposeful. At Google it's just Java charades. One time we were propping up a new micro service that received data from one data source, transformed it to another data source. That's it. No other API calls, no algorithms, no design patterns, no filtering, just deserialize/serializing/renaming fields between two data formats 1:1. It's literally a few dozen lines of code. I was the project lead and was likely going to be sole person responsible for it, and I proposed it be written in Go. It took to me 2 days to implement it in Go. Our manager wanted it rewritten in Java, because no one on the team knew Go and in his opinion would want to learn Go. The Java rewrite took a month to get to an MVP "Hello World" state, and another month to calibrate the codebase with the rest of our projects. It takes days to learn Go, less than a month to be well-versed in Go's standard library. Its package management is simple but also sane. Years working with Gradle and there is still weird stuff popping up every so often. The microservice depended on some Google "public" client libraries. At least with the Go libraries it's feasible to read the entire source code and flesh out things on the edge of documentation. Go's limitations also means code tends toward being idiomatic and standard. Besides the Maps API and some GCP products that receive attention, most of the APIs/libraries feel half-baked for external consumption. Documentation is a big piece of it. I'm not sure what the state of AWS documentation is nowadays but, on my Amazon team, we were co-developing documentation and code in unison, like how people iterate between test/code.

At Google, documentation feels like an after the fact dread so that a bunch of suits ( dressed in jeans and t-shirt ) can green light the project and sign off on a laundry list of due diligence of "product excellence". The final product is documentation that centers around a Hello World, but after that you're often not sure how to proceed. You're instructed to run a bunch of commands serially without much context, basically the fish, but you didn't really learn how to fish. Beyond this imperative 'Hello World' style documentation is nuanced callouts and notes for some esoteric cases for exhaustive coverage purposes that is just really distracting for 99% of clients. Basically don't sue us, we made sure to mention is in documentation. I've worked extensively with the Google Cloud documentation org, and they are really problematic. Google is usually too nice ( or maybe it's just the game dynamic of everyone having cushy job ) to fire people, whereas Amazon would go in a "different direction". I don't see this documentation problem going away until there is leadership who isn't afraid to fire people, which is also unlikely to happen as the well intentioned engineers will quickly rally to dispose of this style of leadership. One time the documentation org held a session for internal developers to provide feedback because clearly documentation is not serving the customers. They were shutting down every idea and interrupted in mid-sentence, only agreeing with things that confirmed/supported their agenda. Then working 1:1 with members of the documentation team to launch a product, I realized the individuals also succumbed to selective hearing. They're like recruiters who just scan for buzzwords like 'REST', 'HTTP', and so Google documentation has random sentences explaining to technical clients of a specific technical API what REST, HTTP, gRPC is. The intended audience are paying clients, and I'm not talking about hobbyists, not students who are not familiar with cURL yet, but the documentation writers are effectively the latter. I admit, the documentation staff write more fluid English than I do, but what's the point if they introduce a bunch of superfluous, sometimes even semantically meaningless, sentences wherein readers of documentation can't discern the forest from the trees? It became a second job for me to revise the documentation, and my manager wasn't supportive nor appreciative of me doing this non-engineering work. That's when I started planning my resignation. If Google is serious about cloud and developers, the problem can be solved by paying actual engineers to write documentation.

Code Review at Amazon felt constructive with the user in mind. Code Reviews at Google felt reductive to the pet peeves of the reviewer and minimizing conflict. On that team at Amazon, performance was actually a priority. I actually felt like my Computer Science degree was put to use, but not in a pretentious, ivory tower, scratching your own itch/ego kind of way. The latter opportunities are more common at Google. The Amazon team built their own dependency injector and markup language, not because it was something to brag about, but it was solving an unmet need at the time. HackerNews never forgets about the long list of products Google abandons, but there are also the projects that are dead in the water. At Google, I was adjacent to a team reinventing HTML but defined in YAML, with less functionality and composability than HTML but implicitly requires you to already know HTML. Probably 10,000 humanhours were allocated to this project. The team are exclusively from infrastructure backgrounds. No one wants to say this, but there is a belief, at least based on my impression of Google hiring practices, that backend engineers have higher aptitude, therefore you can train them to be frontend engineers. I don't think this is true. Ironically, when I interviewed at Microsoft they actually asked me interviewing questions requiring browser APIs and interacting directly with the DOM. When I was the technical interviewer at Google, asking candidates such practical questions rather than Leetcode-style problems tripped them up way more. On the Amazon team I worked with, everyone's first programming language is JavaScript. We directly fiddled with the DOM which goes against all the modern web framework abstractions, VanillaJS, native browser APIs, minimal transpiling for compatibility. This was code 1-degree removed from the user and, ironically, as we were fiddling with the DOM and exposing ourselves to all the dangerous state, nothing bad happened. Then again, we sent people to the moon with much less. At Google, I felt n-degrees removed from the user, while standing on top of many more abstractions and yet in many product areas besides things like Search, 99.5% felt good enough, whereas at Amazon I truly believed in 99.999%. On the Amazon team we leaned on Prototypical "inheritance" and embraced JavaScript, rather than trying to fight it, shoe-horning in Java style Classes, because Google ultimately is a Java shop. Angular has singletons, factories, and other symptoms of people exercising their extensive knowledge on the design patterns in Gang of Four. Meanwhile at Google, I saw triply nested for-loops that I refactored to linear time. It wasn't really appreciated, because on the grand scheme of things, Google focuses on being planet scale, which might explain why SMB / hobbyist support for GCP is mediocre. Indeed, Google infra and internal tools are the best. Possibly even over-engineered where there is diminishing returns, possibly inflecting down on productivity because the tools handles too much for you that you are now responsible for knowing its extensive features and capability set. There's always someone who knows, but you gotta make sure you've done your research before you come to them without extensive due diligence. At other places I've worked, including Amazon, I think there is less anxiety in knowing that you don't know and ignorantly reaching out for help because we're all fools anyways. Google has publicly mentioned that they found no correlation between academic GPA and job success, but I'd bet there is a high degree of imposter syndrome. In practice, Google still selects for the academically excellent, where from an academic and school setting you are expected to know the "right answer", but software engineering is an art not a science.

Products, however, are different story. I am back in school, and the school decided to use Google Classroom. This thing has a 1.5/5 rating on the Apple app store. I'm curious how many people work on it. I apologize if it's a lone developer. But I wouldn't be surprised if this was a team of 3-4+ engineers, a product manager, a manager, a UX designer, a UX researcher. Google Classroom, at least in my school's usage, is just a feed of posts. A Facebook group would have sufficed and been much better. I'm imagining there's a sales team for Google Classroom. At least Google's improving on the non-search/Ads business front.


I'm a developer and a school admin, so I can comment on the Classroom point, at least: It is so comically clear that Classroom really was someone's clever idea to simply take existing Google Drive APIs and then create an LMS-like environment using that. Taken like that, it's actually brilliant and super clever.

The not-so-brilliant-and-clever part is that by virtue of being free and Google having so many schools captive with free GoogleEDU + Chromebooks, this is something running millions' of kids' schooling, especially now during COVID. But it seems, at every indication, to continue to be someone's pet Google Drive API project, so you see some insane feature omissions because it is clear it would probably require some sort of actual original development work besides the very minimal UI and overhead that Classroom provides. I need to thread lightly, though, 'cause I've made decent money (and had fun) implementing quite a few of these for my own school, but every single time its been clear to me that EVERY OTHER SCHOOL IN THE UNIVERSE would also want/need things like that.


I'm also a developer and an educator using Classroom for a small class. Your insight makes it crystal clear why I always thought that Classroom was completely insane, to the point where I was wondering why nobody else said anything and maybe I just wasn't "getting it" - no, it's because it's basically a clever hack that's a Googler's side project (that maybe now has a small team around it).


As a fun exercise, I'd encourage you to peruse even their apps script APIs and see how quickly you can actually get something like "google classroom" up and running for yourself, minus some of the UI candy. Truth-be-told their documentation and what they expose to you is pretty rich, and along the way you then start seeing exactly why "Google Classroom" things are the way they are hehehe.


This is enlightening.

I do see they have a marketing / landing page which makes me feel there is a product charter beyond half-a-SWE: https://edu.google.com/products/classroom/


Awesome informative answer. Thank you so much! this is like the kind of nuanced detailed thing would be good to see on Glassdoor


Thanks for the insights! Surprising that Go met resistance internally at Google, considering that Go is created by Google and that Google have been sued by Oracle for using Java in Android.


It's a bit ironic that you're bashing Google and praising Go in the same paragraph, never mentioning that Go is designed and supported by Google.


I think that was part of the point. Google made Go and then when OP wanted to use Go, their bosses said “use Java” (and took a month to do something that could be done in a few days)


I disagree with OP on this. Their boss in my opinion made the right call. I'd say for a few reasons:

1. Why did OP do this without talking through it first

2. Introducing a new language to a team is not some small decision, and IMO typically not a good idea

3. Why would it take a month in Java to do what takes a few days in Go

4. If it made this one task faster, the burden it will put on the team in the future can be bad in the long run

Perhaps the team would benefit a move to Go (I doubt that), but it should be something that is planned. Otherwise, they'll have "that" one thing that is written in a language that no one on the team really knows.


> Their boss in my opinion made the right call. I'd say for a few reasons:

Well you don't have enough context to say it was the right call.

> 1. Why did OP do this without talking through it first

I was tasked to prototype / MVP / "tracer dart" and prove that it was feasible. As proven, it took 2 days in Go. If it was done with Unix commands, the pieces can be jumbled together in a day. The point was having a self-contained "documentation via code" example of the exact business logic in such a program. The same can be achieved with a shell scripting language, but it wouldn't have been as readable. Go is about readibility, which is exactly the reason why it was invented Google, because Google prioritizes readibility. Java is readable if you know what idioms and style it's in, but it's also verbose, which is distracting. One, communicating with the source and sink. Two, get an initial picture of nuances in the Protobufs and data format. It happens to be that the Go prototype was 85-90% close to a final solution. In Java, after being able to actually bundle and consume the libraries had undocumented idiosyncrasies. Java is more powerful and thus more flexible, so a Hello World solution could might be in the wrong direction. You have options, no pun intended, on how you handle async.

> 2. Introducing a new language to a team is not some small decision, and IMO typically not a good idea

There was already half a dozen programming languages on the team's codebase, include a Go server which we inherited. So in effect, we should know Go anyways. As much as Google is Java shop, engineers are polyglot and not hired for a single language, in theory.

> 3. Why would it take a month in Java to do what takes a few days in Go

The language itself. Async code is verbose. Opinionated debates over variables should use the keyword final. Debating whether to use inheritance, delegation, function, or whatever composition / code-reuse pattern. It's been empirically shown Java programs are more verbose than other languages, both in tokens and in LoC. Complexity and entropy doesn't scale linearly, either. This is reflected in both client code and library code, which in the case of Google for many libraries is stale and misleading. One such library is authentication. For Java, Google has multiple competing libraries, or you can carve authentication features out of another feature library, but that is wrapped around and pegged to an older version. Something like JavaScript, there is 3 public sets of documentation on OAuth2 in JavaScript, and like 2.5 clients. With Go, there is a single canonical version, and so just figuring out what library you should use is a fraction of the troubles.

Then there is the ecosystem as a whole. You have options for logging library, and getting Gradle and the building system to pull in the dependencies, especially when you are on internal networks, is one thing. Aligning the Gradle build to be consistent with idiosyncrasies of the team's existing codebase is another. You can do inheritance with Gradle, and that's what was involved to be "consistent", because copy-and-pasting code is a no go.

> 4. If it made this one task faster, the burden it will put on the team in the future can be bad in the long run

That's a strawcut. What you are referring to is taking shortcuts, choosing a suboptimal solution because it saved time. Go was purpose built for middleware and microservices. It was the tool for the job, independent of how long it took to build the MVP. Beyond that, tess code is always better. If there was less code needed to build it, there is less code to maintain.

Google cares about code readability. This is exactly why Go was invented. Go is built readable language. Readability is what engenders low maintenance cost burden.

> Perhaps the team would benefit a move to Go (I doubt that)

No, it was not about a wholesale migration to Go. It was about using the right tool for the job, in one specific microservice, instead of having the Java and turning everything into a nail. Imagine if a company was a PHP shop and said everything had to be written in PHP. Frontends, backends, MapReduce jobs. This is the whole point about federating to microservices instead of monoliths. Or JavaScript, JavaScript everything. Hey, that's not bad, Coinbase was built solely on JavaScript. The argument might make sense if this was an esoteric language or a Lisp, but this is Go, which is, in theory, an official programming language at Google.


Thanks for adding more context.

You do seem to be making assumptions and having expectations on how the team and how Google should operate. Regarding Java, I don't find the claims that Java isn't as good as Go compelling. For you, sure, but to make general claims is silly. There are many successful companies and productive developers using Java.

There are probably companies that are very productive in how you would want to pick and choose languages based on the problem. IMO, the language choice is not all that important, though I do think PHP, JavaScript, and similarly poorly designed languages are probably a hinderance (but again there are many successful companies using these like you said, so I think that's convincing that the language doesn't really matter all that much).


It could be part of the point but it does not sound like it.

It could say - Google is bad in that and that BUT it has Go. Or it could say - Google designed Go and is interested in its adoption BUT its own managers don't think that Google developers want to learn Go.

But instead it says that Google documentation "does not teach you how to fish" and "you're not sure how to proceed" and at the same time Go somehow gets away with it - "At least with the Go libraries it's feasible to read the entire source code and flesh out things on the edge of documentation".


> It could say - Google is bad in that and that BUT it has Go. Or it could say - Google designed Go and is interested in its adoption BUT its own managers don't think that Google developers want to learn Go.

It's implied. In fact, Go is an "officially" supported language, meaning there is a dedicated team to maintain tooling around the Go ecosystem, sweep for security issues, keep "runtimes" (in this case the compiler and binaries) up to date.

> But instead it says that Google documentation "does not teach you how to fish" and "you're not sure how to proceed" and at the same time Go somehow gets away with it - "At least with the Go libraries it's feasible to read the entire source code and flesh out things on the edge of documentation".

If documentation is going to be equally bad either ways ( that's something I've resigned with), then all else being equal the library implementation which is easier to read would be preferred.

That said, Go being idiomatic also means generated documentation is more standardized. Java has JavaDoc, but that's not enforced or culturally as consistent as Go.


Interesting take. It sounds like you really dislike Google. It also sounds like your manager had something to do with it. Perhaps it was a lack of promotion?

Since you’ve worked at both, do you have an opinion on why protocol buffers aren’t more widely adopted than json?


> It sounds like you really dislike Google

Google's a great if you want a high standard of living and being pampered. Not the highest pay, but it's more relaxed.

Also if you have a PhD. Google could be a research playground for you.

Everyone at Google is or appears nice. I had a slightly mean team lead at Google once, but he's been always my favorite. Highly technical, no BS, little patience when I wasn't hyper focused. One of my coworkers at Amazon weren't nice, and just confronted me with feedback that I should show up exactly at 9A.M. I appreciate having honest and direct feedback like this, and this is where I grew the most. I don't think I ever received negative feedback at Google, even though I probably should have. Some people prefer environments where everyone is perfectly nice and happy all the time. I think I would like Google more if we didn't sugar-coat things. That would prune products and people who are deadweight, even if that possibly means me. I respect the Finance industry to the degree that they do not mask their profit motive.

> It also sounds like your manager had something to do with it.

Of course. People leave managers, not companies. That said, the managers are part of a system. I did shop around for other teams before I left, but they were all boilerplate CRUD work. CRUD work's also fine, but the value of these projects to users was not clear to me.

> Perhaps it was a lack of promotion?

I'd say that is a symptom, not the cause. It's about being appreciated and having your work understood.

> do you have an opinion on why protocol buffers aren’t more widely adopted than json?

I think some people dwell on the performance difference. I think adoption boils down to ergonomics, ease of use, and tooling. Within Google, there has been significant investment in internal tools/libraries around Protobuf especially Java. For something like Protobuf, it's not broken, why fix it? People at Google are familiar with Protobuf. The outside world is familiar with JSON. When I was at Google, I launched a gRPC/Protobuf API but our clients had significant hardship onboarding. I think this is within the theme of externalized Google tech being inferior to the internal version solely from the aspect of ease-of-use/documentation.

Until TypeScript came around, I think an argument can be made against JSON as lacking type safety. I used TypeScript when it was still in Beta and felt Google was reluctant to this. It doesn't help that TypeScript was pioneered by MicroSoft. To be fair, at the time people didn't trust Microsoft. I mean, people were trusting Chrome more than IE for good reason. Once people actually give TypeScript, I think it's a no brainer


Thanks for the detailed posts. This can be useful for ppl considering applying there.

I work for Elastic for the last 6y or so and I feel I’ve been lucky to have managers who cared (for customers, also for the team), provided actionable feedback, and put me in projects that lined up with my strengths and interests. I feel a lot of that is encouraged by the company culture, but esp two individuals I have in mind—I think they’d behave like that in any other company (or burn out quickly).

Would you mind sharing if this was SV or some other region? Do you know if this would a “general” culture for Google/AWS, or limited to certain teams or offices?


https://issuetracker.google.com/ is supposed to be it, but if it were completely open and easy to use i'm sure they'd need a dedicated moderation team just for filtering the issues. The knowledge and dedication barrier is a frustrating but mostly effective way to weed out those with non-issues or issues that really don't affect them much (however humane you believe that is).


I mean yeah, then they should put up a dedicated moderation team to do so. It's not like they have not enough money to do so.


You are actually pointing out a tremendous opportunity that Google has internally and externally.

While there isn't a way to report problems, or get help with problems, and problems aren't tracked or measured, every problem is a singular example that can be hand-waved away with an "it's just that particular user being dumb".

Refusing to support customers is a choice Google has made in order to be able to ignore problems the engineers won't (or can't) solve.


(edited)

If you don't mind sharing, what is the bug?

-

My comment originally read as follows, 2 people downvoted it.

>I work at Google and recently tried to file a bug about the calculator embedded in search. It was dastardly difficult to find how to file the ticket. It took me maybe an hour. A better system for filing tickets internally and for filing and triaging tickets from external users would be a tremendous asset for Google.

I didn't work for Google directly but I did work via another company (Tech Mahindra) so I am saying this as somewhat of an outsider compared with you.

You mention a bug about the calculator embedded in search: could you give me the details, and I can try to get it solved via my Google contacts.

For context, in my personal experience as a user and engineer, the Google embedded calculator is the best product among all of Google's many offerings and works flawlessly for all inputs. I find it breathtaking. For example, here is how many feet times pounds you can turn 3000 Calories into:

https://ibb.co/qJ0Qz0L

it worked on my first attempt. What does this mean? Well here's a foot-pound: https://ibb.co/N3WCxYV

If you weigh 180 pounds you're not climbing Mt. Everest twice (29,032′) without burning 3000 Calories. (Even at 100% efficiency).

Try getting a result like that from any other calculator (though Wolfram Alpha gets close).

What's the bug you tried to report? (What did you enter, what is the correct output and why is it correct, and what is the returned output and why is it incorrect?)

I've never seen it make a mistake so far, and I use it heavily for all sorts of things. (Sometimes I force Google to show me the calculator by typing = at the end of my Google query.) Since the product works so well for me personally, I'd love to understand what problem you have with it.


You just found a bug in Google Calculator. You wrote "calories" but Google is giving you the answer in "kilocalories". If you change "calories" to "kilocalories" the answer doesn't change.

I wonder how many times in the past has it given you the wrong answer without you noticing?


I agree with the other person who replied to you. By 3000 calories I meant 3000 Calories, which is how people use it. My input is sloppy, Google turns its output into something rigorous.

As the other person replied, it is labelled precisely.


That's what people mean by calories, it's not a bug. It even labels it precisely!


Yes, I agree.


I tired 1000 millicalories, but doesn't look like Google understands that either.


> A better system for filing tickets internally and for filing and triaging tickets from external users would be a tremendous asset for Google.

The problem is not that they don't have a tool; they could easily build one almost overnight. They have a glut of very competent technical labor, lots of capital, infrastructure up the ass.

They don't care.

The tech people are convinced they're geniuses who build stuff that never breaks.

The business people think they've figured out every problem a user could have and are satisfied that the documentation and snippets of help text are sufficient.

The accountants say "it would cost us more to create such a system and staff it than we would lose in business from not addressing it."


If it's about search, you could always use go/bad I think?


Did GUTS not survive? When I left, it was pretty solid. Some very close friends of mine spent years on that system. Haven't thought about it in a while but it was so simple and easy. Then again, that was a decade ago.


GUTS is still used for things like desk moves, but buganizer is where eng tickets live. (at least when I left a few years ago)


The discoverability may not be the best, but its not terrible. There's a "Send Feedback" button on most search result pages (and specific ones per-result if you click the 3-dot menus). The same "Send Feedback" thing is available in Gmail (though its hidden in a (?) menu), Youtube etc.

IME that feedback is generally taken seriously.


Maybe they don't want you to file the bug too easily?

I imagine Google would getting 10,000s bugs per day if it was too easy.


I'd rather know where my ship is burning instead of closing my eyes and just having happy thoughts.

But then, I am an engineer, not some marketing drone...


Rest assured that they fix their AdSense and AdWords bugs very very fast.


Curious but how would you figure out where the ship is burning if you are receiving a larger number of bug reports, e.g. 1 million bug reports per month?

Loads of duplication will also follow etc. Sounds like you need entire teams to figure out what the real bugs are at that point and maintain the bug list? Though I can't think of a workflow from the top of my head.


This very much is a solved problem - it comes down to standardization in tools, categorization of incidents, keyword analysis of incident description, and (probably automatable) correlation with logfiles and identifiers. Preventive maintenance is not a concept that has been around only recently, and a good QA team has a whole toolkit of things to throw at code before it hits the customer. And yes, ultimately, it is a question on whether you invest the resources to deal with the dumpster fire, or just let it burn to ashes. I am also a big believer in "You build it, you run it", and a "no new features as long as there are open bug tickets" approaches, making teams responsible for their own technical debt.

Google with it's "Let's never maintain our products, let the bitrot make them gradually worse and eventually EOL them" approach seems to prefer to avoid that kind of cost.

I used to be a Google fanboy in the early 2000s. Maybe it's coming with age, but these days I prefer boring tech that works well as compared than half-baked moonshots, and Google may have burned me once too many. Other software megacorps (and even some NGOs) do this better than the big G.


> "If you're not paying for it, you're the product."

Xoogler here - actually we used to say "if you are not buying advertising from us, Google can't help you at all".

And just recently I am great example of that. I used to have a Gsuite account at $6/per month for 3 years, then decided to give up on it b/c I wasn't using it. But unfortunately the domain expired before I could properly disconnect it and cancel my account. You can probably already imagine at this point what kind of hell I went thru with "google help". Ultimately I had someone from India called me 3 times to explain - the questionnaire they sent me has to be answer in specific format: each question has to have one paragraph space, then tab (9), then my answer. I kid you not! I spent 3 weeks, been transferred over email ticket about 10 times and every time they told me the same thing. Even if I did exactly how they want it - I guess email was automatically eating up the tabulate key and replacing it with spaces. Eventually a buddy of mine who still works there (different dept) told me customer support forwards your email to some account that parses message automatically, and they cannot even change one single letter in your message. Even when explaining them on the phone that I am following up with their stupid protocol of one new line, then tab, then my answer, then next line must be second question, their program must be messing it up.

