7 ms·

Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anyth

Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now.

lukasb 10y ago
I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?
- hughes 10y ago
  I get notifications about that from Facebook sometimes. It is a bit unnerving to hear that someone is attempting to repeatedly log in with my email address, but it certainly prompts me to make sure my accounts are locked down well.
  - knz 10y ago
    Do you have an email address that may be similar to others? My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).
    - lucb1e 10y ago
      > login > emails There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.
      - knz 10y ago
        Unfortunately that was a management decision rather than technical decision!
      - nommm-nommm 10y ago
        Then nobody remembers their user name, I don't remember any of mine. If I didn't have LastPass I'd be password resetting on every financial account I have.
- wfunction 10y ago
  > We do send an email when you log in from a new device. AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...
  - jandrese 10y ago
    On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.
    - Houshalter 10y ago
      I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs. Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regular users more security conscious.
      - wfunction 10y ago
        +1 same. Rssponses like the one you just replied to completely drive me nuts. If you don't think it'll be useful for me then let me disable it. Don't use it as an excuse.
      - jandrese 10y ago
        In the last week my host has blocked 173 different IPs for attempting to guess passwords on SSH. And I don't even have psasword authentication enabled on SSH. And this is on a nothing host. Almost completely anonymous and yet under constant attack.
    - wfunction 10y ago
- Figs 10y ago
  > We do send an email when you log in from a new device. Which is useless, because whoever got access can just delete it or change your password.
  - NolF 10y ago
    They send emails to the alternate account.
    - lucb1e 10y ago
      Which is very nice as a family member who is the recovery contact for many other family members. Wish this shit could be turned off, I've never heard it help anyone (though I'm sure we can find a stranger on the internet who can testify how useful it was for them).
      - NolF 10y ago
        Use rules and labels to bypass your inbox. I use it in the same manner as you and it has come useful to recover their passwords.
- lucb1e 10y ago
  > We do send an email when you log in from a new device. Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)
  - CamperBob2 10y ago
    Why wouldn't you store cookies?
    - lucb1e 10y ago
      From the biggest ad network in the world? The real question is: why do you?!
      - CamperBob2 10y ago
        So that I get ads for microcontrollers, FPGAs, and PLL synthesizer chips, and not fishing supplies, groceries, or feminine hygiene products.

lukasb 10y ago

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

hughes 10y ago
I get notifications about that from Facebook sometimes. It is a bit unnerving to hear that someone is attempting to repeatedly log in with my email address, but it certainly prompts me to make sure my accounts are locked down well.
- knz 10y ago
  Do you have an email address that may be similar to others? My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).
  - lucb1e 10y ago
    > login > emails There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.
    - knz 10y ago
      Unfortunately that was a management decision rather than technical decision!
    - nommm-nommm 10y ago
      Then nobody remembers their user name, I don't remember any of mine. If I didn't have LastPass I'd be password resetting on every financial account I have.
wfunction 10y ago
> We do send an email when you log in from a new device. AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...
- jandrese 10y ago
  On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.
  - Houshalter 10y ago
    I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs. Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regular users more security conscious.
    - wfunction 10y ago
      +1 same. Rssponses like the one you just replied to completely drive me nuts. If you don't think it'll be useful for me then let me disable it. Don't use it as an excuse.
    - jandrese 10y ago
      In the last week my host has blocked 173 different IPs for attempting to guess passwords on SSH. And I don't even have psasword authentication enabled on SSH. And this is on a nothing host. Almost completely anonymous and yet under constant attack.
  - wfunction 10y ago
Figs 10y ago
> We do send an email when you log in from a new device. Which is useless, because whoever got access can just delete it or change your password.
- NolF 10y ago
  They send emails to the alternate account.
  - lucb1e 10y ago
    Which is very nice as a family member who is the recovery contact for many other family members. Wish this shit could be turned off, I've never heard it help anyone (though I'm sure we can find a stranger on the internet who can testify how useful it was for them).
    - NolF 10y ago
      Use rules and labels to bypass your inbox. I use it in the same manner as you and it has come useful to recover their passwords.
lucb1e 10y ago
> We do send an email when you log in from a new device. Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)
- CamperBob2 10y ago
  Why wouldn't you store cookies?
  - lucb1e 10y ago
    From the biggest ad network in the world? The real question is: why do you?!
    - CamperBob2 10y ago
      So that I get ads for microcontrollers, FPGAs, and PLL synthesizer chips, and not fishing supplies, groceries, or feminine hygiene products.