Eventually I gave up on their customer support. It took me/them six months of chargeback disputes for $6 each month until my account must have popped out on someones screen and Google employee gave me 3.5 seconds of their time to click "close this account".


Once we were having trouble with GKE hosted in Asia, it was causing out business a major outage and it wasn't something which I had the power to fix, from memory, half way through a cluster upgrade, Google ran out of compute so the upgrade was stuck half and the control plane ended up in a bad state and some how this impacted the networking (it shouldn't but it happened). I was unable to provision a new cluster due to the lack of capacity so we were stuck.

This wasn't the first problem we'd had either.

There was absolutely no one to call, no one to even alert to warn other customers, the status pages were all green.

Instead of bothering with Google, I just opened an account on AWS and migrated whole stack to AWS in ~ 3 hours, pointed DNS at the new load balancers and we never went back and continued doing business without issue for as long as I can remember.


I'm certainly far from finding excuses for Google, but I have strong doubts when reading stories like this. I wonder how is this possible? If you check their support packages at https://cloud.google.com/support/, they provide different options based on how much you are willing to pay. The premium package gives you 15 minute response time and a personal TAM. What am I missing here? They promise a service, but it doesn't work?

AWS seems to also have support packages: https://aws.amazon.com/premiumsupport/plans/, and their response times are also not supposed to be instant.


Have you ever tried to get one of those packages ? You need to have an interview etc.It’s not straight forward or cheap. We tried to sign up and have a TAM assigned but gave up. It was a lot of effort.

Amazon gives great support at an affordable price.


It's pretty crazy to think about the fact that your email is de-facto your online identity, as it is the universal second factor that is used as a fallback if other login mechanisms fail. An email service is two things: a global name user@emailprovider.tld, which is really your online identity, and an email service that hosts the SMTP, IMAP and DNS services required for the identity to function. People are willing to hand over not just the ownership of the service but also their global digital identity (the email address) to a third-party which now assumes total control of it, and which does not have any interest in supporting you. It is a major hassle to move to another provider, even a paid one, because your email address is tied to the service provider.

Because email addresses are practically a requirement to function in society, I think they should be a public service. Everyone should have the right to get an email address controlled by a public service institution which guarantees you that you can move between service providers as you please. There could even be a standardized protocol that service providers could use to easily update DNS entries when the user requests a move, assuming that you can identify yourself via some other means.


I fully agree. Over the years I've been reading about people being locked out of their Gmail accounts, and the YEARS of pain they had to go through to try to regain access to the countless connected services. You don't realise how many hundreds of services require access to your email account until you lose access. The final straw was reading the heartbreaking account of someone who lost decades worth of personal pictures, critical emails, and access to everything that mattered to him. Google's response was worse than "get lost."

So I bought my own domain and have spent the last year slowly migrating everything over. I'm still only ~30% of the way there. My whole life was centered around that Gmail address, and I could have lost it in an instant for any and no reason at all. It's horrifying, and happens to perhaps thousands of people every day. As we continue to SaaSify everything this problem is going to come to the fore sooner rather than later. Our entire lives live in the cloud now and it can be deleted without cause or notice.

At the very least I would like to see governments issue people a free state email address which can be hosted anywhere. Email is now a necessity.


Keep it up though. And encourage a friend.


> Because email addresses are practically a requirement to function in society, I think they should be a public service. Everyone should have the right to get an email address controlled by a public service institution which guarantees you that you can move between service providers as you please.

In some countries it has already been for a long time, for example Estonia gives everyone by default an email address that is tied to their national ID and you can forward mail from that address to any provider you want.

Edit: Anybody barely uses it though because usually there is no need. But it's there in case you want to use it.


In the US, I have long thought the USPS missed several good opportunities to get involved in the internet revolution in the 90s. This is a major one.


The service you propose will either have the same problem as google, be vulnerable to social engineering attacks (like phone number providers), or be tied to extremely expensive infrastructure (e.g. enable post office or DMV offices to validate identity for the purposes of managing access to this account).

Even if google had customer support agents, what do you want them to do in cases like this? They can't actually validate anyone as the owner of an account, they'd simply be the targets of people begging to access accounts.

Edit: the implication being, we probably simply need most people to just not depend on email for anything important. Unless you can maintain multiple 2FA methods, your email account isn't reliable enough to be trusted with important things.


In my country (Denmark) every person and legal entity has a government-issued digital identity (NemID) so the authentication process is trivial and cheap.


Did they fix the security flaws mentioned on https://en.wikipedia.org/wiki/NemID yet?


The provider of the system is being replaced, which means that NemID will be replaced with MitID. This solves some security issues, but brings others. Most importantly, MitID, unlike NemID, does not allow the service provider to embed the login form, but always sends you to the identity provider to log in. On the other hand, you no longer need to input both a password and use a second factor (key card, code generator or phone app). In MitID, it is enough to enter your username and approve in the phone app. This is quite bad, and has led to the comical recommendation that you should pick a username that is hard to guess. Comical because the main argument for not requiring a password is to make the system easier to use, because passwords are hard to remember.


Probably need to call the Estonians


Same in the Netherlands with DigiD. The name is an awful pun. Very Dutch.


Yes, it would be "tied to extremely expensive infrastructure" ... that already exists. So no additional cost.


You’d wonder why they have corporate sales. I’ve worked in enterprise for a long time and we’d laugh at the notion whenever someone suggested we buy any Google service because easy access to phone support when things go wrong is one of the key selling points in enterprise.

It’s why Microsoft has done so well for itself in this area over the decades. Sure Office helps, but the fact that your operations guys can be on the phone with their Seattle based offices, and get hourly updates where Microsoft calls you, when something big goes wrong is pure gold to any IT manager in any enterprise. Not only because it lets you solve issues faster, but also because you can tell the organisation that IT is on the phone with Microsoft’s head offices and you are working on a solution with them.


>about how he paid Google something for some service

>I'd frequently tell my co-workers, "If you're not paying for it, you're the product."

it seems even if he did pay he was the product, which frankly jibes with my experience of paying for things at Google.


If you pay for it, you simply like it like this.


As a normal rule I don't know what customer service is like at a company I'm paying for things at, until I have something go wrong and I realize it sucks.


only tangentially related but that phrase is a pet peeve of mine. You are always the product if you are using software - free or paid. Netflix is sure as hell going to use your data the same way youtube would.

The only exception of course is most but not all FOSS.


I think there’s a difference. “You are the product” means that your usage and data are the primary thing the company develops (with software) so it can be sold to their actual customers, namely, advertisers.

I’ve been involved with many software companies that gather various metrics (analytics, crash logs, user info, etc.) but do not sell that data to anyone. As such, the user is not “the product” but the customer. I think there’s a meaningful difference here.


In those cases the user is an asset for the company. And not "asset" in a good way if you ask me. It's more of an resource than anything noble.


Since it's a pet peeve we share I'll add... I feel it's a bi-directional exchange. A trade. I consume a product (Gmail) and they consume a product (my personal information). At best I'd be "a" product not exclusively "the" product.


Self hosted is the only good future


I kind of agree and would like to try selfhosting stuff for myself, but in the future where should the self hosting lie? Not everyone can self host (your mother, cousin, etc, people with disabilities, etc) So if it is the future, would level of society would host it reliably? Family, government, etc. Everything seems problematic either in terms of practicality and security.


Is that true for Apple?


You are the product Apple sells to app developers for 30% of their income. Notice that you are not allowed to do things that interfere with this.


That's not at all the same thing as the person I was replying to was claiming, though.


One of the biggest problems with surveillance capitalism is how it subtly guides you to the thing the corporation wants by manipulating search ranking or using ML to influence human behavior.

With Apple there is no subtlety because you just can't have what they don't want you to. Apple wants to have a deal with Hollywood so no iOS BitTorrent clients for you. You don't even know that the things you're being deprived of would have been available -- it's the same problem. It's worse. At least with Google if you notice they're removing things you want to see from search results you can switch to another search engine and still use Android. If you want video game ROMs on your iOS device you have to throw it away and buy something else.

And the privacy thing feels like a Trojan horse when they still have all your data on iCloud and have root on your device. Supposedly they don't do anything with it now (except allow iCloud to be subpoenaed by law enforcement without a warrant), and I tend to believe them.

Now suppose we finally get a free hardware phone that isn't a dog. It runs an Android fork with all the privacy invasive stuff stripped out but can still run Android apps and gets OS updates for 10+ years (i.e. indefinitely) because the drivers are in the kernel tree. That would eat a big chunk of Apple's market -- the people who don't want the central control but do want the privacy are going over there. Or just pick whatever scenario you like where Apple's business starts shrinking rather than growing. Nothing lasts forever.

Their executives are under pressure to keep profits up and they have an enormous trove of everyone's data they weren't previously monetizing. Desperate companies do desperate things. Or get acquired by Oracle or AT&T or Huawei.

Since that can happen with non-trivial probability at some future date, you can't put anything on your iPhone you're not willing to have that happen to. And then how is that any better than the alternative? It's even worse if you don't expect it to happen and then it does.


[flagged]


Looking at Apple's latest hardware changes, I think users are once again the customers.


I've subscribed to Google One for a few years. (When I say "pay", I'm using credit from answering surveys from Google a few times a week). It's only a couple of dollars a month, it gives you more online cloud storage, but it also gives you a chat and call service to Google. I have used it a couple of times - once to help me push LG to release updates on a phone (they kept saying it was Google's responsibility), another to one get my wife properly added to be able to use the Home smart speaker. Both times chat was followed up a call to a real person (that was understandable, and willing to chase up and respond to the issue). I feel if I had an account issue it would similarly work out.


I think the issue is that the form is indeed locked behind being logged in[0], so the phone support won't work for login issues when you have no other device logged in.

0: https://support.google.com/googleone/contact/googleone_c2c?h...


I'm trying to use Google One now to fix an issue and it's been a struggle. Hopefully they'll eventually work it out but frankly without G1 I would probably just throw my Nest cameras out and dispute all future nest charges. Google really need to work on customer service if they're going to offer services that need it.


"I'd frequently tell my co-workers, "If you're not paying for it, you're the product.""

But it sounds like this "extremely irate user" was paying for it.


Yeah, fair point. It's been several years, so maybe my memory of all the details is a bit hazy by now. I just recall that at one point one of the salespeople was addressing a point about something or other involving the user having paid for something. I have no idea whether the user was telling the complete truth (were they referring to something they used to subscribe to and don't any more?) or whether at the time whatever they had paid Google for would have entitled the user to phone support for GMail account access issues. Whatever was going on, the user wasn't able to find any avenues to get the support they needed for their issue.

Regardless I agree with other comments to the effect that even if you are paying, you are often still the product!


"Regardless I agree with other comments to the effect that even if you are paying, you are often still the product!"

The anaylsis needs to go further than whether one is paying or not. IMHO.

It is not rare to see HN commenters who appear to believe that the act of paying some "user fee" to a "tech" company that willfully caters to advertising, devotes almost all of its resources toward catering to advertisers, and derives almost all its revenue from advertising services, is somehow meaningful.


Was the screaming guy no paying for some service?


I'm a bit confused as well.

> he paid Google something for some service and was entitled to phone support and he demanded someone help him

This does not support the conclusion about free users being the product, since the customer was paying based on the statement above.


Disclaimer. I'm a new Google play thing, by giving them money. Just registered a website through them and am about to release a game on the playstore. Fully dependant on zero custom service now.

The one thing I've never understood about google. Some sort of law for a trillion dollar company to have customer service or something.

Google should be employing 10's of thousands of customer service employees to take calls to troubleshoot their customers issues.

On a side note.

Here is my.... the simplest website you have seen since 1989.

https://simplegametime.com

I'm not running a user data farm. I just want to make stupid games, like...

P.S. Zero advertising for anything including my game. Just a 7 line privacy policy. Don't need much more.


More laws aren’t always the answer. Really, we should just be using a company that gives a shit about its users.


Problem is it all works just fine until you get locked out and have no options. So the market won't ever gradually move over because its only a very small % who get hit with an awful experience while everyone else is perfectly fine.


And now I'm signed up to the system. It's terrifying.

At any point. You're done.

Hence the nothing clause.

I'm sure any game I submit to the play will be wrapped in googs analytics.

No matter what my privacy police says.


I don't think people are informed well enough to know which company gives a shit about its users. Google had pretty good reputation when I started first using GMail via an invite during the beta.

I agree more laws aren't always the answer but I really do think that companies should take some responsibility as far as customers' data and property is concerned. If I take my car to be serviced, they can't just tow it to a junkyard and tell me to fuck off. Even if they advertised free service. If you can't provide a free service and take responsibility for it, then don't.

IMO, if the service includes "borrowing" property (rent, email server), then they can't just cut the customer off without giving them time and the means to move off. (It would be illegal here for my landlord to step in and lock me out tomorrow)


Because that worked so well in the past. There is no "we" - they wouldn't have become a billion dollar company if they hadn't found ways to make people still use them despite those issues.

But that doesn't mean they aren't issues.


True.

The sheer scale of not giving a crap is what is truly impressive. Alphabet has built a monster system meant solely to not have a phone number. That's a scary innovation.


I'd suggest you at the very least transfer the domain to a separate company. If Google mysteriously decides to screw you around it will be impossible to access or transfer your domain.


>I'd frequently tell my co-workers, "If you're not paying for it, you're the product." That experience underscored that notion for me.

But this isn't true for all of us, google provides support through paid programs and sells services to other businesses. This is more of google specific problem.


I submitted security bug to Chrome. It was not very serious or urgent. Somebody looked at it in the first hour, in the first day it was analyzed and in the first week it was resolved. I was kind of surprised, because I was sure that public feedback from nobody is going to be put in a very long queue.


Google makes money on Gmail. That means they can pay for customer support.


> Google office there. The Googlers sitting around

Seriously? You stated that you left the cult.


They also do this thing now where they block [1] smaller browsers (even ones using the latest version of chromium) under the guise of security. According to their docs they're fighting MITMs by generally disallowing any browser they can't identify (so the big few).

If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties.

This feels very anti-competitive to me. Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. I'm building a browser for research [2] and have to frequently find workarounds. I'm not quite sure who I'd contact to get on said whitelist either...

[1] https://imgur.com/a/DASVkhl (here is the issue in the Vim browser and Min browser)

[2] https://synth.app


Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason.

It’s incredibly transparent as to what they’re doing. That Google became the most anti-consumer company out there is pretty disgraceful.


I use google constantly— sometimes hundreds of times per day— both logged in and out, almost exclusively in Firefox or Firefox developer edition and I've never encountered this. I'd bank on it being a network thing— VPN, overcrowded proxy, etc.


The beauty of AI is that it's likely no human can say precisely why two similar users might get a different classification.


I'm not saying the browser isn't a factor, or that Google isn't anti-consumer, or anything else. The original comment didn't say they were caught up in some unobservable AI machination. They made a pretty straightforward observation mentioning only two conditions: Google bounces them when using Firefox. From that, they jumped to a pretty straightforward conclusion— Google transparently harasses Firefox users to advance their corporate strategy.

I'm not going to jump through hoops to prove a negative, but correlation does not imply causation.

My empirical observation: For many years I have constantly used Google search on FF with many machines and networks, logged in and not, in private mode and not, with all existing privacy features enabled and no extensions beyond a password manager. Napkin math conservatively estimates I've conducted 200k searches minimum using this combo. I've consistently encountered suspicious activity challenges when using overcrowded proxies, NAT'd networks and VPNs. Removing those factors has never failed to stop the challenges. Ever.

I'm confident the poster's observations are accurate. My observation does not directly contradicts their observation, but it does contradicts their conclusion. I wouldn't be surprised if other factors like JS being enabled, cookie settings, plugins that affected those things, number of other users on their network, or even the public IP range they fall under would affect it.


...and the beauty of the Internet is that there's really no way to be sure people are being genuine...


Which is why it's better to believe people until you have a clear reason not to, in case they are genuine.

https://en.m.wikipedia.org/wiki/Principle_of_charity


It's not that important whether these reports are genuine or not. The important point is that many people are not surprised by these reports. Google has long failed people's trust in them.


Long time Firefox user and HNer here.

I've at least been "captchaed" in Firefox. While being logged in with my Gmail account from 2005.


I've been "captchaed" with Chrome, so I'm not sure the anecdotes amount to much.


That's interesting and useful to know and I decide to believe you.

BTW: Yes, I absolutely noticed that you said this above:

> ...and the beauty of the Internet is that there's really no way to be sure people are being genuine...

My point is, unless the claims of the others are outrageous or we have something very specific to point at, I don't think voicing these kind of thoughts do much good.


tbf, that is the beauty of people in general and not the Internet


I have had the same experience the previous commenter had when I'm on my phone. It would happen quite randomly and sometimes the captcha hell would resolve and I could go back to normal search, while other times it would go into infinite loop. Check back in an hour and you're fine. It's a disaster and at times like these I am so glad there's at least some competition I can go to for search.


I get it ln firefox without a VPN with my own IP owner by a reputable ISP. On a pixel phone with google DNS.

On a VPN I do not get it, so the last couple of weeks I have been making heavy use of my mullvad account.

Edit: however. I only store cookies for fastmail and hacker news and do not allow JS on many sites.


That would make sense, Google can easily track you if you always use the same IP. It's their business, they track you and sell your data so they can provide their product for "free".


> Google sometimes blocks me from searching using Firefox, saying it’s “suspicious activity” and sending me into captcha hell that always rejects my results after several screens for no reason.

That happend to me only when using tor.


Use private mode exclusively. You will start getting into the captcha hell in a day or two.


I configured Firefox to delete all cookies on exit, except few whitelisted sites. So most of the time I have to accept Google privacy policy if I search there. Other than that, I never got into the captcha hell when trying to do a Google Search.

There are some sites I can't login at all unless I change the browser. SoundCloud is one of them.


Could be that IP Address/ISP reputation is also a factor for the variation in results.


that happens to me all the time, i have no idea why. i'm using firefox.


In the same vein, check out what Bing did when I searched for "Firefox" with Edge[1].

[1] https://news.ycombinator.com/item?id=28517187


Any reason as to why they might be doing that? VPN? "resist fingerprint" setting? School/public wifi network?

Usually when they do that its because you are on the same network that a lot of abuse has come from.


Is it possible that your requests are coming from an IP address that google has flagged for previous abuse? I think that the "suspicious activity" captcha hell is triggered by a high request volume from multiple not-logged-in agents on the same IP. At least that's been my experience in the past.


Doesn't have to be not logged-in. Years ago I use Chrome (with myself logged into Google) to search for very specific queries, so I have to use multiple operators (double quotes, "site", "filetype") in one search to narrow the result. I was hit with CAPTCHA as soon as I browse to page 2 of the result. This happens many times, so I have to do this kind of search at different times to make sure it doesn't see me a heavy traffic at any point.


We used to have this happen at an office I worked in where the SEO team was scraping google search rankings by running thousands of queries with different search keywords. Google was blocking the IP address rather than our browsers.


Sounds like your browser (or a plugin) might be blocking some cookie or connection that Google uses for security?


fake your browser header to a chrome variant.


That doesn't get rid of the problem, it only prolongs it.


The header isn't the only thing that identifies a browser.

A faked header might look even more suspicious to their algorithm?


Hanlon's razor applies here, though.


No it doesn't, rockefeller's razor applies - don't attribute to stupidity what could be adequately explained by profit motive.


There is no such razor.


I'd guess that it's because they (incorrectly) think it's an embedded Webview, which get blocked (see https://developers.googleblog.com/2021/06/upcoming-security-... and https://developers.google.com/identity/protocols/oauth2/poli...).

You could try creating an issue in the Cloud Identity issue tracker (Cloud Identity is Google's API for letting websites have a "Login with Google" thing): https://issuetracker.google.com/issues/new?component=522910&...


This is a problem I've encountered too, people are unable to login to a Google account when using insecure Webview browsers... which includes; Messenger, Facebook, Instagram... etc.

But Gmail Webviews allow Google logins though :/


Hey, cool website !, The mailto: hyperlink on your careers button in the footer, has a typo, namely,

"mailto:careers@synth.app&subject=Synth Careers&body=Please attach resume!"

It should be,

"mailto:careers@synth.app?subject=Synth Careers&body=Please attach resume!"

that &subject instead of ?subject is causing that mailto link to not be imported properly by most mail apps, trivial thing, but thought I'd mention it.

Good luck with your app !


And replacing the spaces in the subject with %20 will fix it on more browsers, at least it's at the end :)


And providing no email at all and using form submission with captcha will annoy a bunch people but will save you from a lot of spam ¯\_(ツ)_/¯


You could even power the captcha with Google!

<looks at subject of thread nervously>


Its craziness all the way down. I have a google voice number which is my "default" number with my gmail accounts. All my gmail accounts were automatically migrated to use 2FA with this number which means if I lose all my google devices and I try to log into voice, I'll get 2FA I can't see because of the catch-22 situation of not being able to log into voice.

The only reason I caught this is because they send me a notice about 2FA and I thought, wait what 2FA am I using? Instead of them running a tiny check to see "Wait, is this person using a voice number" they did it anyway. Worse, they know this because if you go into the 2FA page manually it says in bold letters to not use a good voice number.

At this point I'm spooked and I'm just going to port my number into our account at work and have my work phone use this number instead of having a dual number phone with voice. Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone."

If I didn't catch this then there would have been a day where I'm locked out of my accounts with no apparent way back in.


> Voice SMS is a mess too. 50% of services can't SMS it a code because Google blocks it. Other services won't accept it for SMS codes because its "not a real phone."

The first part of that shouldn't be true. I've used mine to receive all kinds of SMS and it always works fine _except_ for the services that just won't accept the number. Only run across maybe one or two of those, over some years.

For SMS from real people it works fine ofc.


What happens is some organizations run a verifying to see if its a VOIP number, and if it is, considers it invalid for SMS based 2FA, and other authentication, presumably to stop hackers. Some big names use these lists, most notably Zelle to transfer money. Discord as well.

Why Google also seems to block incoming SMS from Microsoft Authentication and others is beyond me. Maybe MS isn't sending because it doesn't consider that number real and just fails silently on their end? Maybe Google's own lists are very aggressive. I suspect the latter because this comes up a lot. No one seems to have a good answer to any of this because there's no laws requiring transparency so they hide their rube-goldberg-esque SMS policies behind obscurity and its up to me, the customer, to somehow navigate this mess.

Yes, from regular people things are fine, but my life isn't dictated by regular people but the mega corporations capitalism creates and how I have to cater to their various technological whims. If my phone can't get messages because these big companies are always feuding in some way, then I'm locked out of essential services I need to live, have a job, do banking, etc. Its a small comfort that my friends can text me when I can't get texts from my bank, money transfers, or for work. As of right now in the USA, having a VOIP number be your primary phone number is unfeasible. I have a work cell with a "real" number that I use for at least 4 different services for SMS because of this issue.


That's really weird. Ya the VOIP thing I've experienced. I don't think I've ever found a company that actually tried to send sms my way and it failed though. Maybe just luck, I don't happen to use any of those companies you mentioned.

Anyway, yeah that's lame. I'm personally abandoning ship from Google Voice myself anyway, but for other reasons.


Just like Microsoft might not want users on cheap VOIP lines because those services tend to be like in the seedy underbelly of the web, Google also doesn't want it to be useful for that purpose, for exactly the same reason.


Discord won't take the numbers, Venmo won't take the numbers.


Interesting how the brand of security companies like Google keep telling us is in our best interests always seems to secure their corporate revenue streams first, while the security and freedom of users are an afterthought.


years ago I interviewed with a startup that was aiming to put their routers in various locations like airports and coffee shops. They would offer free or cheap internet at those locations. The catch: they were going to swap out ads with their own ads on the fly.

Shortly after that, Google started pushing HTTPS. I never believed that was a coincidence.


The great migration to https, even for read-only self-hosted blogs, has been an amazing disservice to the world. Maybe if we had non-expiring ssl certificates with working OCSP or CRL, I’d have a different opinion.


Yeah, they make almost tens of dollars forcing users to use Safari or Edge instead of lynx.


Well, if they could make tens of dollars per user, that would be pretty good.


Yes but they save a lot not paying Firefox to be the search box.


A browser environment designed for researching is something I've been investigating lately. I want to stay with Chromium for convenience (Chrome for work, ungoogled-chromium for personal). Right now I see two paths that might work for me:

- A standalone browser that I use only for research purposes. Currently evaluating Bonsai [1] and am interested in Synth.

- A suite of tools that makes bookmarking and organizing easier when used alongside Chrome. Currently, I pay for Raindrop [2] to manage bookmarks, most likely will pay for Slapdash [3] for indexing, and am evaluating Heyday [4].

For an end-user like me, I would much rather pay for an extension+SaaS for Chrome or Firefox, rather than deal with workarounds for browser incompatibility.

[1] https://bonsaibrowser.com/ [2] https://raindrop.io/ [3] https://slapdash.com/ [4] https://heyday.xyz/


You might also like promnesia

https://github.com/karlicoss/promnesia#readme

And if you're interested we have a small discord server "awesome knowledge management" come join us!

https://discord.gg/XPNeDSQE2j


What makes your discord server unique among the thousands of other knowledge-management organizations out there?


Nothing ¯\_(ツ)_/¯

Although you say "organization"... this isn't centered around a particular tool or anything.

I made it in response to a post about Promnesia on "Who wants to collaborate" https://news.ycombinator.com/item?id=29764928


Awesome. To keep focus on the main topic, feel free to email me to chat more (FWIW I've done the 50 extension patchwork thing and generally find the extension experience to fractured and suboptimal for me).


What OSes are compatible?


I use a proxy service (VPN) and gstatic.com blocks my requests. This breaks reCAPTCHA which defeats its entire purpose. It also breaks every site that uses Firebase. About 50% of sites load their fonts from Google and they appear with all text invisible and finally appear after about 3 seconds. A few sites, even government sites, refuse to display any content at all until they load their JavaScript from Google.

Browsing from this Google-blocked VPN has been an eye-opening experience. Google tech is pervasive and makes the web hostile for everyone practicing online hygiene.

When Google first blocked my proxy, suddenly search in Gmail and Drive stopped working. This was my paid Google business account. I tried to contact Google Support but found I couldn't log in. I carefully wrote down a Google Support PIN several years ago. When I tried to call Google Support, the PIN didn't work. Apparently, Google Support PINs expire after an hour. So I learned that Google provides zero support for login problems, even for paid accounts. That's a massive risk. I switched my business accounts to Zoho. It took about 4 hours to sign up and move over my domain + email + docs + spreadsheets + drive. I've been using Zoho for about 3 weeks now and it's fine. Zoho Email search is good. They let people create support tickets without logging in. And humans respond to the tickets within hours.


Wow, that's awful. I wonder who's idea it was? Is it doing anything more than checking user agent (trivial to spoof), because if not that seems entirely hostile.


It's not just the user-agent, it is definitely doing non-trivial fingerprinting (both linked projects also had UA mitigations before). We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them.


> it is definitely doing non-trivial fingerprinting

Can confirm.

To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level. Being in the wrong cohort (say unusual browser, small country, rare language, use a vpn etc) can affect your score. Basically it's these massive bayesian filters that output how suspicious some activity is. Whether you're signing in to Gmail, returning a product, buying something with a credit card or booking an Uber, some form of score is computed and then used to allow/deny/delay/verify. Obviously this is well established in the insurance and finance industries, but make no mistake, it happens everywhere.

This approach is understandable from a business perspective, but imo deeply troubling for an open society. You don't have to squint much in order to see the similarities to social credit systems, EVEN if there is no grand totalitarian state-coordinated behind it.

As usual, the first step is transparency so we can actually discuss these issues based on accurate data, but that's very difficult today. Usually fraud and abuse prevention is among the most secretive departments, they never share anything.


To clarify, these scores can be sanely used to decide what level of trust you have, and when you have none you get a capcha, a SMS check or something heavier to authorize the access you are trying to get.

In my book you’re never supposed to fully block a session because of the score, there needs to be a (potentially burdensome) way to prove the score wrong. Blocking a browser should be out of question.


Even so, we still need to have a debate about what levels of "papieren bitte" we are willing to accept for different functions of society. The currently ubiquitous corporate-centric trend is to "nudge" instead of outright ban, i.e. instead of a bool it's numeric, and I highly doubt that the difference in data type is as significant as people think it is -- "Well you can always create a new account/buy another device/ask your friend to do it/.." and so on.

If these numeric scores are affecting search results, recommendations, when sharing stuff, etc etc, there's no question that it will affect societal discourse. These hidden "algorithms" (as in the popular term) and fraud prevention systems are so far from being understood that it may be too late to reverse it when we realize what's happened.


I agree with you. I think this discussion started around the time shadowbanning was gradually used on forums to reduce moderation workload.

It seemed somewhat legitimate for a small free to use site mods to try to not get their whole life sunk by dealing with trolls, but if the same behavior is applied to giant entities who have much more incentives to do it at scale, it becomes a different issue altogether. Hidden restrictions on search results or other functionalities would be distopian and something I hope doesn’t get accepted as standard.


"Papiere, bitte." (Just fyi. Mangling the German [sic] doesn't detract from your post.)

Not sure being corporate centric makes this problem any worse? If you had other kinds of organisation, you'd still have to deal with abuse and fraud? Any people doing weird, unusual stuff, look inherently more suspicious. That's a fact of life in meatspace, too.

There might be some utopian, ideal way to organise activity so that non-mainstream stuff ain't suspicious.

But I would count that as a great feature of that ideal way; not as a deficiency in the corporate way. Just because this deficiency of the corporate way seems to be a common deficiency of most means of organisation that have been tried.

(Keep in mind, this isn't all or nothing. Softening the tendency might be enough of a relief, without having to eliminate it completely.)


> "Papiere, bitte." (Just fyi. Mangling the German [sic] doesn't detract from your post.)

Thanks!

> Not sure being corporate centric makes this problem any worse? If you had other kinds of organisation, you'd still have to deal with abuse and fraud?

I think it's definitely not unique to big corps, but an emergent property of a distributed and homogenous system of self interested agents, probably. It feels very game theoretical, at least. What's clear is these systems are becoming ubiquitous rapidly.

Anyway, if my Google account gets locked today, for whatever reason, I am very seriously screwed. Google's human appeal process is best-effort at best, I know people personally who have been locked out for life. Now, I have the luxury to blame myself because I should have bought a domain and so on, but society at large doesn't have that foresight/insight.


> I think it's definitely not unique to big corps, but an emergent property of a distributed and homogenous system of self interested agents, probably. It feels very game theoretical, at least. What's clear is these systems are becoming ubiquitous rapidly.

Not sure the homogenity is necessary?

To an extent, the market delivers what people are demanding.

For most people, Google's package of cheap or even free services with minimal hassle in the common case, but almost no recourse in bad cases, is compelling.

And for many it's a step up from having everything locally: I'd bet that more people lose their local data than get locked out of Google?


> Not sure the homogenity is necessary?

Oh, nice catch, I actually meant to write heterogeneous.

> I'd bet that more people lose their local data than get locked out of Google?

Probably. There's definitely some low hanging fruit/middle ground though. We desperately need to have ownership of the address itself, so we can transfer to different providers. Either with your own domain, or a domain provided by a truly neutral party, similar to phone numbers.


Not sure about phone numbers. You can get them hijacked relatively easily, at least temporarily.


Problem is that having an account be breached is catastrophic while getting locked out temporarily ranges from annoying to very annoying but not nearly as bad as having the account be breached. So if the filters have determined that someone is absolutely almost certainly a bot/attacker, it might make sense to do a total block like a bank would lock your account.

Unfortunately google doesn't have the support infrastructure like a bank to do recoveries.


I know cloudflare uses a trick with canvas element to fingerprint the browser. If you disable it, it can be actually impossible to bypass.

It's not so much a social credit score to fear rather than privacy. Any site using cloudflare or Google knows where you're going and what your doing and if they don't then, access denied.

They know so much more than your innocent mind will want to admit.


> Obviously this is well established in the insurance and finance industries, but make no mistake, it happens everywhere.

Speaking from someone in the US--in both insurance and finance I can get a person on the phone to resolve my issue.

Specific to finance, there are a number of consumer laws that protect me.

If I'm denied credit based on my credit history, I'm allowed to know why. If my credit score is not accurate, I'm allowed the ability to fix it.

Lousy customer support is not a tech industry issue--Stripe, Amazon, Apple, to name three all have great support.


> Stripe, Amazon, Apple, to name three all have great support.

True, but they have actual customers. As a user of Gmail, I can hardly be considered a customer.

Google ads has customers though. Their support probably isn't great either, but does it need to be? Where else are you gonna go?


> Google ads has customers though. Their support probably isn't great either, but does it need to be? Where else are you gonna go?

I've not dealt with Google Ad support, but I can say from experience Facebook Ad's customer support is terrible.

Similar to Google, I'd speculate that the majority of customers pay such small amounts, that it's more cost effective for Google and Facebook to not support them, than it is to support them.

I would also speculate, that if you were instead, say Pepsi-Co, you would have white-glove service from both tech giants.


> Similar to Google, I'd speculate that the majority of customers pay such small amounts, that it's more cost effective for Google and Facebook to not support them, than it is to support them.

That's probably how they reason about it but I think it's a cultural thing too (pure tech Co's have a bias towards automation for everything, and a reluctance to staff operations at all). Amazon for instance has many low value customers, yet has much better support across the board.

> I would also speculate, that if you were instead, say Pepsi-Co, you would have white-glove service from both tech giants.

Oh absolutely, that's no secret. I know account managers that had a single big customer at one of these companies. It's part of the sales org basically.


> say unusual browser, small country, rare language, use a vpn etc

> Basically it's these massive bayesian filters that output how suspicious some activity is.

It almost feels like the digital equivalent of racism, xenophobia, homophobia, and other prejudices; people are suspicious of anything that stands out as being somehow "different." Now computers are suspicious and prejudiced because your digital appearance looks out of norm.

> This approach is understandable from a business perspective, but imo deeply troubling for an open society.

Agreed.


> To generalize and understand why, big corps have to deal with an insane amount of (often automated) abuse, so they build profiles using data collection to assess your risk level.

Total coincidence that it's also "you're not being a good little data source", I'm sure.

I use a privacy-oriented browser on my cell phone to load amazon's website to get that stupid whole foods QR code for the checkout, because I'm not installing their fucking app so it can collect more data on me.

Guess what? Every single time, I'm presented with a "we've emailed you a link" error, and that link is difficult to open in my preferred browser because iOS doesn't offer it as a choice for opening links...


> Total coincidence that it's also "you're not being a good little data source", I'm sure.

100% coincidental, of course :)

> that link is difficult to open in my preferred browser because iOS doesn't offer it as a choice for opening links...

Hmm, wasn't that fixed? Perhaps it's the email app that won't let you? I seem to be able to open many links in Firefox on iOS these days, but in some cases Safari is indeed the only option.


"We don't have an easy workaround (besides a sketchy cookie hack that took hours to reverse engineer) right now and have been trying to get in touch with them."

First thing I do when creating a new Gmail account, using a "supported" browser, is to save the required parameters of the cookie in a text file then convert the file to a simple shell script, powered by netcat and TLS proxy. This only takes me takes seconds. Then I close the supported browser without logging out. The word "sketchy" seems applicable because unlike, e.g., a bank website, companies like Google and Facebook will let users stay "logged in" for some ridiculously long period like one year. Yikes.

Two ways to disable the script are 1. log out of that session (://mail.google.com/mail/logout?ec=ABCDEF, ://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail/, ://mail.google.com/accounts/ClearOSID) or 2. change the password.

This tiny script can be transferred to any computer and used to check and send mail from the command line. No browser, Javascript or password required.

Netcat, the browser of the future! :)


What did min browser have?


Likely the goal is to protect users from malicious apps, trying to get user to log in on a hosted browser component in order to scrape their data (or perform activities on behalf of user).


I think HN users often severely downplay the threats large companies are facing and frame every anti abuse measure as a coordinated attempt to shut down their indie browser fork.

People are having their lives ruined when their account gets breached which Google prioritizes over avoiding accidentally blocking a few odd users.


At work I use Chrome, and I was once using some more obscure features of Google Search to find Microsoft documentation and it (Google) started asking me to verify I wasn't a bot, over and over.

So there's some evidence that this sort of nonsense can be other than malice.


Huh. I'm using a little-known Chromium fork[0] and I haven't had any trouble logging into Google services.

0: https://github.com/blueboxd/chromium-legacy


It might just pass as Chromium to their browser fingerprinting.


I suppose, but then how would they detect a Chromium build with a keylogger?


Just signed up. Your idea appeals to me. Hope I can take it for a spin soon!


I use qutebrowser[0] which is built on qtwebengine, which is based on Chromium but comes with the caveat that it will likely be blacklisted by Google since it does not follow upstream's release schedule. But it is trivial to get around this by setting the user agent to something not blacklisted.

[0] https://qutebrowser.org/


Kind of unrelated to the whole Google thing, but this Synth browser is a really cool idea. I'll read more into it when I get the chance!


How do we get our embedded webview driven app verified as a secure browser or has the AI already designated the lucky few and we are cast aside?


Godspeed building any browser. I know it's just for research, but I miss options. Palemoon was great until it imploded.


I wonder if that takes long for gogle to create a premium search account product. Paid one.


> Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic.

OK but that also describes pretty much all the Web browsers the vast majority of Web users actually intend to use, right?


Yes, in part thanks to their efforts to make it harder to use other browsers...


I think you are overestimating the inclination anybody has to use those.


How do you know what people 'intend' to use? Making it inconvenient to use alternative browsers especially when they compete with your own is manufactured consent not intention. I use FF on Linux and have to go through that crap every time FF updates even though nothing else has changed.


It seems to me that packaging a malicious browser to look like a familiar one is actually an attack vector


Synth looks cool but why can't it just be an extension?


Well, for one, nonsense like this is why I set out to build a browser in the first place :) More generally, the user experience is, naturally, worlds apart from extensions.


What is a MITM?



Man in the middle


Man in the middle


Please dont post links to programs that arent even publicly available.


AFAIK There's nothing wrong with doing so. The comment was on topic, and the project is interesting.

One of the most discussed projects on HN in the past year or so has been GPT-3 which is (was?) pretty hard to get access to.


GPT-3 is pretty open at this point.


Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as I used to always access it, no less.

Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in.

Needless to say, I will never again use gmail for critically important things.


My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain.

That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (since you can just move to another provider).

Also, use an email client on your PC (such as Thunderbird) and configure it to keep a copy of all your emails locally (and possibly have the PC backed up). That way if you loose access to your account you don't loose access to your mail, that you can even upload again in the new provider server.


I agree with the advice to get your own domain, and then use a service to manage email for it. But don't use GSuite/Google Workspaces/whatever they're calling it now. Your Google account will be somewhat crippled and will be missing a bunch of features, because Google has just decided GSuite accounts should not have those features.

And you can't convert your account to a regular Google account. I really want to untangle all this, but there's no way to (for example) export your Google Photos sharing settings and import them into a new account. I have hundreds of GPhotos albums, with many of them shared with various people, and if I migrate to a new, regular Google account, I'll have to manually set up all those sharing settings again. And this is just one of many difficulties; I'm assuming I'll also lose all my Hangouts/Chat history as well, with no ability to import the old history.

But I'll be doing all this sometime soon, as Google has decided to finally pull the rug out from under those of us who signed up for GSuite when it was free (well, "Google Apps for Your Domain", as it was known back then), and will start charging later this year.

This is all incredibly frustrating, and the level of lock-in is pretty severe after more than a decade of having this account. If I could do it all over again, knowing what I know now, I would have created a Google account without GMail[0], using my email on my custom domain, and hosted my mail somewhere else. Though, admittedly, back when GMail was first a thing, webmail otherwise universally sucked.

[0] https://accounts.google.com/signupwithoutgmail?hl=en


Yea it is odd that not all Google accounts are the same.

My favorite is that I cannot migrate my Nest account to a Google account because it does not support Google Workspaces accounts. I use it with my own domain and it is my private Google account.


>export your Google Photos sharing settings and import them into a new account. I have hundreds of GPhotos albums, with many of them shared with various people, and if I migrate to a new, regular Google account, I'll have to manually set up all those sharing settings again.

If you think this is bad you should check out iCloud. They're all as scummy as each other about locking in users so the friction to leave is sufficiently high.


> Google has decided to finally pull the rug out from under those of us who signed up for GSuite when it was free…and will start charging later this year.

Do you have a citation for this? I heard last year they were going to start charging for new accounts, but that since I set it up on my domain in 2008 I was grandfathered into the free plan indefinitely.


The email has not been sent to everyone yet, but it mentions "transition all remaining users".

https://news.ycombinator.com/item?id=29996432


I had this week to transfer a small account of 2.5GB between 2 google workspace accounts. All paid accounts. It took 3 days to transfer the 2.5GB account with Google's data migration process. Downloading and uploading the emails with Thunderbird would have taken maybe 3 hours at most.


That's true about GSuite being crippled compared to Gmail, but I accepted that as the price to pay for having my main email use my own domain.


What features does GSuite lack?


Two that affect me: can't use it with Nest, can't buy family plan YouTube subs.


Family sharing of Youtube TV is another one.


Can't share Google home access with another user.


And if you don't run a local mail client like Thunderbird, make sure to take a Google Takeout backup as frequently as your threshold for losing recent mail. The backup of GMail includes all your mail in a standard .mbox format.


I did this! Kind of. I bought a domain and was lucky enough to get in to a custom domain email (and more) service with a big company years ago when they had a free version.

Unfortunately... it was Google (so kind of hiring the wolf to care for my sheep, as it turns out).

And now they're cutting off all of us free tier folks. Which I can't fault them for, but still blame them for. Because I'm petty and entitled or whatever.


Same here and it's a massive problem because nearly all of my digital presence is associated with, not just that email address, but that Google account specifically.

I'll lose important things like my Google Voice number that I've had for a decade unless I pay for a business account.


You can transfer your Google Voice account to a regular GMail account despite their documentation claiming otherwise. See:

https://github.com/marwatk/gsuite-to-gmail/#google-voice


Keep in mind you can port out a Google Voice number, also if you pay for Apple services domain hosting is free for iCloud+ users now, although you don’t get as many addresses.

It is very frustrating. I did a lot with Google Apps on that domain, and migrating that stuff out to a consumer account is a painful process.


You can port your number out. I'm working on doing that myself. I think Google charges like $3 for some reason to do it, but whatever.


Same situation here. Have you done the research yet to decide on a new service, or are you planning on starting to pay?

For me ideally I would like to move to something else (even paid) just because someday Google deciding to block me for whatever reason scares me quite a bit after having everything for the last decade attached to this account. I would like to export my emails, switch my domain to the new service, and import everything - but I have no idea how realistic that will be yet.


I’ve been really happy with ProtonMail. I use their professional account with a catch-all email address on my domain, and I give each vendor I interact with their own dedicated email address (I.e. homedepot@mydomain.com, ticketmaster@mydomain.com, etc.)

It lets me track who is sharing my email address and gives me control over that (set up simple filter to automatically delete any email received at ticketmaster@mydomain.com when I start getting spam on it).

It’s been really effective - such a part of my day-to-day flow now I can’t go back.

The transition was pretty painless. I setup an email forward from gmail to my proton inbox using gmail@mydomain.com, every email I received at that address I’d go update my contact information with. After a bit, I was able to turn off the forwarding. Basically the classic strangulation pattern for microservice migrations applied to email.


That sounds pretty good. I do something similar but use POP and Thunderbird, which I'm looking to move away from. Does ProtonMail automatically set the From address when you start writing an email to a company you have a dedicated address for?


Having had my primary Gmail account blocked twice in the last two months, apparently through VPN usage, I became sufficiently terrified to decide to start to move all my email to my own domain.

I adopted Fastmail for my domain email, and it has been a good experience (I do know that Fastmail is a five-eyes company with all the related issues around privacy, and I researched alternatives for several weeks, but I guess in the end I was willing to trade privacy for ease-of-use, uptime and various other factors).

Now I am looking into getting away from other Cloud-provided backups such as Prime Photos, iCloud, etc., moving to self-hosted NAS storage.


The only alternative I found to Fastmail that was somewhat competitive in terms of tech & security features and not one of those countries was mailbox.org but their webmail is not Fastmail's and Germany isn't far behind those 5.


I've been working on this but my family is pretty hung up on Google Photos so we're migrating most things there trying to preserve as much as possible. We're doing Google One family. As much as Google has annoyed me with the change, the other options weren't any better (O365, iCloud+, random non-FAANG services)

I'm documenting everything here if you're interested:

https://github.com/marwatk/gsuite-to-gmail/#google-voice


I switched to Apple's (paid) iCloud+(?) and it was entirely smooth, even though it was still in beta at the time (or alpha: the signup notification I got still had editorial comments in it).


Zoho has a free tier that allows a domain.


whoa! thanks for the heads up :/


I usually do use emails only on my own domains, but in this specific instance I wanted an account that could not be easily traced to me (nothing illegal, just some investigative activity), and this was how I've found out how erratic and merciless our new Google AI overlords are.


https://purelymail.com/ is cheap and great, albeit still in beta.


I looked at Purelyemail recently and it looked attractive for what it does and what it provides for a low price of $10 a year (compared to Fastmail and others, which can be quite expensive for more than one user/mailbox). But the fact that there’s just one person behind it makes me uncomfortable to consider it for any serious use. But that also probably works in favor of the low price.


And be careful not to have your domain recovery procedure tied to the same email account that you might need to recover.


The issue with running your own domain is that it could be blacklisted by google (and Facebook) if you get hacked, and then you're fucked big time. I encountered that because of an outdated Wordpress. Domain was blacklisted everywhere on the internet. Luckily I didn't have email set up on it.


>Domain was blacklisted everywhere on the internet.

Well this is horrifying. Of course, not much worse than Google unilaterally and permanently banning a Gmail account.


I guess one potential downside is if you mess up and forget to renew the domain on time and some jerk (automated system) buys it up and tries to resell it for a ridiculously high price. Happened to me even on my firstnamelastname.com domain.


Honestly i really like Gmail as a client, but I've read too many Google horror stories over the years. Therefore I've always had this setup: own domain & mailbox at a trusty provider, and then just forwarding copies to a gmail account + sending via smtp

that way I've got the comfort of gmails features but always have a "real" mailbox to fall back to if anything happens


The only problem is now you have to make sure you dont get your domain hijacked. This was the reason I went back to gmail (and outlook).


Or get a paid e-mail service where you can have support. I use Fastmail for this exact reason.


Won't work though, big email providers have made it a nightmare to run your own email.


And what email address did you use, when registered your domain?


[flagged]


Not FUD, putting your eggs in the Google basket "considered harmful" - unless you pay (Gmail for your domain). I had a similar lockout but on my paid account, got fixed in about 48h. It's happened to like 10 other folk I know over the last 2-3 years


I don't know if it's FUD, but it's true. It happened to a person I know, and in her case, the resolution was "ask around until a friend of a friend of a friend of a friend works at Google".

She literally had to ask her friend, who asked me, I asked one of my friends to ask one of his friends who works at Google to put in an internal ticket. It was thankfully resolved quickly (she lost access to all her work materials), but the process is insane.

Use your own domain with Fastmail. Yesterday.


Indeed, I only consider myself tangentially in the tech world, but I do have access to a private facebook group with many old co-workers and sometimes this sort of request will go out to current FB or Googlers. Inevitably some will complain that it's inappropriate and should go through official channels and others will point out that this back channel is often the only real resolution.


Google now have support, including phone and chat, via Google One ( basically if you pay for extra storage for Gmail/GDrive/Photos/etc.).


Interesting, I wonder if you can somehow pay after you're locked out.


> It was thankfully resolved quickly (she lost access to all her work materials),

More than your own domain, BACKUPS.


This is exactly my experience too. My Google accounts just randomly decide to stop working from time to time, and if I no longer have the same phone number that I did before (or if I'm traveling overseas and cannot get a "confirmation call"), there is no way at all to get in. Usually after a mysterious and unexplained period of time, my account gets un-flagged again and I can log in as per normal.

The first time this happened I completely lost all access to my Google account. I transferred all of my important email correspondence over to a Microsoft account and I have never looked back. Unfortunately I still need to maintain another Google account for my phone (Android) to work properly, so there are times I still get bitten by it. It's absolutely infuriating when you get a new phone and specifically need to log in with your Google account to be able to do anything, that's exactly the time Google blocks you from being able to get into your account, because it's apparently detected the new phone and decided you're a hacker.

This also happens to me regularly with PayPal, almost always when I am traveling overseas, at exactly the moments that I really need PayPal to work so I can pay for something related to my travel. It's so annoying. Tech support never, ever solve the problem. All you can do is wait and try again later until magically it works. Sometimes weeks later.

The only thing I can say for certain is to never try log into your account over open wifi or over a VPN connection, because somehow Google (and PayPal) seem to flag that as a hack attempt no matter how many times you correctly confirm your identity. And once you've been flagged once, your account gets caught in some kind of loop where even after you get back onto an apparently blessed IP address, you're still locked out for some unspecified period.


Having a VPN back to your home IP really helps with the overseas logins in my experience. If it doesn't work turn on the VPN and it sees you coming from a 'trusted' IP and you're set.

The fact that I've had to learn this through trial & error and spend time & money setting up a personal VPN host is crazy.


I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you".

They won't let me reset my password.


I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you".

They won't let me reset my password.


Yeah this sounds like utter bullshit to me. What if you're travelling, all your devices get stolen, and you're logging in from a public computer or friend's computer to contact your family?

This is mindblowingly idiotic. Do they have such a bad vacation policy for their employees that not a single ONE of their engineering managers has experienced the above? Do they just sit in front of their desks for 365 days a year and never leave their country borders?


It's definitely more complicated than that. I travel a lot, sometimes to places where borders are dotted lines, cities use a script I can't read, but every hill is "charlie-5" or somesutch... VPNs, public terminals, government networks on .mil.<country> domains, etc.

I have been quite impressed with the improvement they've made in the last year or so regarding these locks. It's probably a sudden change when you've been more predictable before that gets flagged.

Only trouble I sometimes run into is Google Search (or Books?) locking me out with increasingly difficult captchas if you keep running searches for 18 hours straight.


My guess is they get defrauded more often.

The scenario you present is a really obvious risk as phone thieves often compromise those devices.


No, I think it's a huge risk to be stuck somewhere these days without any means of contacting your family or getting emergency money sent to you. Especially if you're in a place that's politically unstable or where helping strangers isn't the norm.

One of these days someone will not be able to get their heart medications or a flight home because of this damn Gmail policy.


Not just Google, I'm regularly locked out of banks, state resources, and all kinds of other shit because of various combinations of bad decisions producing toxic login flows.

One of my personal favorites -- a bank automatically associated phone numbers you called them from to the account, and later they forced SMS 2FA onto the account regardless of any other security you had in place (and of course made the common mistake of allowing account takeovers with JUST that 2FA and a username). Those automatically registered numbers weren't exempted.


If they need only SMS for a takeover, it's 1fa, not 2fa.


I make a habit of

1. Forwarding everything to my free tier google apps for business on my domain

2. Annually logging into my throwaways. it seems if i login to them once a year from home, they dont pull this.

3. do NOT attempt to login to my throwaways from a proxies connection (SSH/SOCKS on a VPS or something like that, which i frequently use at work)


> my free tier google apps for business on my domain

your habits are going to have to change soon...


Yeah....its unfortunate.

Currently I may just pay the cost. Or move to a more privacy focused service like ProtonMail and at least give my money to a place I support.


Had the same thing happen to me, I know the password, have access to the recovery email but Google won't let me login. Spent months in a support thread with Google and eventually gave up. Still really bummed about it tbh


> Needless to say, I will never again use gmail for critically important things.

That's a hot take. If it was critically important, you'd have 2FA and a recovery phone number associated with it - which would have prevented you from getting stuck in a trust-fail situation to begin with.

Use whatever service you want, but your takeaway from this situation is a bit absurd.

Edit to add: I'm not saying Google's algorithm is perfect here, but relying on heuristic voodoo ("I use the same IP, so I should be fine") for "critically important things" instead of using well-established means of securing access to critically important things (e.g. 2FA, backup mobile number) is a bit insane.


I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious.

This happens to me from time to time, and the only way I can get back in is through Android. I keep an Android phone on hand at all times for this very reason.

Don’t blame the human for inadequate preparation; I assure you, no amount of preparation will save you from Google’s AI.


I think we need to quit calling it AI, and instead call it AS: Actual Stupidity


Agreed. The moment we allow AI to take the blame for irresponsible decisions made by the humans who designed and maintain said AI, is the moment we stop holding people accountable for real damage done.

Account lockouts are bad enough, but more serious things driven by AI are bound to reveal their fallibility. I sincerely hope tech workers have the integrity to take responsibility, judging by the current political climate and its participants' willingness to venture into thinking (surrounding the value of human life, among other things) that was considered taboo not long ago.

The moral and practical capacities of AI will reflect the limits of those designing them, at best.


Some time ago I used to run a userscript which replaced all occurrences of "Artificial Intelligence" and "AI" with "Artificial Idiocy". Added some charm to buzzword-heavy press releases :D.


Or “Artificial Incompetence”


This is an incredibly harsh and naive take. Authenticating logins at scale is an incredibly hard problem. There are tons of phishing campaigns and attackers seeking to get access to Google accounts all the time.

That they sometimes get it wrong sucks, but calling their attempts to do so "actual stupidity" is pretty rude.


Microsoft & Zoho Mail does the same, and when they do it, they also revoke all of your app specific password for good measure, so SMTP is a toast too.


> If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code.

Seriously! What! The! Hell!

I too have thought before that having 2FA (and linking a phone number, which I hate to do) would avoid tripping in such situations and that the systems would consider a different situation (like a different IP address/location, a different browser) as reliable enough with 2FA. But this irks me a lot.

I don’t really use Gmail much and have other paid alternatives, but I have some old stuff that may be mildly inconvenient if I were to lose them. Need to download the data and dump these accounts.


If you're entering a code, the 2FA method you're using is still susceptible to mitm-style phishing attacks, which is what this kind of location based check is securing against. You'd need a push notification or yubikey based 2fa check to get the same level of security.


AIUI, they do send push notifications if you happen to have a mobile device that's logged in to the same account. Maybe they should do the same for the "suspicious login to an unused 'secondary' account" scenario? They're already sending "recovery" emails, so it wouldn't be that big of a change.


I have several YubiKeys linked to my account. It will decline those as well. It demands that I sign in from Android sometimes, seemingly for no reason.


That's especially weird. I've had Google decline TOTP/Google Authenticator and SMS one time when I was troubleshooting a OAuth issue, but declining U2F? Are you logging in from various different VPN servers daily, or just through the same few ISPs?


No VPNs, just my home network with an IP address that rarely changes. What seems to throw it off is when I log in from "conflicting" platforms, particularly iOS + Android. I also have multiple iPhones for work, and it very much dislikes that.

When it gets in this state, nothing will work besides going to g.co/sc on Android--it can't be any other platform, regardless of how long I've had the device--and approving the code request there. If I approve it from any other device, even with a YubiKey, it'll give me a code on g.co/sc, but I'll be told it's invalid and I'll get one of those emails telling me the code was correct but declined due to suspicious activity.

I appreciate the attention to security, but c'mon, it's a YubiKey, and I'm logging in from my usual residential location.


If we reason from good faith and consider that this is intentional and not a bug, have you considered that Google did not implement "blocking suspicious 2FA" just to mess with you?

That perhaps this deals with a very real threat? Google has no incentive to make it difficult for you to log in, it's the exact opposite.


The problem is not really that they do it, but that they don't adequately inform users about this risk and that they fail to offer proper support and alternatives when it gets triggered. If they offered proper support a whole lot of the user despair and anger would disappear.


I agree to some extent, but also consider that whoever designed this may not be as intelligent or as widely experienced in certain matters as is necessary for the real world.


I have no doubt it deals with a real threat. That doesn’t change the fact that I’m regularly unable to log into my Google account.

Usually it happens when I’m using multiple devices simultaneously—for example, Android and iOS. It’s understandable that Google considers that to be suspicious, but if Google isn’t going to learn on its own, there needs to be some way for me to confirm that nothing is amiss. It’ll ignore everything from TOTP codes to YubiKeys.


I have an opposite anecdote: I moved to iOS but kept my (4-year-old) Android device active, and now I basically hop between a few iOS devices (but just one iPhone) and a Pixel 2 regularly. The only account that appears to dislike that is my work Microsoft 365 account that demanded I reauth all devices a couple times.

Not saying it's not true (I believe you), just that it's not designed to be a suspicious case, at least.


It’s definitely a point that should be made. Typical TOTP tokens are weak MFA in takeover scenarios. Especially considering that people have a bad habit of syncing them between devices.

What a lot of the grumpy posters here probably aren’t mentioning is that many ate probably doing high risk signal stuff like running through public VPNs. Google and Microsoft know a lot about what you are doing and what scammers do. They score risk accordingly.


With Google’s nonexistent customer service I’d be afraid of being locked out for any arbitrary reason and having no recourse no matter what recovery procedures I prepared for.

Contrast that to my bank where I can go to the branch, show ID, and get problems logging in resolved.


A plug from a very satisfied customer: I pay $5/month for Fastmail. I've emailed support before and reached a human within hours. They helped me with my problem, because it was their job and I'm paying them to do it.

Email is too important to rely on a free service which has a history of shutting people out, at any time, for any reason.


I prepay for the 3-year package and it comes out to $3/mo or something. I'm not going to stop using email, and Fastmail is fantastic so I'm not going to switch away, so it's worth prepaying.


Yep, Fastmail is great. Google cannot be trusted. With google you are the product, not the customer. The Fastmail service and features are better than gmail as well.


Still the problem with Fastmail is the same as with Google. Leaning on 3rd party service that you have no control of. There are so many things that could go wrong there, they can be hacked, go bankrupt, closed by authorities, insided. Everyone should have an appropriate personal disaster recovery plan that includes stuff like recovering from loss of service supplier.


This is a false equivalence.

Life on a crowded planet depends on third parties; choosing vendors well is a critical life skill.

Fastmail have a long-standing reputation for treating customers right; certainly not a reputation google shares.


Well, there's always a risk profile no matter what you do. But the risk profile with a company that's obsessed with AI and doesn't believe in having any customer support is much higher than one that you pay and has very good customer support.


Fastmail has been extremely responsive to any random minor issues that have cropped up for me or the several people I got to transition to their service over the last 7 years.


If you have your own domain it doesn't matter much. You can always move your domain to a better host.


Reasonably confident one of my support tickets even got answered by the CEO once. They're a shockingly human-focused company.


Yeah, likely - I've answered a few tickets here and there :)


That's really cool! I'm just now migrating my Gmail-led life (15 years) to Fastmail, and it has been great so far.


So happy to see this. I've started the transition of my 25-year-old .org domain from Gsuite legacy to you tonight :)


Just wanted to +1 this. I've been a happy customer of Fastmail since ~2013, never had a single issue, great service


> never had a single issue

Fastmail was blown offline by a couple of DDoS attacks recently. Both of them impacted my ability to access Fastmail, but I suppose you didn't happen to try to access your account during those attacks.


Fastmail is Australian. That is a nonstarter if you want any amount of privacy.


Ditto.

I'm a satisfied Fastmail paying user for years


Me 2


What do you do if Google buys Fastmail?


Switch to something else ASAP.


FYI, google has customer service if you're paying them. I pay $6 a month for gsuite. I've contacted customer service 3 times. Got them instantly.


I've read stories here on HN about non-existent Google customer support from people who worked at companies that were paying Google millions.


I live in a third world country on little island in the middle of the Pacific Ocean, yet have had Google respond within minutes every time I've had an issue (multiple times over the past decade). They have provided support both by phone and chat. I pay them 2 figures a month.


+1 on this. I’ve actually had them call me back proactively multiple times on a simple case too. Obviously it’s all anecdotal. But I have been happy with them (when paid)


They're supposed to have paid customer service for non-business users too if you pay for Google One, no idea how effective that is.


I was wondering that as well because I have Google One. When I go to the support page it claims 24/7 support for phone and chat in 2-3 minutes and e-mail support within 24 hours.


I have no idea what Google One is, but I get that level of support for the $12/month I pay them for Google Suite and have had great support experiences multiple times over the past decade.


If you have a Pixel, there's also chat + phone support in the help menu, though I'm not sure whether they handle account issues. (I used it a couple times because of, you guessed it, hardware issues)


"With Google’s nonexistent customer service..."

What's needed is enough of these cases to bring a class action against Google.

It's over a decade since I've used a Google account and I was similarly ignored even back then.


I have a few thousand dollars I earned with Adsense a bunch of years ago. They suspended my account and prevented me from getting the money. Every now and then I get a letter from some auditor that says I can claim the money. Just need to login to my google account. Needless to say google customer service hasn’t helped. Definitely need some class action suits to change their behavior, and I hate class action suits.


Exactly. But don't hold your breath waiting.


"With Google’s nonexistent customer service"

Quite. If you play the game then all is well but if you don't then you are given very short shrift and no recourse to a higher power or anything at all.

There is very little oversight. If you fall afoul of the "algorithm" or whatever bollocks is running the show, then you have to fall back on calling them out on the socials. Get enough traction on that and lo: "soz, lol, we failed here but your <whatevs> is important to us ... in this case ... etc ..."


I personally had a great experience with google support when I once stupidly locked myself out of my account. The whole thing was resolved in about 3 days.

However, google customer service is definitely erratic since loads of other people have had bad experiences. The best thing to do if you're using Gmail is to enable 2fa and backup the recovery codes offline and somewhere safe. This could probably get you into your account without needing to talk to support.


I have never heard of anyone anywhere ever being able to access Google support once they were locked out -- you need to be logged in to access what little tech support they offer.


Something can be critically important for a person to access on-demand and not be something they’re especially concerned about an attacker accessing. Two completely unrelated dimensions of access needs.


They are not mutually exclusive. An attacker accessing a service can hinder or even completely stop your ability to access that service (i.e. change your password).


Or do things that trigger the provider to force you to change your password.

See: Apple ID, where failed password attempts (by anyone) causes Apple to force users to change their known password.


Actually, I specifically declined setting up a recovery phone number because I accessed it from the location where receiving codes would be impossible on my phones. I always accessed it from the same IP using my own VPN server, entered the correct password, and still Google decided that they are 'not sure that it is not really me, try again later'. No thanks.


What about downloaded back up codes ? Phone push approval? U2f key? Authenticator app? Can't imagine complaining about being shut out if you didn't have at least one or all of these set up. Google even nags you about setting these up.


Why can't you imagine that? This gatekeeping you're doing is rude and doesn't make sense. 2FA's very purpose is to increase shut outs when enabled.


It might be 2FA's very purpose, but I've found that a 2FA-less account is a lot more distrusting of logins. Some of my relatives don't have 2FA set up and they got more "verify it's really you" prompts compared to my personal MFA'd account.


Because Google is abusing the concept.


I do wonder how many people will be locked out of their lives when they change phone numbers. 2FA across the industry seems to have rolled out this critical dependency without drawing enough (IMHO) awareness.


The only way to avoid getting into a trust-fail situation with Google is to be completely signed into it at all times so they can monitor you 24/7.


You didn’t understand the story. It’s google that’s using heuristic voodoo for critical things.


Yep, have had that issue for over a year now, I am completely unable to access my old gmail account despite having the password, recovery email and everything else.

Just says "you can’t sign in" and that's it: https://i.imgur.com/4YrElkJ.png


Try using a VPN to log in from the location you last used the account


Logging in from a known VPN IP will likely flag the activity as even MORE suspicious from Google's AI's POV.


Perhaps a better alternative than VPN (given it may look suspicious) would be to spin up an $cloud instance at whatever location and using a SOCKS proxy.

I used to do this back in the day to augment my Netflix selection.


This is no better. All the big cloud providers have their CIDR ranges published


That has not been my experience. I was able to recover two google accounts by using a VPN


Not sure why you're downvoted. Setting up VPN on my home router and using that VPN on my next travel will be the first thing I'll do prepping for a vacation. Using VPN is a right solution.

All the geo-IP nonsense is absolutely crazy, including these random login blocks and "security" checks. You also get UI reset to languages you don't understand, because no, websites can't use the language you set in your browser, they have to use some geo-IP nonsense to select a language (especially funny with IPv6). And there's no persistent switch if you use private mode, because they don't respect UA settings.


Not, Google, but I'm having sort of the same problem with Facebook. My church has a Facebook account that we used to set up our public page years ago. We assigned editors to the page, then promptly never used that account again. Fast forward to this year, and I need to add a new editor, which only the page admin can do. I reset the password on the church's facebook account (it was lost years ago), but when I log in, it says it doesn't recognize my location and it needs me to get codes from a list of trusted contacts (a list that I'm fairly certain we never set up). When any of those trusted contacts go to the page it lists, Facebook tells them they aren't trusted contacts. I have tried to get Facebook to respond to me in every single possible way. I have gone through all of their help pages, talked to their bot until it said it would forward my message to a human that could help, sent emails to every address I could find, reported the page and account on every form I could, hit up Meta on other social media, and even reached out to Oculus support and offered to buy a headset if I needed one for them to be able to help me get access back to the account. The only response I've gotten is from Oculus telling me they can't do anything. That's it. No other responses at all. I swear it would be easier to answer one of the 37 recruiters that have reached out to me, interviewed for a position, gotten hired, and then fixed it myself.


Can you find a facebook engineer on LinkedIn and send them a InMail? Only costs you one month of linkedin plus, or whatever it is called.


I understand you are saying this in good faith, but honestly this is bullshit. Is the only way to get a solution to use LinkedIn inmail to solve a login crisis?

There are plenty of FB engineers on this site alone. Are you all feeling okay with the work you’ve done?


There’s plenty of ways:

1) Get your story on HN front page

2) Get a job at FB, fix issue yourself

3) Install Tinder, drive near FB offices, set search radius to minimum. Try to convince your matches to fix things

4) Buy a 0-day from the dark web, hack into FB and reset the password

5) Become incredibly wealthy, acrue enough FB stock to get a board seat, complain to the CEO


Someone should sell VPN exit nodes next to BigTech offices so that people can exit their Tinder there and do the (3) connection approach without the drive.


Haven't used Tinder in ages, but don't they have a "Travel" option to find matches are a location of your choice?


It’s a paid feature but yes


What about spoofing your GPS location to the front desk of the FB offices? Should work with Androids in Developer mode?!?


> 3) Install Tinder, drive near FB offices, set search radius to minimum. Try to convince your matches to fix things

3 b) Install Grind[e?]r, drive near FB offices, set search radius to minimum. Try to blackmail your matches to fix things

(Yeah, it's a good thing that's a lot less blackmail-worthy nowadays. About as serious as what I'm replying to.)


Amazing :)


If it would work, then 100% I would do it in a heartbeat. I posted on Blind looking for help, but just got snarky high-school level comments. Have you had experience reaching out via LinkedIn?


Does this work ? Emailing the engineers on LinkedIn ?


You can send a message with a connection request, no Premium required.


Worth it for the story.


Yep, and it was even more aggravating.

> have three gmail accounts

> primary, name.surname@gmail.com

> secondary, name.surname.purchases@gmail.com

> tertiary, name.surname.work@gmail.com

> secondary and tertiary have primary as a recovery address

> log in/out once a week in 2nd and 3rd

> last August, try to log into name.surname.work

> "Password is incorrect"

> WTH?! of course it's correct.

> try several times, Google blocks me ("temporarily")

> next day, try again, no dice.

> OK, the hell with this: let's reset the password

> "what's the last password you remember?" duh, the last and only password is the one I already gave you, you stupid machine.

> "we need additional verification; input the recovery address" Finally! type my main address

> mail from Google arrives pronto, code in it

> type code in verification field

> new mail from Google: "Thank you for verifying your mail address" [my primary one?!] Based on the information provided, we cannot ascertain that [tertiary account] belongs to you"

This has been happening since. A few weeks ago, secondary account went down too, yielding the same error OP got.

Note: a) I have been using the same IP and the same machine to log into those accounts for many years; there is no other device or location where I've signed in before! b) primary account has multiple (4) Yubikeys associated with it, so it should be clear I'm a real person and not a bot.

I'm currently in panic mode: if my main account goes down, it will take a huge part of my life with it, from banks to government stuff.


I've had exactly the same issue before. The only way I could resolve it was by "confirming" my phone number. I didn't have a phone number connected to that account, but Google helpfully let me confirm it anyways (i.e. it just accepted the phone number as proof of me being me, despite never seeing that phone number before).


Set up a real email provider, forward your mail from google to them, and transition over.

If you want real identity security, reg your own domain, and move it with you.


> If you want real identity security, reg your own domain, and move it with you.

I'm pretty confident that Gmail is more secure than the domain registrar if you're really attacked. At least do your research carefully on this one. Domains do get stolen.

As always, consider your own threat model. But if you're a civilian? Wow, just hope you can walk away from the lockout.


Maybe. I guess it depends on the TLD. My country's TLD manager allows owners to lock their domains against transfers by registrars, or against changing the NS sets.

At that point, registrar can't do much to harm you.

Choosing your country's TLD for the most important domain is probably a good idea, if your country has well functioing and fair TLD manager. I certainly feel I have more of a chance when someone steals my country's domain, rather than some .com or .org. Country domain can be registered only to citizens, and so both the TLD manager and the thief will at least be in the same jurisdiction as me.


I am my own domain registrar.


The $3500 ICANN registration fee and the accompanying $4000 yearly accreditation fee hardly make running your own personal registrar worth it, and that doesn't even cover the necessary legal fees and paperwork you need to fill out to become a proper registrar.

The entire process also seems rather lengthy to me if all you want is set up secure email: https://www.icann.org/resources/pages/accreditation-2012-02-...


And can any random person with a gmail or outlook or yahoo email address successfully email you and get replies back?


In my experience, the moment someone emails your domain (at least on Gmail) your domain seems to become whitelisted almost instantaneously, even if others receive your email as spam. I don't know about Yahoo, but the problem is usually reaching out first. Generally, deliverability seems quite fine as long as you don't go for the cheapest package deal and implement all the modern protocols (SPF, DKIM, DMARC, etc.). Amazon IP addresses also seem to do quite well because Amazon has its own spam prevention system that's tied to your AWS account.

Having said that said, I haven't had a failed delivery in years and I host my email on a cheap VPS. I only started getting deliverability problems when I ignored my mail client's (and server's) warnings before sending a 100MiB email through a mail server that also hosted a TOR relay, which was pretty stupid in hindsight.

Mail deliverability isn't quite as bad as people seem to think it is, but if mail delivery to the big four fails, there's almost never a way to troubleshoot it. That's kind of a pain, I suppose.


Having your own domain doesn't mean running the email server yourself. Or are you suggesting that they filter by registrar?


This 100%. It's the only way you can move your email between providers.

Of course, it just shifts your risk to the domain registrar, so don't use someone too cheap. It's worth paying a decent fee for decent service here.


Perhaps you're not supposed to have more than 1 gmail account, and the assumptions in their code cannot deal with more than 1 account per user, or worse, they actively try to discourage it.


I've been using multiple accounts for years, almost every part of the UI has the ability to switch between accounts. Youtube even still has the old Youtube account available from before the Google+ era, and switching to it is painless.

There could be many useful and useless reasons for why accounts get flagged, but using multiple accounts isn't one in my experience.


All of a sudden? I've had those accounts for a very long time - I created them when I got an invitation to test the service (Gmail was in beta and not open to the general public.) The year was 2003, I think.


This would be pretty foolish on their end to discriminate this way, because I'm willing to bet 99% of their enterprise customers employees also have personal gmail accounts.


There’s nothing of that sort. Gmail has long had a feature where you could link your accounts and switch between them too.


Shared accounts are a nightmare too. Google makes it a pain for a team of developers to share a single "test" account completely seperate from their individual accounts.


I had something like this happen becasue I was logging in to some microsoft service, and thought I was supposed to be giving them my microsoft account password but apparently they wanted my gmail password for whatever they were up to. And doing a password reset on this microsoft service actually reset my stupid gmail account. Then once I figured out what happened, google wouldn't let me use an old password to set it back.


Is it possible that your secondary/tertiary accounts were victims of account takeover? Did you have 2FA on them?


Are you quoting from somewhere or is this bullet points? (I only know this bullet points style from 4chan so not sure if this might be a quote instead.)


Could be some bot is trying to log in to your account, triggering your account being locked down.


This is because most people use Gmail for basically all their online accounts: if you don't directly login to the site via Gmail, you can use your account to change your password. Imagine the damage which can be done if a malicious user breaks into someone's Gmail, if not your own, then the average person who uses the same password everywhere and trusts Gmail with everything.

Not defending the practice at all. It shows we as a society and Google in particular need better security if they are flat-out locking people out of their Gmail accounts and others are still being compromised (I know they are). I honestly support Google forcing people to use recovery addresses and 2-factor authentication but I don't support them making the recovery authentication not work and providing literally no options for a legitimate user.

I think the best you can do right now is complain on HN and Twitter and you'll probably get your account back. In the future, maybe if you have a YubiKey or stronger form of 2FA Google won't lock you out, because obviously if someone can authenticate with a YubiKey they are practically guaranteed to be the real person.


>obviously if someone can authenticate with a YubiKey they are practically guaranteed to be the real person.

Or someone grabbed your backpack.

I understand why Google wants 2FA - it gives them a stronger claim to not provide support. Personally I don't want 2FA - I use strong passwords, and I don't trust them to provide support if my device is lost. Imagine a house fire, for instance, and losing not only your possessions but also basically all your online accounts. I have password backups, nobody has device backups.


The chance of someone stealing your physical token, and knowing your email + password are almost impossibly low.


But if you lose your 2FA device then you lose access to everything if there is no alternative recovery mechanism.

I recently started working with a client that uses cloud-hosted everything and mandates 2FA for all accounts. They asked me to install Google's authenticator app for that purpose. So far, so reasonable.

However of those different services, only one provides recovery codes as a standard part of its 2FA registration process. For everything else, if my work phone gets stolen or broken, that's it, game over for those accounts. I would need to contact the administrator for each service on my client's team and get them to restore access somehow.


Another scenario where yubikeys shine: you can have multiple. Keep one in your main computer, one on you, and one at your parents's place, or even a safety deposit box if you're feeling fancy.


Definitely an advantage. Of course like any other back-up it's only worth anything if you test each copy regularly!


tbh I think that's basically reasonable for corporate-controlled accounts. They can verify that you are you, and recover the account (or get you a new equivalent one) pretty much no matter what you screw up. It might take a couple days, but it'll happen eventually.

Individuals do not have that kind of power over their own accounts. So if you screw up, you're screwed for good. 2FA means third parties can screw me over at any time, I see no reason to take that increased risk.


this only works if your post gets upvoted.

which in the grand scheme of things is rare. have you been to the "new" page lately?


(you're all checking out the 'new' page now, aren't you?)


I browse 'new' most of the time, because there is a lot of interesting stuff that never makes it to the front page.


guilty


Things I can recommend in your situation, which helped me in the past, in no particular order:

* log into other gmail account (with a long history) using Chrome without any addons, log out and then immediately try logging into the primary account (ideally google should ask you if you want to add another account)

* log in from the same location. I once spent two years abroad, and could not log in to one of my accounts. I regained access only after returning to my home country

* if you are working in an organization that owns an IP range, try logging in from work, i.e. do not use publicly available ISP.

You'll get best results if you can combine two or more of these points. Unfortunately even following this advice you are not guaranteed to be successful...

For the future reference, the only prevention that I know which works 100% times is using YubiKey for 2FA. 2FA with TOTP codes often helps unlocking the account, but I had cases where even the codes did not help.


> using YubiKey for 2FA

Today Google/Gmail suddenly logged me out and asked me for the hardware key, and I thought no problem as I have OTP with my Password Manager, but OTP didn't work. I had the key somewhere else. Luckily after insisting a bit Google gave me the option to use my mobile Gmail app to verify it's me (note it was not Google Authenticator, why did they made me install it?). All this hassle even though I've been on the same ISP/IP range and computer for weeks. No VPN or anything.

On top of the multiple authentication options, I'm going to add a second hardware key in case I lose my main one and Google decides it's the only way to log in.

Edit: the OTP option is not there anymore in my Google account 2-Step Verification, but it did ask for it and it failed.


I once had a situation where I didn't have access to my YubiKey but I had backup codes (not from the authenticator app but the 10 codes you are given when you set up 2FA for the first time). I could log in but I thought I'll remove the YubiKey from the account and set up TOTP (Authenticator) instead. It turns out you cannot do this using only backup codes, you have to have the key! So if you loose your key and run out of your 10 codes, you may loose the access to the account forever! It seems that the only way to prevent this is to have two YubiKeys added to the account...


They do recommend having two keys associated with the account. It’s not cheap, but you can pick up a USB-C small format one and leave it in your computer & get one for your key ring that does NFC / Bluetooth. One is always with you, one is conveniently on your main computer.

You can get the least expensive model as a third, off-site backup.


All hardware dies at some point. What if both the Yubikeys die? What if the third one was already dead before and it wasn’t noticed because it wasn’t used recently? This sounds like too deep a maze for I don’t know how much benefit.


It’s really up to the user to determine whether it’s worth it for them. I work in security, so I eat my own caviar in my personal set up and like to test things out.

All hardware dies, but I also have different keys from different vendors (not just yubico), purchased at different times. The likelihood that all 3 die at the same time is very low. Whether it prevents an attack that would be successful without the physical key (e.g. SIM takeover) is something I won’t ever know. Both of those scenarios are very low likelihood.

But to have this level of security requires extra work, and part of that work is regularly testing that the keys still work. With the increasing account lockouts, this thread is showing me that physical keys may have another advantage.

Most people are set up so that their email account is a “Jesus Nut” [0], so this extra level of security is well worth it as it protects banking, personal files (g drive & photos), password resets / password manager, and purchasing capabilities.

An approach I like is using one’s birthday as a reminder to reset important things - check security keys, check batteries in critical items, test security system, etc.

[0] https://en.wikipedia.org/wiki/Jesus_nut


> But to have this level of security requires extra work, and part of that work is regularly testing that the keys still work.

This is a late reply, but thanks for your detailed response. I agree that this requires extra work, and that it is important. But the cost of multiple hardware keys also add up. So I doubt if this is a solution for the masses (of course, I'm not implying that anyone who's concerned about losing an account shouldn't spend some money and time).

If you do see this reply, I'd like to know the other vendors (apart from Yubico) whose keys you use.


I don't know why they removed OTP. I like handling ALL my logins through a single Password Manager.


Similar case here. One of the Google accounts I have has three 2FA setups: SMS, TOTP, and Yubikey. One time I tried logging in I didn't have my Yubikey with me. I thought no problem I'll use the TOTP authenticator app. Google told me I can't login even though the code was correct.

There wasn't any way to address that except by actually using the Yubikey to log in.

I'm using a fresh install of Chrome with no addons.


One day I logged in to my Amazon account from a different country. Mind you, I have 2FA/OTP enabled in my account, and I entered it correctly. They also made me click on a link they sent via email to "verify my login".

A couple hours later my account was blocked due to "suspicious login(s)" (i.e. mine), and the order I placed cancelled. They had me wait 24h until I could contact someone at support that could unblock it. He told he was going to disable 2FA (?) and send me a code that I could use to change my password.

The code was sent via SMS.

They think that someone who has just my SIM card (or a clone, FFS) is more trustworthy than someone who has my password, 2FA token, and email address.

These companies take user security as a joke, or as pure theater.


It's incentivized top-to-bottom. Every audit is structured around checking boxes, absolutely zero interest in actual security. Just state you have processes, that they meet the loosely written (or in some cases bizarrely specific) spec, and be able to provide some writing that explain them at least at a surface level.

This is the case for just about every framework, and even though these systems are just for window dressing, the auditors are mostly incompetent. A review a few years ago showed that 20-50% (depending on which of the Big 4 you've decided to hire) of audits were done incorrectly.


I recently quit my job in Information Security. We used the NIST 800-53 framework. 99% of people following security frameworks just blindly check in boxes during audits or control assessments. A security control/requirement can’t be met? No problem! Just create another piece of paperwork accepting the risk and get it signed off by the system owner (who has the most incentive to not inconvenience their project or department due to an outstanding security requirement).

The things I saw that were labeled as “acceptable risk” would drive me crazy. Maybe the government hires incompetent security practitioners? Do all organizations have this type of behavior behind the scenes?


The entire system is about abstracting away liability, not keeping things secure. Every framework is like this. The fact that companies are paying auditors to review their own work creates a completely upside down incentive model, and turns it into effectively a rubber stamp. You have to do things horrifically wrong for an auditor to care, and it's not like they're actually going to fail you, they'll just tell you to fix it and give you a generous deadline (or, for frameworks that allow it, do what you described and have it signed off as a known risk).


The flipside: I've recently been working with a company that was audited and called out for allowing too many security policy exceptions.

As a result, unless you can satisfy every one of their requirements, regardless of mitigating controls, you cannot get installed. Even if you're a security product whose ultimate use case is discovering in-progress exploits.

I'm not sure if that's an example of the system working or being broken. But overall, Information Security is a complicated problem.


I was working for one of the Big 4 in risk assessment and this is 100% how it works.



It's absolutely bonkers what stupid crap some companies would call "security", and what lengths they'd go to enforce it.

- Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one.

- A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more.

- Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password.

- Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.


> - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one.

A good password manager, such as KeePass, will generate a passphrase. That is, words. Use that instead. Even if they ask "what is your mother's maiden name" just make up a passphrase.

> - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser.

Yes, but;

> This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more.

This is false. I know many people who share computers. I treat all my computers as shared even though they are not; it's safer that way.

> - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password.

I agree that password changes after a certain time period is stupid. However, a password manager solves the problem of forgetting your password.

> - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.

100% this


> A good password manager

> a password manager solves the problem

Sorry but as a software developer myself, I can't trust a piece of software to store all my passwords and thus be a single point of failure for my entire digital life.

> This is false. I know many people who share computers.

With a single OS user account? Even android tablets these days come with multi-user support.

> I treat all my computers as shared even though they are not; it's safer that way.

Do you not have a password, and preferably full-disk encryption, on them?


Ideally Bitwarden, Keepass or what have you should be printed on a piece of paper and put in a safe.

If anyone gets access to my weapon safe I got bigger problems to think about (no, not the weapon(s) but whatever has caused the situation.)


As a software engineer you should know that you could use multiple redundant open source password managers with your password database backed up multiple times and remove your current single point of failure (your memory).


> You want me to forget my password? Because this is how you make me forget my password.

   MySuperSecrit001
   MySuperSecrit002
   MySuperSecrit003
...


Amazon's security is completely bonkers.

I lost access to my old account and they just decided that I will never change my password there.

To unblock I must provide them with proof of identity.... that includes: - notary certified copy of my passport, in English... (I'm not from an English speaking country) - proof of residence in Ireland, where I wasn't even resident, but I did receive a few packages

or.... I could just call my old phone number and ask the person to just forward me a text that they send to that phone number.

I mean... How over the top are the requirements, while someone with a damn leaked password database and access to my old phone number will be able to just "sail through"...

My AWS/Amazon accounts don't even have any activity or data in them...


The amount of trust that providers put in phone numbers is absolutely insane.


That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.


Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.


Is this a niche waiting to be exploited?


Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies...

But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field.

Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.


I'm pretty sure in the US the barriers are also commercial, ie, Epic (a huge hospital software company) is not going to make it easy to do digital transfers of their patient data to non-Epic computer systems. Only the small-fry software companies will want this.

What needs to happens is for the US federal government to issue a mandate: if a hospital wants to get federal dollars (Medicare, etc), its computer system has to comply with the FXHR rules (Federal eXchange for Health Records, or whatever they want to call it). To establish FXHR, they get the top 5 vendors in a room and tell them that they WILL come up with a data exchange protocol and format within x months. They did this with HIPPA, they can do it with data exchange too.

And it is sorely needed. I went to Mayo Clinic for a week, which generated 80 pages of medical reports. To get these transferred to my regular doctors, I had to call Mayo, request the transfer, and they had to schedule the transfer, which sometimes took up to a week. This isn't because they are inefficient (far from it). It's because when they do a fax, sometimes the fax machine isn't on, so it can't go through. They have to retry until they get through. The receiving machine ran out of paper. Etc. It's ridiculous.

Beyond that, I watched my eye doctor try to flip through 80 pages of crap that mostly didn't relate to him to find the pages that were eye related. None of this has any structure; it's just a bunch of pages of text. Horribly inefficient use of his time, and very likely he would miss something important. You want to see blood test results? Well, I had about 10 of them testing various things, and the lab results are spread all through the report. Good luck finding what you want. Truly a mess, and the large software companies have zero incentive to fix this problem. Their goal is to be "the one to rule them all", or at least one of the few. And when there are only a few, there still won't be any data exchange, because they will be duking it out with each other.

Government screws stuff up all the time, but so do private companies, and government is the only player in a position to force the private companies to do the right thing.


The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon.

It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.


> ...insane to allow broad access to medical records through any centralised system any time soon.

> It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways.

Funny, one would have thought that pretty much is the status quo already: Looks to me like the UK already has (or should have) a single centrally-administered records facility with robust security and audit trails -- isn't that the NHS?

If it doesn't at the moment quite fulfill your requirements, it certainly ought to anyway, oughtn't it? So the problem is one of fixing its possible current deficiencies, not one of lacking it entirely. Or?


The NHS isn't really a single body at all. It's a vast, unimaginably complicated network of healthcare professionals, medical facilities, managerial organisations, supply chains, and so on, under the shared banner of being public-run and with strategic leadership appointed by the central government (modulo some devolution to different parts of the UK at various scales).

In normal circumstances an individual's primary point of contact with the NHS is supposed to be their GP, and the GP's surgery will normally hold the main medical records for each person under their care. But then other parts of the NHS, such as hospitals or therapists, may hold their own records in connection with the specialised treatments they provide. There are all kinds of protocols for sharing health records between clinical professionals who are directly responsible for a patient's care and potentially others and successive governments keep meddling with them in ways that make you nervous about those others and what they get to know and what they can do with it.


Ah, thanks!

I kind of assumed there was some public administrative service run by the national government behind it all. That would have been the logical entity to run a central storage repository, and perhaps to administer and maybe even define the storage and transmission format(s). IMO.


LOL!

I just had an email from Mouser(online electronics store), that gave me the option to send in export for by fax...


I agree. I change my phone number often and this is annoying.

It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP.

I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable.

Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.


Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.


That's interesting. What 2FA system do they use exactly?

AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.


It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.


N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?


Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)


I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).


My phone number is probably the least valuable thing Amazon knows about me, I figure.


Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales.

Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.


I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world.

E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that


Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.


Wechat does this to me just to use the app. They keep making me play stupid recaptcha games and do verification codes then ultimately block me anyway. I finally gave up on using it.


To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transaction then the bad actor already had my sim card and ability to log into my account.

Serious question: is there any examples of a robust way of doing customer security? Even just a proposal/document or blog post (doesn't need to have been implemented). I sort of feel no one has figured this out yet (if its even possible).

Companies just need to make sure their insurers will pay out, which if there is not proven solution seems about all they can do.. tho a little humility and honesty that that is their position would go a long way.


U2f key ? Works for me.


Are there best practice process diagrams to support the correct usage of these with b2c services?

how should the initial verifiacation happen? what happens when i loose/corrupt/break the device? should this represent me as a human or the keys to an account? - should a human hold the permissions ultimately (if so how to i override a key?)


I always wonder, are there banks using U2F/Fido(2)/Webauthn or whatever it’s called now? I’m reasonably certain not in Germany, but is there one in another country?


2FA is going to be exposed badly by some basic social engineering one day. When I worked in a hospital, 99% of the people dealing with HIPAA protected patient data were doing so on a desktop that sits in an unlocked office or in an open reception area with the duo two factor authentication set to call the landline right next to the desktop.


HIPAA is always going to be a joke. Walk around the hospital's parking lot and drop a bunch of malicious USB drives with the logo of the hospital on them. Someone is bound to pick one up and stick it in a machine on the network.


Google is absolute trash now compared to what it was.

Most accurate search engine is now almost useless even for VERBATIM queries; queries that took milliseconds earlier (they even built a product around that, Google Instant), now take 2-3 seconds on average.

Best email service, now feels clunky and slow plus the spam algorithm not only stopped working, but is now working backwards.

Everything just worked and it was simple to grasp and to work with, now we have issues everywhere with their draconian 2FA among other "wise" decisions in the name of "security".

All this while on Android, basic stuff like calling 911 so you don't die is not possible because of all the other "features" they keep adding to the platform, see: https://news.ycombinator.com/item?id=29492884


>Best email service, now feels clunky and slow plus the spam algorithm not only stopped working, but is now working backwards.

That's annoying, and they don't even care anymore. Now I have to check my spam folder multiple times a day. A lot of legitimate email is going to spam and vice-versa.


Wasn't aware of this, but can't say I'm surprised.

Personally, I'm still happy with Fastmail, which uses customer subscriptions fees to fund a professional support department, as well as contributing to email-related FOSS. (Among other things, obviously.)


I moved my family to Fastmail a couple months ago and it’s been wonderful. Never knew I wanted “shared contacts”, but it’s the best feature ever. Once I figured out it existed, I spent a couple days making really good cards for family members and family friends, and all that work is shared with the whole family.


for others curious what this feature is: https://www.fastmail.help/hc/en-us/articles/1500000279721-Sh...

> Sharing contacts is an easy way to let all users in an account have access to common address book entries.

> Businesses can share their corporate directory easily. Families can share contact information of extended family members.


I moved my email to Fastmail this week in the wake of the Google Apps announcement. Having your own domain is great since your email becomes provider-agnostic. While Fastmail had a great import tool, I could have transferred my Gmail myself from backups. I'll be ready to do the same if Fastmail goes under or is no longer competitive.


I've heard this from a several posts this week. Genuine question: since maintaining GSuite is expect to cost $6/user/month and Fastmail costs $5/user/month, do you really find the $1/user/month in savings worth the trouble of moving email providers and losing Drive/Docs etc.?

I'm planning a move too, but Fastmail's price doesn't strike me as competitive enough compared to Google's price. Amazon WorkMail is $4/user/month and Rackspace Email is $3/user/month.


There's going to be a lot of hassle, but I'm planning to move many of the Google services to old Gmail accounts. To some extent it's more of a justification to reduce reliance on Google. When running the numbers I was initially confused about the pricing for Gsuite and thought "standard" was the lowest tier ($10/month/user), so it's not the most strategic decision price-wise.


Fastmail is doing only email and has been doing it for a long time. I simply trust them more to care for their users and for me it is worth the price.


Last week's news gave a lot of people the nudge they needed to finally migrate away from their legacy free GSuite accounts to something more reliable.


Yep. I've been a Fastmail customer for a while with a couple of my own personal accounts, but our family e-mail domain was a legacy GSuite account. I'd get pushback from my brothers when I'd suggest we switched to a paid service, because they didn't want to pony up for email accounts for their kids. Cheapskates :). But now Google is forcing the issue, and Fastmail is cheaper. And they have a $3/month account which is good for the kids who don't get tons of email.


Can I ask which news? I'm already a happy Fastmail customer, just curious.


This [1] Neat fact, Google is yet to tell me they are making this change to my account.

[1] https://arstechnica.com/gadgets/2022/01/google-tells-free-g-...


Yeah, I haven't gotten the official notification yet either. Maybe going in waves?


I disabled the GMail service in my GSuite account, will they honor the domain's current MX records? Because I know they don't for calendar invites.


Not that anyone will likely see this, but I just now finally got my notice from Google about this change.


Same. Has anyone heard of anyone who HAS gotten a notification?


Same here but I pre-emptively moved everything to Fastmail (coincidentally) anyway, was the nudge I needed to finally drop the last of my Google services


Wait what? This is the first I've heard of it. Bad timing.


There was an HN discussion about it here: https://news.ycombinator.com/item?id=29996432

People are pissed.


Fastmail's UI is just faster too.


It's too bad their app doesn't have offline support. I use that feature of Gmail app a lot


On iOS and macOS I just use the standard Mail.app. Works well and even push notifications work.


IME, that's my biggest complaint. Even plain text emails take 2+ seconds to load.


Somethings wrong or suboptimal for you. Just tested this in the middle of the US with some messages from years ago to make sure they weren't cached and it was like 2-3 tenths of a second.


I actually enjoy watching it tender at light speed!


I'm still a happy Fastmail customer after around 17 years.


Fastmail looks great, but having "Get the email features you need, without giving up your privacy" and "Your data is always private" at the top of their homepage while knowing full well that is far from the case[0,1] seems disingenuous.

[0] FastMail loses customers, faces calls to move over anti-encryption laws https://www.itnews.com.au/news/fastmail-loses-customers-face...

[1] Goodbye FastMail https://www.ctrl.blog/entry/goodbye-fastmail.html


You are never safe from these shenanigans, not in Switzerland and not in Germany.

If you absolutely must have email out of the hands of low to mid grade government entities you need to implement the technical solutions yourself. If you want more, just forget it, if they want your mail they'll just get it at your endpoint anyway.

(also, "most email is unencrypted in transit" is a very out of date take, I've checked all correspondence I've had with medical practicioners in the past 2 years, and all where at least TLS 1.2 on the transport, close to half 1.3 - and i was sent around quite a lot last year)


> If you absolutely must have email out of the hands of low to mid grade government entities you need to implement the technical solutions yourself.

Very off-topic, but this is exactly the most important and consistently underappreciated angle to the Hillary Clinton email server scandal. She deliberately designed her team's communications infrastructure to be maximally resistant to legal process.

I don't want to make this political, it just bugs me that media coverage--regardless of political slant--always seems focused on irrelevant details and ignores what (arguably) makes it an actual scandal.


Fastmail is not a zero-knowledge service. Unless I'm missing something, anti-encryption laws seem to be irrelevant, since they don't really change the position at all.

I suppose hypothetically if Fastmail was a zero-knowledge service that law might mean they need to break it, but it's not a zero-knowledge service so the issue doesn't arise.

You're going to be hard pressed to find a service provider which ignores valid warrants. Such a service provider would need to either operate unlawfully, or not hold the information (ie be zero-knowledge).

Even Protonmail, the bastion of email privacy, has supplied the IP address of a user in the face of a warrant.[0]

[0] https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...


I'm not expecting government-resistance from any third-party service.


I'm also a happy customer of Fastmail. Can recommend.


I too have used Fastmail for over a year now, but I do wish they would add a few much needed features.


Would you mind sharing which features are missing that you miss?


- A phone app that can handle being offline. (the biggest issue IMO)

- I want better parsing of dates, so I can click on them, and add to my calendar.

- The calendar needs to be able to show more than one timezone at the same time.

- Have a way to create a secondary icon on your phone to go to the calendar. (You have to click multiple buttons)

- An iOS calendar widget would also be great.


Have you used Fastmail's support?


I have, yes, and the response was swift and helpful!


Yes - it was almost instantaneous, super helpful.


Yes. It’s great!


Good to hear. I’ve been with them for a few years and support was one of the reasons I moved over from Gmail but I’ve never actually needed it.


I tried it, they are responsive and helpful.

A bug I reported is actually sent to the development team, and it's fixed. It took 5 weeks, though.


Hah, I had a bug/request for clarification (their rewriting of media queries), it got escalated 2 times to the dev team, and it took 2 or 3 weeks to get that answer :D

Had one other contact that was handled by normal support, that was just a day.


Do they offer an api?


You mean IMAP and SMTP protocols, right?


And JMAP.


I mean an api like mailgun


That's more for sending email. There's two APIs for sending: SMTP and JMAP. Both work completely fine, and have the same overall sending rate limits.

We (Fastmail) are set up for human-to-human emails rather than bulk mailing, so if you try to do bulk mailing you're likely to hit limits and possibly terms of service issues - if you're trying to do the kind of thing that people use mailgun for, then I'd recommend using something like mailgun instead!


yes, and it makes the gmail API look like a toy

https://fastmail.blog/open-technologies/jmap-new-email-open-...


1password have an interesting article about integrating with FastMail using JMAP: https://blog.1password.com/making-masked-email-with-jmap/


Reminder: Google paid for an ad campaign with this gist: A father creates a Gmail account for his daughter when she is born, and sends her important photos and mementos as she grows up. Sweet. Reality: At least one person tried this in real life, and the child's account was automatically deleted without recourse.

https://tech.slashdot.org/story/11/12/18/2046221/why-google-...


You can do this with a regular Gmail account. The kid just can’t log into it until they are 13 or older.

Google also now offers child Google accounts for kids under 13, which are limited and tied to a parent’s account through an app called Family Link. This is how you can set up a Chromebook for a kid, for example.

This limit of age 13 is not arbitrary by Google; it’s their way of complying with a U.S. federal law called COPPA.


It’s not arbitrary within the US, it’s arbitrary everywhere else, where the US law doesn’t apply.


https://support.google.com/accounts/answer/1350409?hl=en

It's clearly not just US that they are not arbitrary. You could argue for countries not listed above it is arbitrary but it is clearly a legally safer option for a US corporation, so not really arbitrary.


Not when google is a US company.


US law does not apply for people living in the US. These people have no rights.


Do you mean outside of the US?


Google is a US company so US law always applies to it.


Edit: I just got back in! I had to give a real phone # for the SMS step. It pretended to accept a Google Voice # but would never send a code and I just got stuck in the loop I describe below. I've now closed the account. Oh, the irony...

Yup, I've got an old gmail account that Google won't let me into. First I get:

"This device isn’t recognized. For your security, Google wants to make sure it’s really you."

With options for "Confirm your recovery email" and "Get a verification code at <elided recovery email>."

Regardless of which I choose, it then asks me for a phone # for an SMS code. So I give it one, just to get:

"Unavailable because of too many failed attempts. Try again in a few hours."

Except, "a few hours" is a lie. I last tried this weeks ago. I get a "Try another way" option which prompts me "Enter the last password you remember using with this Google Account." at which point I'm at a dead end because this account only ever had one password.

The best part is that shortly after going through this exercise I get an email to the recovery address:

"Sign-in attempt was blocked. Someone just used your password to try to sign in to your account. Google blocked them, but you should check what happened."

With a "Check Activity" button that takes me right back to the Google sign page...

Buttle? Tuttle?

The irony in all of this is that I'd forgotten about the account until Google sent an "new terms of service" email to the recovery email address and decided I wanted to close the account. But I can't login to do so.

Anyway, I switched my primary email away to Fastmail years ago and I'm still happy with that decision.



Nearly every interaction I have had with Google in the last two years makes me think the company has devolved into warring factions that cannot communicate let alone coordinate for the betterment of their users. Do they not eat their own cooking, or how do they manage to make everything so dysfunctional?


> has devolved into warring factions that cannot communicate

Maybe they should come up with a new chat app that will fix the communication issues.


Perhaps remote work doesn't lend itself to a well coordinated company?


Google has lost its way long before the pandemic


Google added one of my employee's LinkedIn account address as our LinkedIn URL to our company Google business profile. We have contacted google support about this to change URL to our own but we got response like following:

    I understand that you are referring to an incorrect LinkedIn profile which is visible under your business profile in Google. Please be informed that information from social profiles are collected by automated algorithms.

    There's no way to manually remove these social profiles from our end. This is something which is driven by Google’s algorithm, based on the visibility, ranking, web presence, etc. of the particular business page. We at Google do not have any manual control over this.

Google and its algorithms are going bad and they have no control over it. It is getting ridiculous.


Just FYI there is a solution to this: enroll your gmail account in the advanced protection program

https://landing.google.com/advancedprotection/

When you login you are required to use a security key (like Yubi key) but it removes all the annoying emails and texts with codes, IP filtering, login AI, etc


If you use your phone as the security key and something goes wrong you are in exactly the same situation. Let alone with weird one where they talk to your phone using bluetooth as a security key. I have seen that one go very wrong so many times now.


That's not a possible state to be in. Google won't let you set up Advanced Protection unless you configure a minimum of two security keys, one of which may be your phone's built-in key.

https://support.google.com/accounts/answer/7539956


Hit this over XMas. Dad got a new fire stick. Wanted to use the YouTube app. Wanted to sign in to YouTube for channel subscriptions. Had a GMail account he'd not used in years. Tried to recover it with the whole send-a-code-to-secondary-email rigmarole. Google went to the trouble of sending a code, but upon successful entry decided that it just wasn't good enough. Maddening. Gmail account gone forever. Can't sign up for a new one because "phone number used too many times". Fuck me I guess, guess we'll have to use one of the unofficial YouTube apps that do client-side subscriptions and incidentally block ads.


> "phone number used too many times"

Reminds me of that time we did a project for google. They couldn't give us accounts which was required to do the job for them, too much hassle even for them internally. We bought a dozen phone numbers and invoiced them instead. (There is some humor in invoicing Google for circumventing a Google security system.) Each phone number is good for a handful of accounts per ~2 years iirc.

This is in a country with ID verification for a new phone number (no, it's not russia/iran/china... it is germany). The person behind the counter was not happy when I showed up to a busy post office with a stack of ID verification requests. (I couldn't have gone at a quiet time: they scale employees and I queue for 15-20 minutes every time also for a 20-second package pickup, no matter which day of the week, which time of day, or which city I go in.)


I recommend NewPipe for watching YouTube on phone. Best of its kind, free and open-source. https://newpipe.net/


It’s this kind of thing that has had me moving most everything off Google over the last 6 months. It’s just not safe for me to have 20 years of photos, emails and documents in the hands of a company that may cut me loose at any moment. After decades of slowly moving my life to “the cloud”, I bought a Synology nas, and now all my stuff lives in my own house (though backed up externally, of course).


Curious about the backup solution.


rsync.net, just because I have a pile of storage with them that I’ve had forever and not really made good use of. Synology natively supports S3, which includes Glacier, which I may use some day if I feel like a nearly free solution.


Same here, I got an email to my main mail account saying Google has blocked a login attempt to another old Gmail account of mine that I haven't used for a long time (the old account has the new account listed as the recovery email). So I tried to log in to that old account, and got the same message to "try again later". I tried a few more times over the next few weeks but always the same message. So even with the correct password and access to the recovery email I still can't log in to the old account, and there's no way to get around it. I just gave up.


From my experience, as a non-Apple user, they are the absolute worst. I bought a family member an iPad for Christmas. They had an Apple account associated with their iPhone. They forgot their password. No big deal, I'll just reset their password.

Ha! We have to wait 24 hours after wrestling through the page, I leave my holiday visit in 36 hours, that's fine we have time I say to myself. A little odd but whatever, the account itself has no payment or important data associated with it really. 24 hours pass and the recovery page then suggests 14 days for recovery. What?!?! Why!?! (I mean, I get why, sort of, but I've done highly secure work that has less/shorter security processes than a consumer phone account). Apple says there's nothing they can do.

That's fine, well just create a new email and account for them I say to myself for their iPad annoying and yet another account for them to remember, lose the password, and deal with but whatever. Ok new email, new Apple account, sign in and perfect. Now I just need to disassociate the phone with the account its locked out of and switch it to the new Apple account to make syncing things a bit easier between devices. Wait, I can't do this until I recover the account to sign in to then log out of in the device. Wow. Again, I understand the security model here, but wow, a consumer device? Insanity.


The problem is the Apple ID is heavily tied in to their anti theft features. So you just cant reset a device without the password. And people do not understand the gravity of this situation, someone at the Apple store really should be hammering it in that you must not ever lose your Apple ID password.


I stopped using gmail. I pay for my own domain (approx $10 per year and subscribe a hosting service that costs about $4/month). The total cost is not much different from a paid google email which is about $50/year.

If I happened to forget/lose all passwords (lost laptop, burned house etc.), I would probably need to deal with the hosting company who would try to identify me with my credit card or some other way (phone number, mailing a letter to my physical address on file). Nothing is absolutely secure but I think it is secure enough for me while I also have fair good chances to recover my lost access. I am not a big target to scammers anyway.


In most cases it’s easy to social engineer hosting company staff into granting unauthorized access (even the major ones) all it takes is a bit of know-how and maybe a photoshopped ID. The weakest link in any security stack is always the human element. The fact that Google makes it impossible to get in touch with a human is why I trust it.


This is one of the reasons I've been reluctant to start using a hosting provider (in addition to social engineering, it's always possible that their infrastructure gets compromised). Their problems become my problems. And on the other hand, some of the big ones are also prone to arbitrarily blocking you for random reasons, just like Google. Didn't take long for Hetzner to block me.

I still host my mail at home and am my own registrar. There are still human elements of course but I've minimized them to the extent that is currently feasible.


The biggest risk I think is falling a victim of the scam. I usually get emails purportedly from my hosting provider (sometimes from my bank etc.) that I need to verify payment or something like that. Obviously they are fake but I can understand that even an attentive person can have a bad day and click on a malicious link and enter all required details. Google is probably better in filtering out such scam. And yet I wonder if it still happens often enough that they actively block login attempts if they are from unusual locations.


It can be done but it is not guaranteed. Smaller companies have more geeky staff who would be more suspicious and wouldn't let that easily to be had. They have more accountability.

I hear that many accounts of celebrities get hacked and I wonder how? Apparently even with 2FA it is not that secure. Some countries let you order a replacement SIM quite easily and then it can get intercepted (maybe by stealing from mailbox or similarly). This appears to be a reason why google has been refusing access even with 2FA in place.


BTW A paid Google email via Workspace (previously G Suite) has gone up to $6/month/user, so $72 USD a year for a single user setup.


Google/Gmail is a nightmare to use for me as someone who travels overseas to visit family. Logging into Gmail from a different device is a harrowing experience. SMS 2FA doesn't work with many providers even with international roaming turned on. So you're dead in the water and face a potential account ban that can never be recovered.

Years ago, I had my account suspended when I was implementing an Adsense integration into a site for no discernible reason. I have too many ancient financial institution's login tied up to my primary email. That was the last time I signed up for anything related to Google. At my workplace, I'm a strong advocate against the Google ecosystem. A few of us fought hard to keep our cloud systems away from Google and move to Azure. I've seen similar sentiments from quite a few devs in the last few years.


Those of us who move around quite often can attest to how frustrating the security of online services has gotten.

It can get even worse if you provide a phone number for "added security" and find yourself in a different country with a different phone. I've witnessed a few fellow travelers getting locked out of accounts because they couldn't access the SMS sent to their home phone number and the app was ignoring the code sent via email. Yahoo, Amazon, Gmail. I've even seen someone unable to use their Airbnb account for this very reason, which is odd considering that the service caters to travelers (that was 6 years ago, so maybe things have changed).

If you travel and change phone numbers often, avoid giving it for security if you can.


I know the pain of the internet with borders.

Paypal phone support literally told me to close my Dutch account and open a new German account so that I can use paypal in Germany. If you can login to paypal from abroad, that is a bug according to them, you're not supposed to be able to login from abroad (like when on holiday) and need to make a new account instead. (I currently start a VPN into NL every time I need to use paypal; one more reason to avoid them.)

In their defense: at least paypal has phone support. Try that with a gmail account.


PayPal is just as bad. After I moved country, I forgot to log in into my old PayPal account for months, and I've never been able to log in again, even having the right password, the same phone number, everything.


I stopped using it too. The email service isn't that great (minimizing email in general), Google can be a pain to use for reasons already mentioned, and at the time there was a small swing against surveillance capitalism.

Anti-patterns in registration are annoying too. A recent example from Twitter: "sign up with phone or email" (defaults to phone); click email (colleague insists on only using phone for work); register with email only. 2 minutes later: "give us your phone number to unlock your account." Crazy.


This reminds me of a story from a couple years ago (pre-covid). I dropped my brand new phone before my case arrived in the mail and cracked the screen. We were on our way to the movie theater and so I decided to drop off my phone to get it fixed before the movie and then we would pick it up on the way home. Perfect plan!

Except I bought the tickets through an app and now I didn't have that app. Nor did I know the password, because I use a pw manager. The person at the booth said I could use the confirmation email, so I tried on my wife's phone. It wouldn't let me log in to gmail from her phone no matter what I tried.

Different browsers, desktop mode, etc. There was no getting in. We were about to miss the start of the movie so I just went ahead and bought two more tickets and got a refund later.


That doesn't help OP now, but I found it helpful to enable 2FA with Google Authenticator, and keep emergency backup codes in a safe place. It's slightly more hassle, but there are less 'soft AI' barriers between you and your successful login.

I'd also suggest not to rely on a phone number as 2nd factor, it's not that super safe.


> enable 2FA with Google Authenticator [...] also suggest not to rely on a phone number as 2nd factor

Well, I have my PayPal account set up with a strong unique password and 2FA via an authenticator app. Recently installed the PayPal app on my smartphone, and it asked for CAPTCHA, password, 2FA token, and then additionally SMS to an old phone number I still had on file. How does it make sense to ask for 3 factors? At any rate, I logged in on the computer and updated the phone number. Still wouldn't let me log in on the smartphone, needed to contact customer support.

Look, I understand that many people choose bad passwords and they get pawned and all, and I'm glad that the providers are a bit smarter and use other factors (cookies, IP, phone number...), but it really penalises security and privacy conscious users. If you use strong passwords and 2FA, but use VPNs, switch phone numbers, clear cookies, etc., you get flagged and locked out. Very annoying.


I'd suggest not to rely on google for anything you wouldn't want to lose.


2022 me agrees with you, but 2003 me getting an invite to GMail when it was a brand new service and essentially a completely different company with a different landscape didn't know better. Now I have nearly two decades of accounts and things tied to GMail =(


Google Takeout is a pretty nice service still. It's good to back up your accounts regularly.


I think the main problem with many people isn't so much the archive of email that they would lose from not using GMail anymore, it's the many years of accounts that are authenticated with it. There are literally hundreds of services I have that are registered to that e-mail address now.


Unfortunately Takeout doesn't really do anything to help with purchases.


> 2FA with Google Authenticator

I just wanted to recommend Aegis as an alternative to Google Authenticator. It allows backing up codes to an encrypted (password protected) file. Plus it's FOSS.


I use 1password as an Authenticator replacement, which saves time when logging in.


Bitwarden ($10/year Premium Bitwarden plan[1] or self-hosted Vaultwarden[2]) and KeePass[3] are also password managers that support TOTP authentication. They are open source and less expensive than 1Password.

A single password manager should only be used to store TOTP secrets alongside passwords if you're comfortable with both of them being accessed from the same devices. It's possible to store your TOTP secrets in a Bitwarden account or a KeePass file, and your passwords in another account or file, hosted/stored in different locations.

[1] https://bitwarden.com/pricing/business/

[2] https://github.com/dani-garcia/vaultwarden

[3] https://keepass.info/download.html


I hope you're not storing your passwords in there too


I’d recommend a non-Google 2FA app. Microsoft has one, and Authy is popular. Personally I’m happy with OTP Auth. Some password managers can also handle 2FA, e.g. Strongbox.


I'd recommend andOTP here as it is open source and not tied to any company that's trying to sell you anything.


Seconding andOTP[1] or Aegis,[2] if you're looking for an Android app that only handles OTP authentication. Both of these apps allow file-based import/export so that you can back up your codes and restore them elsewhere, no proprietary cloud service needed.

[1] https://github.com/andOTP/andOTP

[2] https://getaegis.app/

I'm not impressed with Authy's privacy policy, especially this part which mirrors the Google issues:[3]

> We use the information we gather from you to monitor for unusual or suspicious activity in your account, to communicate with you about your account, and as additional information that can be used to validate who you are if you need to recover your account or your account has been or may be compromised.

Authy also collects and shares more of your private information than most OTP apps:[3]

> When you use our app we collect: Your phone number, device information, and email address.

> We also share your information with our third party service providers as necessary for them to provide their services to us. We may also have to share your information with third parties if required to do so by law.

> Your information will be transferred to the U.S.

[3] https://www.twilio.com/legal/privacy/authy


FreeOTP, PIN Genie Vault are two OTP authenticator that has zero access to your phone and zero data sent back to them.

my fall-back is Microsoft Authenticator.


Any particular reason?


1. In a thread about being locked out of google services because of AI black box, it makes sense to reduce dependence anywhere possible

2. If you get a new device, you need to un-enrol and re-enrol in all 2fa providers with g authenticator - it's a nightmare. Very hard if the old device got fatally dropped in a pool! I know at least with Authy you can carry the tokens to a new device.


I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to. Stick the old phone in a safe and make sure it's still working every so often (2x/year?)

This is relatively new - a few years ago Authenticator did not support this.

Oh, and make sure before you use the emergency device, time is synced - codes won't work otherwise.


> This is relatively new - a few years ago Authenticator did not support this.

Thanks, this was around when my device went for a swim.


Aside from the other reasons cited, at least once in the past Google replaced Authenticator with a new app and I had to re-configure all of my 2FA from scratch to transfer over. Deeply untrustworthy, it's already bad enough having to reconfigure 2FA when I get a new phone without them forcing me to do it again.

I use Authy these days.

https://android.stackexchange.com/questions/20899/why-does-t...


1Password has had really nice 2FA support for years now


Would be good but on my accounts which didn't have 2FA, they seemed to have removed Authenticator as an option: only phone numbers available now.


You still can if you muck around with the dark-UX flow.


Easily the most straightforward recommendation possible. Thank you.

HN outrage at Kafkaesque account lock-outs makes me imagine bureaucrats complaining about an approval requirement they themselves created. It is frustrating and I know data loss can be devastating. If people in the tech community individually follow basic security procedures, that helps us further discover pain points in the work toward better security. Who better to have to deal with these problems than people who focus on leveraging effort?


What piss me off the most with Gmail and google things like meet, is that if you are on Android, there is no way to login in a single app: Gmail, meet or even a third party email app without associating your Google account to the whole phone.

This is really annoying. Sometimes I have to join corporate meeting from my personal email account on my personal phone, because if I would like to login with my pro one, all my personal phone will be associated and controllable by the company.


FWIW android supports Work profiles for exactly this purpose (though your company may not allow them). So for example I have my work and personal accounts on my phone, and my employer (Google in this case) can manage my work profile, up to and including erasing data on it, but can't do anything to my personal accounts.


Still, you will have to associate all your phone with this account to use a single app. Like search and all. That would not make sense if android was not tied to Google.


You can generate an app password then use gmail through IMAP using that password. (google it ;)


Nope, this is the theory but in Android you will not be allowed to use anything else because even with IMAP you will need to go through oauth some times.

Also, Google is regularly messing with the IMAP support. Like blocking their own server IPs as suspicious...


I lost a google account that I had a recovery number set on.

Google used it, verified it, then said it wasn't enough, and there went an email account I had used for years.

No way to recover.


One site I've found particularly annoying in this regard is ebay. I'll log in, enter a 2FA code (both SMS and email), do whatever I need to, and then 30 minutes later I'll get an email saying my password has been reset because of suspicious activity. ("your eBay account has been secured because your login information may have been used without your permission") This has happened several times now. At least they haven't canceled any of my orders or anything.


I think we, "people", pushed companies to do this.

There are billions of people creating various accounts. Hundreds of thousands of them had a weak password, or told their password to someone, etc, and their data leaked. There were so many news about "data leaks" and "security issues" in the past 20 years, and each time, a company was blamed, never a user.

We even made laws, where letting people log in with only a password can be illegal.


I actually don't mind this take - it's no doubt the security rules for google services are a bit over the top, but it's not like they don't have good reason to do it; or even to be anti-user.


Once again this shows that we're at the mercy of the giant AI machine. For fear of having my data locked into Google, I migrated to my own domain and e-mail hosting elsewhere. I'm still at the mercy of the hosting and domain registrar at that point, but at least they have phone numbers I can call to get support and talk to a human.

Offline backups is a must at this point.


> at least they have phone numbers I can call to get support and talk to a human.

This is important. I've decided to move all of the services I care about to a paid platform with properly paid support staff. This whole 'get it for free!' crap with the tech companies is just too much risk. I make more than enough money, I can afford a few bucks for the things that matter. Gmail is an awful choice for something so critical as your primary email account.


It would be interesting if this becomes a monthly hackernews post like the monthly hiring, where people with problems with their Google or Facebook or "insert Tech Giant here" account with intentionally no human customer support, would post their account problems and whatnot.

It would never happen of course, but it would be interesting.


I have solved this couple of months ago:

1) dont try to login couple of weeks (this was recommended on multiple boards)

2) try again with the recovery email

My problem was a) I didn't log in during the previous 12 months b) I moved to another country.

Only when I connected via vpn to the country of my previous residence, I got in. Took me more then 4 months to figure this out...


Glad to see others are also frustrated with Google's extremely excessive "security" gimmicks.

The one that I run into sometimes: in order to do "Find My Phone" for my wife's phone, I try to sign in as her. In order to 2FA authenticate, I need to press yes on her (lost) phone, or answer a phone call or text on her (lost) phone. What exactly is the point of a find phone feature that requires you to have the phone?

Apple doesn't have this issue BTW; they have some 2FA stuff but Find My iPhone is excluded so you can use it if your phone is missing.


Oh god, have you had the M.C. Escher-esque experience of trying to sign in to an email account, and it hits you with a two-factor-auth prompt that sent the code to another email address?

Imagine the insanity if the email account that received the code in turn asks for a code sent a code to the first one.


Escher or Kafka?

So far as I can tell, 2FA in a low touch environment means it is a matter of when not if you will be locked out without recourse.


Escher works in this case: 'Drawing Hands'. https://d279m997dpfwgl.cloudfront.net/wp/2018/02/0207_escher...


Having 2 logins is still 1 factor, the situation is not insanity it's the designed intent of MFA you shouldn't get access in that scenario.


This happened to me. It was impossible to access my gMail account, knowing my username/password/recovery email/all recovery codes... until I returned to my home country / home address. Then gMail let me in.


I had this exact same problem... I was logging in on the same IP address I've used for 10 years

I only managed to solve it by digging out an old phone that was still signed into the Google account... if I had factory reset that then I suspect I would have lost it forever

this experience is one of the many reasons I've dumped Google wherever possible


Anecdotally, getting arbitrarily blocked and locked out of your stuff is the single biggest practical security today problem today for me (maybe it isn't for non-technical users who reuse weak passwords, install catpicture.jpeg.exes and random software from the internet, log in using public computers or other people's PCs..).

I don't believe I've ever had passwords compromised. The only time I know I had malware was when I was a kid and installed a runescape autominer.. I've had some close calls with software vulnerabilities (I patched opensmtpd mere hours before bots started attacking it), but that's rare. haveibeenpwned only shows involvement in the last.fm compromise, which is a no biggie since I wasn't 1) using the service any more 2) using the same password with other services 3) using that email address with anything worth caring about.

By contrast, I've been burned by service providers blocking me many many times. They call this security but how is the equivalent of "we decided to take all your mail and not deliver it to you, and changed the locks to your apartment so nobody can get in" security? It's security in the same sense as "we decided to burn all your money so nobody can steal it, hope you're happy."

As a consequence, I've tried to cut out as many services and third parties out of my life as I can. It's an uphill fight though, and most services are hell bent on adding points of failure. E.g. where my bank before supported OTPs (in addition to login & password), now they require a phone too. It's probably not a matter of if but when I get bitten by this; I've had a Samsung Xcover physically break.

I think any notion of security should include secure access for the relevant party. If you can't access your stuff, security has failed (unless it can be demonstrated that there was an active attack going on and the only way to prevent it was to block everyone.. which these overzealous blocking systems in place can't demonstrate).


My 'favorite' is SMS and other proprietary app-based 2-factor auth.

My phone broke while I was traveling through Laos. I was going to be returning in a couple days, I could speak the language well enough, so I didn't have any immediate need to get a new phone (and the pickings were way too slim in a country such as Laos). What I thought would be a good idea was to purchase a new device online to be shipped to my apartment on my return. I tried to log into my online shopping account but most payments are always locked behind 2FA with SMS being the only option. Bank transfers worked too, but that as well was locked behind SMS. So in order to buy a new phone, I needed a new phone to buy a new phone. Almost nothing in the country support TOTP or WebAuthn, etc.. and the times they do they just call it "Google Authenticator" encouraging users give those keys to Google as well instead of supporting FOSS TOTP.

At the same time I got my income via TransferWise, and their 2FA is some proprietary BS in their app instead of generic TOTP that I can back up on my laptop. So I couldn't get extra money to my foreign account to pay for it.

A few months later I needed to use PayPal and was locked out of my account on similar grounds. My foreign account I didn't have my old phone number because it's pretty customary to rotate numbers on prepaid plans here, and my US account was using Google Voice (because it's tedious to maintain a US SIM card for the 2 times a year I need it) and they removed SMS support for Voice while not giving an alternative for authentication. The best part is that to get support from PayPal about authentication you needed to first authenticate to message support. Needless to say, I straight-up refuse to use PayPal now and direct message vendors about supporting an alternative (either widely or for this exception).


Password reset functions for most providers often make 2FA hardware/software tokens useless. They fall back to email/sms to reset forgotten password/tokens. I guess it’s usability for majority over security that would lock out users.


If TOTP or Webauth is offered at all, usually it's some garbage like SMS. Twitch, eBay and Amazon all three are really disgustingly pushy with it with some bullshit excuses.


Some similar thing happen to me. Gmail login page says that I need to acknowledge that me is me and it forces me to change password... I occasionally get this message on screen when I change countries with VPN. I need to use VPN different countries because this is required by my work (development of streaming services). I get so much annoyed. Recently I spent Christmas in Norway (not the country of my origin) and that happened again. I had to access Gmail to check in the flight so I was forced to change the password. This is ridiculous!


This is a long shot, but if you have a spare Android phone lying around consider doing a factory reset on it and signing in with that account during the initial setup.

My situation was somewhat different. I had a rarely-used account with no recovery email/phone. When I entered the password correctly using a web browser, I was asked to provide a (new) phone number so I could be sent a verification code before continuing. I didn't want to provide a phone number, so I tried to log in with that account during the initial setup of a freshly-reset Android phone and it worked (allowing me to add a recovery email).

I'm curious if this strategy helps in your case. (You mentioned getting a new phone, but I assume you are signing in on that phone after it has been set up, which may be different to signing in during the initial setup.)

By the way, in your reply to a comment on 2-factor authentication (https://news.ycombinator.com/item?id=30051366) you said you had a recovery account. There is a difference between enabling Google's "2-Step Verification" and having a plain recovery email/phone (though from other comments it sounds like you can get locked out even with 2FA, and not all 2FA methods are equal).

P.S. If you want to allow people to contact you privately, consider adding some contact details to your HN profile.


And a suggestion from https://support.google.com/mail/thread/123734419/i-am-locked... (written by a community member who is labelled as a "Product Expert"):

> Try letting the account sit for a full week with NO sign in or account recovery attempts. Just leave it idle for a week. This may help any suspicious activity flags to clear allowing you to attempt account recovery with more success.


I had a different problem. On my wife's account she started receiving someone else's emails. Initially we suspected that her email was wrongly(typo) used in registration at various sites. But increasingly we noticed that the conversations in the mails were ongoing, implying continued usage of her address. We suspected her email was hacked and changed password, that didnt help. Eventually she had to abandon that email. The problem with free mail service is that the support you get is what you pay for.


This is your daily reminder to Gmail users to set up automatic email forwarding to a secondary (free) address.

I recommend ProtonMail, you can set emails to autodelete after X time so you never fill your quota.


The only rules of thumb I can come up with are these:

1) Log in on everything now and then (hm, maybe gotta so that myself soon); and perhaps even more important,

2) When getting a new device / phone number / email address, log in to everything from the new one before getting rid of the old one. That way, you can jump back to the old and confirm the validity of the new. Then set up the new phone number for 2FA / email as your backup address / recognised login device... Only then can you dispose of the old.


Immediate solution to try: Use a mail client to access your mailbox with IMAP or POP3; GMail may be more tolerant that way.

Long-term solution: Stop using Google. Why? Not just because of this type of shenanigans, but because Google spies on you:

* It keeps a copy of all of your correspondence, even if you delete it.

* (Rephrased) The US National Security Agency (NSA) has gotten access to much of your correspondence, by tapping links between Google's data center; it may still have such access today and Google's extent of collaboration with this is not known for certain (to me anyway).

* It uses your correspondence and other information about you allow commercial companies to manipulate you with advertisement.

(The NSA part was verified by Edward Snowden's revelations, several years back; see: https://www.washingtonpost.com/world/national-security/nsa-i... for example)

Now, no third-party mail service is perfectly safe; but you should want one which is at least somewhat-safe, and that doesn't treat you unfairly.

I won't make specific recommendations, but I've personally had decent experience with ProtonMail (Switzerland) and gmx.com (Germany).


> It send the US National Security Agency (NSA) a copy of all of your correspondence

Google did no such thing. What Snowden revealed was that the NSA knew at that time the SSL connections from a user to Google were terminated at the GFE, and all the traffic between Google data centers were in cleartext. That includes, for example, a request from an application to store some user data in a database or storage system, or the replication between data centers of user data for redundancy purposes. NSA then wiretapped these communication links.

See this leaked NSA slide: https://commons.wikimedia.org/wiki/File:NSA_Muscular_Google_...


I stand corrected and have edited my answer.


Recently signed up to mailbox.org after losing one of my longtime Gmail accounts due to this Google nonsense.

I had correct password AND correct secret answer to my own secret question I set years ago, but was denied entry because of new device, or time sine last login or whatever.

The explanation it gave made no sense, sending me in circles with no recourse. So I decided enough is enough. Their system is broken. When a user has both password and secret answer, there is no reason to deny them at that point. Good riddance Gmail.


I have a theory:

It is impossible to have anonymous reliable email accounts nowadays.

Today a lot of data are collected. For those data to have any value they need to be quality data, so that they can be used. Many would think for AI, but what is more lucrative maybe is to sell them or services based on them to government intelligence in USA. Similarly, maybe government is also putting pressure that accounts of big providers are not mass used or hacked by adversaries. Google may have some hidden deals.

Starting with Facebook, Google, Microsoft as the biggest ones, you are forced by all means to have non-anonymous accounts. Google accounts measures point to one direction: tell them your identity. Make sure you are in that location, no VPN, tell them you phone number when you register an account, etc, so they know it is you for sure.

This makes it impossible to use Google, etc, anonymously. It is impossible to open any Google account, as I do not want to drop my VPN, or give them a phone number. I also have 2-3 accounts of Google open many years before, when these restriction were not so bad in place. I was relying on them for various things. I assume since a while, that I will loose access to those any moment and I am not using those much anymore.


I regularly get security notifications for an account I’ve since lost the password to, the notifications go to my primary email, and this means a malicious actor has my password. I can’t login via account recovery, using my backup email, for the same reasons as described so I’m at a stalemate with some random malicious hacker and have no way of solving the issue, and no idea what’s actually in the account. Fuck you google.


I guess the takeaway here is that it might be better to de-google-ize yourself on your own initiative than to deal with having it done to you unexpectedly.


I once forgot my gmail password. There was no way for me to recover it. Eventually I found it after 6 months, but it was a very difficult 6 months. bank emails, work emails, etc were in the google 7th circle of hell, and there was nothing I could do. I don't have any good advice for you really except is there a way you could vpn to a location closer to where you typically access gmail?


I have one of the old gsuite free accounts with a personal domain, so my backup plan for that for the last ~15 years has always been "if google graveyard gmail, at least I can but mail service elsewhere and update my MX records".

Now they're going to start charging me for that, I'm considering which non-google mail option I will choose instead, I've been sticking with gmail against all my privacy and ethical objections, because it works so well and is free. It's no longer going to be free soon, and I'm pretty sure their competitors work as well as they do (or very close to), so I can _finally_ get over the inertia that's made me feel _almost_ bad enough to leave gmail but not quite bad enough to pay money or do the work required. Right now, it looks like Fastmail or Protonmail are going to get my money.


Why the heck is running a your own email server so complex?! I run my own email servers, as does my company, and they can be an absolute pain at times. Once you've got everything settled, they're okay, but still, they're unnecessarily fiddly things to get working.

It should be easier, much much easier. Then we can all stop relying on external providers for substandard email services.


It's pretty simple if you use Docker and the mailserver images.


I've had this happen before with my OG GMail account -- the one when we needed an invite to sign up. Back in the day there were no "account security" beyond the username and password, not even 2FA, backup codes, security questions, etc.

At least Google doesn't recycle usernames unlike other services and account retention is trivially automatic if you use an Android phone.


I was setting up my blog and using AppScript to automatically write add my new posts to Firebase. It is still a WIP, I granted the script the permissions I needed and somehow after that Google labelled my account on my main computer as suspicious (which I have been using for years). So whenever I switched from my personal computer to my office one, it used inform me someone suspicious tried to use my account and asked me to reset my password. This happened multiple times (and it isn't possible since I have set up 2FA and have a very complicated password). When I switched back to my personal computer, it once again used to ask me to reset my password. This became infuriating and after a while I just gave up and switched to Firefox completely (where I have not had the issue again).

*The script I wrote is a variation on the one I wrote while working at my company (where we use AppScript to sync some sync data to Firebase... the same issue never occurred for me while using my company's account)


Protip: log in to youtube with this account. (Or is it “log into”, “login to”, not sure)

Less reliable way: log out of all google, login to all of your “best” accounts, then login to this one. When you are logged in and google knows they were logged in at the same time before, restrictions get relaxed (there is sort of a “skip security” button, or a similar setup).


You get what you pay for. Microsoft hotmail is pretty much the same.

Reailize that what you call "security" isn't there to protect you. It protects Google's interests. Google wants to minimize the risk of hackers compromising any google service; and if doing so might destroy your livelihood, well, that's a risk Google is willing to take.


I am going to try and avoid google from here on out. Far too much instability around the google services I use the most. It's unfortunate that I've used the gmail id for just about everything including taxes. I feel google is entering a phase where it will look at all of its services for cutting down on "freebies."


I have an account that I frequently sign into in an incognito session. Every time I do, Google emails the same account saying that it doesn't recognize the device. I've tried requesting that it remembers the device, but despite the browser and IP address staying the same, it doesn't seem to matter. Though it also appears that I can ignore these warnings entirely.

The biggest issue that I have is that I have an email account through my web hosting provider that isn't connected to Google. If I email anyone with a Gmail address, it gets rejected for being potential spam, despite not having any links or anything. Even if I respond to someone writing from a Gmail address, Google will reject it, saying that it was unsolicited since I was the one initiating the conversation, which is simply ridiculous. I usually end up logging into a separate Gmail account just to communicate with those users.


Perhaps you'd have more luck using a Firefox Container instead.


Yes, FF Containers are ideal for this, or make a new Firefox profile altogether. Incognito windows don't preserve your cookies (that's the whole point of them) so the site has no way of "remembering" that device.


I'll have to give that a shot. Thank you both!


I lost access to my primary Google account in this way, 10 years of mail and drive inaccessible, all sign Ins void, and I find Google hasn't supported account recovery for almost five years.

I'd set inactive account recovery, so if I died my brother would get access six months later. That didn't happen either. Google is a joke.


I had an ancient Google account that I hadn't logged into in forever that put me into a similar recovery loop. I had the correct password for the account and it said I was logging in from a new device and asked for my recovery email. It sent a code to my recovery email account and I entered the code into the page.

So Google knew the following:

  1) I have the correct password to the Google account
  2) The recovery email address is valid and the code I entered matched
Despite that, after entering the code I received an error message stating essentially "Thank you for providing the correct code however we are still unable to verify your account". I then reached out to a contact within Google and they escalated the issue and the account access was restored for about a week or so before it went back into the same recovery loop. I gave up after that.


I'm having a hard time getting my head wrapped around the idea of relying on Gmail (or any other online identity provider) without enabling 2-factor authentication. The best way to avoid this kind of "AI hell" is just to take control of your own account security and set up some additional factors.


Google will still lock you out with 2fa. It’s pretty bad


Even with a FIDO2/U2F/WebAuthn key?

If so, yeah that's pretty bad..


Yeah I got locked out dispite having printed codes and authy setup. Lasted a day or so


That's a scary thought, being locked out of a primary email address despite taking security seriously.

I currently have it secured with my backup codes (printed and stored in a secure location), as well as two Yubikey (one primary, one backup).

I'd be seriously angry if Google locked me out of my account.


Recently i wanted to setup a shared gmail account with some people.

Even with 2FA setup, correct password correct TOTP, it did not let them in because it was suspicious. I also checked "it was me" in all their security alerts. It would only let the person in with sms based 2fa, which was a pain.


One of the main reasons why I don't want to activate 2FA in my Google account is precisely because while I don't have highly sensitive data in that account, I do have lots of convenient things that I need in a day-to-day basis, so I wouldn't want to be locked out of my account. And 2FA provides more ways in which this can happen (for example, the smartphone with the authenticator program breaks). So now the option is either having the risk of being locked out because of 2FA, or having the risk of being locked out because of the AI being "angry" at us for not activating 2FA?


> for example, the smartphone with the authenticator program breaks

There are 3rd party authenticator apps (not Google Authenticator, though) that will allow you to seamlessly back up and restore the 2nd authentication factor, even to a different device. Ideally, it then becomes no less convenient than a password.


Unless you have an older account, rarely used except to forward email to another address, and google unilaterally decides to lock you out without telling you they're changing their policy. Apparently the big google brain decided somebody other than myself guessed my 40 random char password. I've long decided I will never be able to login to my gmail account.

I forget now why I was originally trying to login. I may have been trying to setup 2fa even. Not gonna happen now.


Except Google does not honor the recovery account. Even with access to the recovery code, Gmail just ignores it.


For some people, anonymity of use has a higher priority.

I've largely given up on personal use of email, full stop.

Have had an account since the 1980s.


If there is one Google service I'd happily pay 10 bucks a month for (given that they would then provide proper support), it'd be gmail.... It'd be a nightmare for any gmail user when suddenly their account is blocked for no particular reason. This post is reminding me to look for alternatives.


I had a similar issue with outlook when I went to visit my parents in Cyprus (normally I live in the UK)

My main account gave me a similar message to yours; the only option was to approve this location via a link sent to my "nominated backup email".

Which, also refused to let me in for exactly the same reason. *facepalm*


I have a very similar issue where I enter my (correct) password, Google recognizes it but says they need some additional verification where they require one of my previous passwords to be entered. I don't know my previous password, so I am locked out of my account.

What's funny is I have another account to which the Gmail of the said locked account is connected, so I can send and receive emails by the locked account, but I cannot use it for any other purpose. It has been the trigger due to which I had switched my primary email to my own personal domain and a better service provider for a few bucks a month. It's painful and I'm still in progress of transferring all communications to the new domain, however it's totally worth it because I have a sense of actual control.


Mirrors my experience.

I moved away from Gmail for most of my mail a while ago for privacy reasons, and in anticipation that something like this would happen eventually.

Not much later, I was locked out of a Gmail account I had for an extensively long time (created back when Gmail was still in beta and by invitation only).

I know the password, I know the recovery e-mail address, and have access to the recovery account, yet I'm not allowed to access the Gmail account or recover the password regardless. Go figure.

The account was used mainly for all kinds of registrations where I expected I might end up getting spammed but I definitely wasn't doing anything suspicious with it. I didn't bother too much trying to restore it but any attempts would have likely failed regardless.


I had a similar case, in one of my (lesser) gmail accounts. I took that as final warning and since then started to move away from google mail.

Currently, I use a posteo mail, which costs me 1€ (I believe) per month, for the important stuff. Mails which come as part of my webhosting package for most of the other stuff. And a free adress (web.de) as experiment, but it didn't turn out too bad so I keep it for unimportant stuff They just send ads as mail once a week. Calling this "mildly annoying" is exaggerated already.

Yea, so the takeaway (imo) is, leave the sinking ship before it sinks you. The process may take weeks or months if you proceed it relaxed (that's how I did it), so start before one of your important addresses gets hit.


Just yesterday, I got two 'Google' verification codes to my mobile number out of the blue. No number, so I've only got 'Google' as the sender to go on.

  * My password is very long and complicated and stored in a password manager
  * I don't use any device I don't own and can see the moment the SMS messages came
  * I have no other indication that I've been compromised
I'm thinking it's more likely that someone else added my phone number as a second factor to their account.

Google: Just one damn easy thing would give me more information about the situation and allow me to act appropriately: Have the email address associated with the verification code in the message.


I had this happen as well about 8 years ago. My Gmail account one day just said it couldn't log me in, even though my password was correct, and I was logging in from the same home address and browser as always. It said I needed to complete the security question to access my account. I didn't know the answer because I just set random letters and numbers for the security answer when configuring the account recovery, because I was confident in my password and backup system. Since I couldn't answer that question, and because Google has no support, I could never access that account again while knowing the password.

Fortunately this was a secondary email address, and my primary email was on my own domain.


As a security professional, this is something we deal with daily. Security is too lax? Why didn't you protect my data. Security is too strong? I can't easily access my data!

Can someone show me the Goldilocks zone for internet security? It's a moving target.


Have you considered that these are different groups of people talking?

I'd like to take responsibility for my part by not reusing passwords, not using weak passwords, not using my passwords on computers that I can't trust (other people's PCs, public computers, etc.), etcetra. There's not a whole lot on my end other than physical security and the possibility of malware (not very likely on my systems which generally rely on a small set of linux & bsd packages from distros' official repos). For critical stuff I do some kind of 2fa or OTP too.

Which is to say, it is almost possible for an attacker to gain my credentials.

Now if you do your part, your company won't leak my password either. You won't allow bots to bruteforce trillions of hashes per second. You don't allow your infra or certificates to be compromised. Don't mail me my password. Don't let some rando in if they call or send an email claiming to be me (unless you're a bank and that someone shows up with a valid government issued id plus passes a basic background check). And so on.

If we each do our part, the system is secure. There is no need for you to block access to my account when valid credentials are presented.

The only time I've had a breach that was on me when I was a kid and ran a fucking runescape autominer. Every other time, it's been on the company; either they get breached, or their "security" fails and blocks me. I don't consider that "too strong" security. I consider that weak security, because the job of security is to ensure secure access, and with no access, security has failed its job. And if you permanently lock someone out, as Google has done many times, it's equivalent to putting the user's data through the shredder. That's incredibly bad security; a complete failure to protect the data.


Goldilocks for me is not allowing brute force password attacks and trusting me to create a non-worthless password.


Not exactly what the OP is talking about, but I do consulting and have ~5 gmail accounts.

My FAVORITE feature ever is: "huh. You just woke up on a Tuesday and need to get to work? Well, we've logged you out of all your accounts and need you to log in again."

The worst.


"We have detected unusual activity on your account --Nothing has changed in the last 7 days. Please sign in again."


I just had this experience yesterday! I entered the correct password, the right recovery email, even asked for a code to be sent to the recovery email address and entered it but Google still didn’t allow me log in.

I had the same experience last year with the gmail account I created for my app. I travelled and Google didn’t allow me login from my laptop (cos I was in a different country). Entered the code from my recovery account and still no show.

In both instances it asked for a phone number to send me a code. If it refused to accept the code from my recovery email, why would the one from a text message be different. Besides, I didn’t want to provide my phone number to gmail


They're trying to deter you from using Gmail anonymously/as a burner email.


I think that's it. They might consider three use cases: 1. normal usage multiple times a day, 2. grandma using it once a month, but always from the same device at the same location, 3. people using as an anonymous/burner account (likely from a clean/incognito browser session, maybe using a VPN, without phone number on file, etc.)

With the current implementation, 1 and 2 still mostly works, and they don't care that they make it impossible/inconvenient for 3.


Google security allows you to use a titan key, but then still ignores it if you use an android phone, not the best security, since phones can get sim jacked. (common way to get your ecoins hacked, take over your phone.)

Defeats the purpose of a titan key and 2fa enabled.

There is no option to turn off android auth confirmation popups, so you have to de-activate all signed in google phones, and remove google account on your cell for more security and stop trolls from spamming you, if your phone number is public. People been asking google for years to fix this major fubar.

Google auth is designed by idiots, to be as easy as possible, but bad actors can abuse.


I dont recall the password of my old gmail account and I listed my current gmail account as the recovery email, and they still cannot recover the account for me. It makes absolutely zero sense. It just seems like entirely lazy.


Had similar issue before. My and my friends are traveling to a different city and one of my friend's mobile went missing during our trip. The contact we were about to stay in the city is in that mobile (saved in his Google Contact thankfully). When he tried to login his account in my mobile to access it, Google wouldn't let him. He had to use the secondary email he registered with email(which is from Yahoo) to send a verification code and use that to login to the Google account. He also forgot the password for the secondary mail id and finding that was another story.


I understand how you end up here - after a decade or more of micro-optimizations down a pit of the newest/most advanced scam and take over techniques... but at some point you need to sit back, zoom out and look at collectively what you've created and see if you are catching a bit too much in the net.

I feel like Risk underwriting at Finance/FinTech companies goes through something similar... the list of rules only ever gets longer/gets added to.. I don't know that anyoen rewinds the clock every 5 years and starts from a clean slate to build out a new model.


So in theory if someone was to ever accidentally or intentionally reset the location info for where all gmail accounts have logged in from, then effectively everyone would be unable to access their gmail account?


Worse, one day it just doesn't work.


If that were to happen it would take about 5 minutes until this security feature would be deactivated.


If it happens to everyone then yes. But now imagine it happens to just you.


Same sort of problem. I have an account like that which was giving these messages and after trying a lot of things over few weeks I gave up.

Some long time later (year+) I retried and got in. I attempted to change the security settings, but it wouldn’t let me.

Some long time later again, I’m now locked out again.

This whole thing is ridiculous. I know the password, and have access to the account to which it forwards all emails. It should be obvious that their is no IP address which regularly uses this account, and that they are clearly locking out the account owner for no good reason.


When my kids were born I created gmail accounts for them to save the name for when they become old enough to use it. This worked well when I did it from home, but for my last born I created his account *on the hospital wifi*, saved pass in 1pass. A couple years later I tried to login to his account from home and got thrown into this recovery hell. I visited that same hospital wing a year later to try "a prior location", but it didn't work.

As a result I unintentionally caused the very problem I was trying to prevent.


Happened to my grandma, who have had the same address for over 10 years. Was quite the ordeal to have her change over to a new adress once we decided it was meaningless to hope to regain access.


This happened to me. I had half given up on my account since I didn't have a phone attached. Knowing my password and recovery email doesn't help. I emailed to some support email for google partnered people. I am not sure who I emailed but they responded that I was emailing the wrong person but they checked the status and it looked all good. I tried longing and it worked without any issue.

Edit: I was super happy to see a human response at that point and was very hopeful when I tried to sign in again.


I actually found the solution to this last time I had it. I get it all the time on legacy G Suite accounts that are still hanging around that I never log in to.

I think it's this link: https://accounts.google.com/signin/recovery (don't go through the usual forgot email/password process on the login page or you get that stupid AI loop).

I think it helps to use Google Chrome too.


For over a decade I refused to give Google a phone number.

Eventually they locked me out and demanded that I verify my account via SMS using a landline telephone number I hadn't had access to in over 8 years.

Obviously since this was a landline, I could not possibly have given them this phone number for verification purposes and forgotten that I had done so. Evidently they scraped the phone number out of my email; I'd had PacBell e-bills emailed to that gmail address.

Google is unreliable.


I've had this problem too.

In terms of security, it's great, but it's terrible when you're going back to old, dormant accounts and have lost trusted devices.

Thankfully, it's not a problem if you've set recovery emails and 2FA options, but it is easy to forget if the accounts are set up for someone else who isn't checking often (like family members who only use their accounts rarely)

It really takes months for the lockout to clear up, and it sucks when it happens.


I have a 80+ old father. The security controls Google has put in place, I much appreciate them because he keeps a fairly simple password (but not one that is susceptible to dictionary attacks) and he cannot remember multiple passwords. I have tried using a password manager for him but he finds them too complicated. While I understand the pain this causes, any changes should accommodate the security and convenience of the older demographic.


Google is not the only one. Amazon froze my account for suspicious activity. I had a fire and had to suddenly move leaving a delivery at locker also changing my address and password all on one day. I forgot to change the phone number, cause that phone died in the fire. I waited out my suspension, now I can't get into the account with my new phone. Top it all off I'm deaf and can't talk to customer service.


If you've moved to a different country / region, use a VPN to access the account from the old location, then after that point the device will be okay


I realize I am a million years late to the party, but this is a good time to remind everyone to turn this “feature” off.

It’s buried deep in settings but it can be disabled.

The first time this happened to me I had to talk to an old employer to let me use my old laptop and sure enough it worked. I was very lucky.

I hate google at this point - or rather how big these trillion dollar tech companies are getting.

Would love a viable email alternative, but fast mail isn’t it.


I had the same issue. I just gave up and came a while later with the same IP and eventually got through. It’s ridiculous that they both allow you to not setup 2FA and don’t let you in without whatever they deem required.

I eventually started using 1Password for all my backup google accounts to setup TOTP making it just as convenient as without 2FA. It was still a pain to have to wait and go through the process though.


This is another reason why I recommend to use your own domain (from a 3rd party registrar).

If you can't, at least set a mail-forward to a different mailprovider (I have an old hotmail account) so if you get locked out, at least you can receive mails.

Use Google Takeout at least twice a year.

Another option would probably be to use Office365, I don think it's that expensive and I guess you would have the possibility of getting real support?


In the safety perspective, dormant accounts might be prone for exposed passwords (reused passwords, exposed via other services etc.) and easily an attacker can hijack your account. I had similar experience where a dormant apple account was hijacked and unable to recover. Apple also follows similar philosophies to sign in from a real device for recovery. Have you tried recovery options?


The most insane thing is is not being able to sign in with the kind of 2FA you want until after you've signed in with a phone number.

This also affects paid Google Workspace accounts, which has a setting on GW to disable phone-based auth...

So you're stuck. you can't have people sign into 2FA until they do it via phone... and they can't do it via phone by security policy...

Just nuts.


For critically important accounts, host it somewhere where you have the chance of talking to a human if things go boom.

Google is not one of these.


I wonder if paying up money for this Google Workspace Individual[0] will make me more immune to possible lockouts like this... Or is it just more sensible to jump to another paid email provider like Fastmail?

[0]: https://workspace.google.com/individual/


I've seen this a lot with incognito mode too. I think Google just deals a large penalty for "clean" devices.


I always use the 2FA and whatever happens it seems to allow me back in. I would think this happens with a phone number too.


Have a similar problem here,

I logged into my google account on a mobile emulator VM while testing some apps and have since deleted the VM. However, when i sign into my gmail acc it has 'tap yes on your android x device to confirm it's you' (which i deleted). I have recreated the exact emulator VM and the same thing happens..


Most big tech companies now use "conditional access" for their login with the hypothesis that this increases security. Even if it does, it leads to a drastic reduction in user-friendliness as OP has seen. It is like saying: The best way to prevent unauthorized access to our servers? Let's just turn it off!


Years ago, but just after Google purchased YouTube, I forgot my YouTube password so they emailed it to me in plaintext.

Maybe 10 years ago I experienced forgotten Gmail password hell when a family member forgot their password and was never able to recover the account.

Can't wait to see what the process is like another 10 years from now.


I had this in ~2014 at an event. It literally would not let me log in no matter what.

This did reinforce that running my own email server was a good idea. Like, what are you going to do if it actually is important? Call google support? I'd be surprised if they have a helpdesk with humans nowadays, let alone to fix some free account at 1am in the morning. Or even if you get to talk to a human, what are they going to do? Disable a security measure because a kind voice asks them to?

Google thought my IP address was in Russia (I was in Germany) and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned. Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.) I think I later checked and saw that there were no other active login sessions, so it knew that I could not possibly have done as it suggested. (Or maybe that was another instance of this problem, not sure anymore after 5+ years. I never forgot the lesson though...) The reason for logging in wasn't time-sensitive so I let it go for the four days of the event.

A related problem is that I have to clean up my inbox after logging into various services. Twitter was one of the first and I apparently got annoyed enough that I stopped using it subconsciously (I only later noticed that I had stopped checking Twitter and figured that the annoyance factor must be the reason). Like yeah you don't recognize my device, I don't want your "tweet" buttons across the web to track me so of course this appears as a new login device. What would be more suspicious is a login from a known device to this account, if the machine learning functions correctly...


>Google thought the IP address was in Russia and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned.

I'm not sure why you immediately jumped to the conclusion that google is blocking entire countries. It seems fairly reasonable to block signins from russia if the account was created and has a history of signing in from another far-away country (eg. US).

>Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.)

Google is probably doing more checks than looking at the country code from a geoip lookup. VPN/VPS IPs are easily distinguished from typical IPs (eg. residential internet and/or mobile internet).


I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's.

It didn't have a problem logging in with the same laptop from another place in Germany earlier that day. There are surely more factors, but the deciding one here seemed to be the geoip.

Perhaps anyone here can prove me wrong and confirm it's merely the distance that does it? Did anyone travel between two top ~50 HDI countries (not anything Google employees would consider putting on a blacklist, e.g. rich EU countries, Australia, USA, etc.) and had their login blocked with no way to access it?


> I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's.

1. even though people travel, I suspect it's far more likely that a random russian IP accessing an american account is because the account got hacked. at the very least there's a good enough chance of an account compromise to request additional verification. Obviously locking the account entirely (effectively banning it) is unwarranted, but I don't think "well people travel" is a valid excuse to ignore a red flag.

2. google probably considers far more factors than just geoip. it probably also checks whether you're logging in from a new device or not (via cookies and/or fingerprinting), and whether your other devices have moved to the new country (eg. android phone or chrome browser on your laptop). I wouldn't be surprised if it scanned your email to see if you have an itinerary booked or your search history to see if you looked up russian vacation related queries.


"whether you're logging in from a new device or not (via cookies and/or fingerprinting)" Every login is a new 'device' because I don't have Google tracking me across the web. Fingerprinting, sure it can see I'm a firefox on linux with the usual browser features and fonts. All is as it usually is, nothing suspicious in this category.

"whether your other devices have moved to the new country" I don't have any device pinging the mothership about my every movement so that can't be taken into account.

"I wouldn't be surprised if it scanned your email" lol and I definitely don't have email from google, so that's also not a factor. I also highly doubt they're actually this clever, especially over six years ago. Huge amount of work to parse the email formats of the thousands of popular travel companies from around the world in fifty different languages.


I've lost several paying business accounts to this problem because I never log in except when a credit card expires and then I need to update it with a new one. By that point I've moved or changed computers or ISPs or something and there's no way to 'identify' me anymore.


Lately I've noticed that Google wants me to "open the youtube app on your phone" even though I've configured 2FA. This is a work account, I have no interest in associating it to the youtube app on my phone.

My own email is with fastmail. They do what they do particularly well and are worth it.


Google has some kind of backup code that you can get.

It says so here https://support.google.com/accounts/answer/1187538?hl=en&co=...

Does it actually work?


I signed into an old Gmail account of mine that had a bitcoin private key backup. After signing in successfully, I searched for "bitcoin private key" in Gmail.

Within a second and before the search completed, I was immediately kicked out of all active sessions, and my account was locked.


Yeah, unfortunately that's exactly the kind of thing that a hacker would do upon getting access to an account. sigh.


Another fun one (not Gmail but Google property): ReCAPTCHA will validate and re-CAPTCHA you infinitely if you’re using Private Relay. They could just, like, store a cookie… they already have (assume) permission to do it. But just green checkmark > same question forever.


Had this same issue: thankfully managed eventually to regain access (by temporarily re-invigorating an old half-working phone) but have since moved all essentials off Google.

Absolutely outrageously dangerous system, no way I can trust that service with anything remotely essential again.


I find account security horribly bloated thanks to tools like Podesta and such lame password creators. If ppl would simply make good passwords this would not be an issue. Google, Amazon, Valve/Steam, blah blah blah… we almost don’t need passwords anymore.


Last time I had to deal with Google's account recovery (10 years ago when my mom fell for a phishing scam) there was an option to pay a few dollars to get to talk to a real human in a customer service / operations department. Does that still exist?


I have this exact issue since I changed my phone number and forgot to update it in all my Google accounts. Now I can't access an account that has some adsense funds. Lesson learned: don't trust a company that doesn't have customer support.


Woo.. This happens to credit cards a lot, but in these cases, you can at least call the bank.


Last time I use Google services I can't delete my credit card too. So I cancelled that. Now all my accounts are somethingfunny.anumber@ just for comment music in YT.YT i good, I wonder how they will trash it.


Yes, posted here about it too.[1] There is no solution. You are locked out forever once Google does this to you.

[1] https://news.ycombinator.com/item?id=21168834


Yes, this happened to me with a throwaway gmail address I once had. Correct name and (strong) password, BS about a different device. I never regained access. Luckily nothing of real value was lost.

My primary email account is on Fastmail these days, and I like them.


have old gmail account

no longer have associated phone number

Do have backup email (primary email).

Do have password.

Google doesn't care. Won't let me log in, won't send an email to the primary account for recovery, etc.

I've written it off. Essentially if I'm not paying someone for it, they don't care.


Facebook is the same way. If you don't have their cookies, but know your account name and have the recovery email, you still cannot log in after resetting your password unless you are stupid enough to send them a copy of your photo ID.


The solution to these kinds of problems is obvious: Stop using any Google service. No more Gmail, Google Cloud, Google Docs, Google Drive, ... there are many alternatives.

I've pretty much completely degoogled my live and don't miss anything.


It keeps locking out my printer for using LDAP. It's extremely annoying to go and re-check the "yes, allow 'insecure' access" every N months. I complain a lot in the box, but obviously nobody is reading them.


They have calculated that overall, a non-negligible amount of users will be hacked unless they have their system the way it is. Sure some accounts will get locked out, but overall it's a net benefit. There are hidden variables.


Based on what I see while consulting, I feel like more strange company behavior is attributed to cleverness than the real amount of stupidity/randomness that goes on. Here, too, there are so many variables and unknowns, this is not a calculable number. And even if they could, I am not sure they necessarily would. Bigcorps are not infallible and do not get everything correct with meticulous calculations on boatloads of data, much as they might try to give that impression.


The variables are hidden because the system would be insecure if they were known.


Your only option is a helpful googler who can fill out the internal "help recover an account" form. You this sucks. But having accounts stolen sucks too. I think Google is between a rock and a hard place here. But anyways, sucks.

-Xoogler


Interesting question for you hn people. My email domain is my website domain and I just use Google’s email servers. If Google ever nuked my account is it trivial for services to resolve that my email pointed to a new provider?


Every week my google workspace accounts kick me out on my laptop, and I have to log back in with a password. This never happens on my Android phone with those accounts. And also not on the laptop with my regular gmail account.


I feel your pain. You’ll probably have better luck logging in if you add a hardware token or 2fa. most android phones have a built in hardware token, or you can buy a yubikey or the tokens from google (often on sale for $5)


My 87 year old grandma's computer wouldn't boot. We set her up on a new laptop. But we couldn't remember her Gmail password. We never recovered her account, including any photos backed up to Google Photos.


You should be able to image her hard disk, and probably boot it up in a VM. Windows activation might complain in that case, but her data will be there.


> You should be able to image her hard disk, and probably boot it up in a VM.

Is that still an option? I haven't used Windows for a long time, but I believe Microsoft has been pushing towards enabling BitLocker by default for everyone. If you don't have the BitLocker recovery key, or access to the user's Microsoft cloud account (which AFAIK has a copy of the BitLocker recovery key), the only way to decrypt the hard disk is to boot the system the normal way (with SecureBoot enabled even), since the key is held on the TPM.


If you have BitLocker enabled, you'll know about it. It's not the kind of thing that happens by accident.


Yup there's a few things to try yet when I can get the hard drive from my family member. But I'm not optimistic about the Google account either way!


It's especially annoying that you can't turn this nonsense off. I had this happen to me when I was abroad, obviously with no way to recover when I was abroad and I needed access to certain mails. Nice feature.


Arguable email addresses now are more important, that phone numbers. Mobile carriers are legally required to allow you to port numbers. We need a legal framework that allows to have inalienable email addresses.


Or government issued email addresses tied to your identity, either as a citizen or as a registered company.

Due to the decentralized nature of email, you can't have inalienable email addresses except within a domain. But you can register your own domain, and then, it is tied to your real identity and you can transfer it between registrars, which may be closer to what you had in mind. Most registrars provide an email relay, so that's probably the best you can get.


To register a domain, you need an email. Phone numbers are as decentralized as email addresses. Obviously the current scheme is not gonna work and there has to be some sort of centralization. I don’t think email service issued by the government is the best way, but a dedicated domain with email relay that get an address at and then can you an email provider of your choosing.


We have one, it's called the DNS, IP and SMTP.


Yup, I am effectively locked out of a few email addresses I rarely used as well. I haven’t found a solution. I just moved everything important off of Google and would never trust them with anything at all—ever.


Yep. They're getting aggressive with 2FA too. More ways to lock you out of your account in opaque, unpredictable ways with no support whatsoever.

I'm very glad that I've already started moving my accounts off.


That's because you tried to sing in using a cell phone which is listed into a black list. Maybe your mac address or imei is being rejected because it was used to do some illegal thing. Be careful...


From 3 days ago: https://merveilles.town/@akkartik/107656797631193281

One less risk to worry about.


gmail security is infuriating, particularly if you are off travelling the world. You enter your password correctly, you use MFA, and still google can be like nope no email for you. Its incredibly frustrating, and there is no recourse, no one you can call.

I get its trying to help protect people, but you know, if it creates friction for the user, you have fucked up. And google's automate everything is admirable, but where there are no feedback loops, it is worse than useless, as no-one knows something is broken and needs fixing.


From other user experience problems introduced by Google (what they did with Chrome address bar) I have impression some incompetent non-computer people are making thechnical decisions there.


I’ve also noticed that google like logging me out regularly if I’m using more filtering tools (think pihole etc). The ridiculous part is I’m on a static IP…google damn well knows it’s me


Looking at all the Google, Amazon, PayPal and comments on many others, security UX is simply an unsolved problem.

I am wondering if YubiKey would have the same problem? Edit: Looks like not.


Google has a good Yubikey implementation (they allow multiple keys), Amazon and PayPal are 100% crap implementations.

I had a website with probably 10K monthly active users go down for a week because I was travelling with a different Yubikey and AWS only allows 1 Yubikey to be registered.

I've also had PayPal payments have to be delayed until I got back home because of the same reason, they only allow 1 Yubikey.

Horrible quality products.


I've lost two Gmail accounts (like firstname.lastname@gmail.com) because of this. Now I'm using only nickname accounts and not tying them to anything important.


I’m in the same situation and have an account that I have a password to, but cannot login to for the same reasons.

Google is one of the companies I’d trust the least for anything critical.



I have my own domain and use email with that domain.

I have a gmail account but only use it for mailing lists, ecommerce orders, etc. Relying on Gmail for everything is a bad, bad idea.


Why was this title edited from the original (which was "Gmail account security is insane") as submit by caseyf7?

I understand editing titles to articles but self posts...???


I ran into the same problem and complained on HN a while ago.

In my case, I was able to access my email in an incognito tab, although that didn't seem to be a universal solution.


Try to login from a device that you used previously to login to other different accounts that you touched from the same device that was used to login previously.


You think that’s bad trying recovering a missing Microsoft outlook account. I have to wait on some verification and send my address previous addresses used, etc.

Good luck.


Just out of curiosity, do you have two-factor authentication set up? Or the Gmail app on a mobile device? Or do you really just have the recovery account?


Oh that is CREEPY.. means if I lose the devices I'm using to sign into google, I can't sign into google no more, even if I have the password.


there needs to be some kind of law or regulation around this right? email has become as, if not more important as regular mail, and the government should be protecting access to it.

try sending it to your senator and local representative. I think the FTC would also be interested in this. if google won’t even give you support for the issue, that should really be addressed by the government imo.


In my country the state maintains an alternative to email, where you can receive messages from anything government related, plus any business that registers. It's opt-in only, you cannot receive spam or be subscribed to entities against your will, and of course if you lose access you can just go down to the nearest citizen's office and get it sorted. You can also pay bills through it.

It is a nice solution but unfortunately everyone already has to have email accounts, so it becomes just yet another account to check, which is not attractive.


There is not need for a law. Just don't use google.


If someone wants to stop using gmail, it's horribly inconvenient to move to another service. You need to update your email with all your other accounts, which for most people is pretty much unfeasible. You can't take your @gmail.com address, which means switching email providers is extremely difficult. There should really be some consumer protection laws around email.


Email forwarding makes migrating away from Gmail substantially easier:

https://support.google.com/mail/answer/10957

With this, you don't have to update your email on all of your accounts at once. You can do it at your own pace.

Consumer protection laws requiring data portability would still be welcome.


That is nice, didn't realize you could do that. But yeah, people in the same spot as OP can't exactly do that if they're locked out for no apparent reason.


if the U.S. government offered an email an email service, I'd use it.


Use Che browser to mimic your usual device…

https://chebrowser.site/


eBay blocks my account for suspicious activity every time I post something. Completely unusable for occasional use


This is why you want your email to be your own domain, so even if you still use gmail, you can recover from that.


Same exact thing happened to me, I tried reaching out for help in Google and yet, to no avail, nothing happened.


Happened to me too. Gmail asked for a valid phone number for verification though and after that it worked.


Turn off any adblockers or other things that might be manipulating your browser sessions, cookies, etc.


This absurd struggle strongly reminds me of the themes in Kafka's novels: The Trial, The Castle.


Yeah, living abroad I am constantly running into issues like this and it's quite frustrating.


try to connect same network/wifi you have used to connect your device or native place where you have frequently used your device. you can open you Gmail id. If this not help you to fix , try to reset password in a Desktop/Laptop on chrome browser.


try to connect same network/wifi you have used to connect your device or native place where you have frequently used your device. you can open you Gmail id. If this not help you to fix , try to reset password in a Desktop/Laptop on chrome browser


Apple Private Relay enters the chat


Only solution that works for me is to use my 8 digit backup codes. That works everytime.


try user agent modification, it claims all this crap about wanting a device you signed in to before but in my humble experience using Linux + Firefox, all is fixed if I switch my user agent so it appears I am using Windows + Edge.


though this and the fact gmail manages to hide my important emails, I moved to using Zoho, which stays out of my way and plays nice with neomutt


Pretty sure if you have 2FA (Google Authenticator) set up this will never happen.


btw if it helps, by "location" they mean the same ISP you used to create the account or last successfully used it

old accounts without a valid phone number attached to get a SMS code are pretty much screwed if you change ISPs


We'll always be hostages of Google while we keep using their services.


I had this happen recently as well, have not found a solution


I just accepted I can't get to that account anymore...


eBay does the same shit, but they force a password reset on you instead.

Have to reset my password basically once a month because their heuristics are absolutely dogshit.


I have/had the same experience with Dropbox.


Try in Chrome with all extensions disabled?


Good news , CloudFlare does email routing


If you have a friend in the Feds, call them they give access to Feds immediately, zero requirements. Security is gone, poof. (sarcasm)


alphabet just needs your account. You don’t have to access it. all is good.


The faster we move from location/PINs sent to mobile, and other BS forms of 2FA the better...


turn on their advanced protection features and it gets even more fun


is paying for Google One subscription give me any support?


If you live in EU or EEC I wonder if this isn't covered by GDPR?

Aren't companies required to have a way to get a manual review of anything an AI does?

And aren't they also to safeguard your data?

I'm not a GDPR expert but I know GDPR is a bit larger than many expect.


mailinabox.email

fastmail.com

if its that valuable to you, pay!


google is evil


Security comes at the cost of comfort

You might not like it, but then you're free to disable this IIRC?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: