5 ms·

"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In

"When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious." In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. It should be my choice, as it is my account that is at risk, to turn on/off such dubious security measures. It is fine to have these features on by default, but I would like to turn this particular feature off for my account. Any clever "risk assessment" thing where a computer decides without an option to turn if off/on is problematic. I have sometimes the feeling they know this and it is on purpose. They want not only to collect data, they want to collect high quality data and these measures help to clean their data sets at time of collection.

realusername 8y ago
> In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. That's exactly it, there's already two Gmail accounts from high school I can't access despite knowing the passwords.
zuzun 8y ago
I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?
- NullPrefix 8y ago
  What makes you think that their end goal wasn't getting your identity confirmed?
  - O_H_E 8y ago
    I don't think they are questioning Google's end goal, but more the effectiveness of the current system.
minitech 8y ago
Yep, this happened to me when I created a separate account for travel. Immediate, permanent lockout.
jasonvorhe 8y ago
They're giving you a free account to burst out mails with. Your account will most likely contain a lot of private or privileged information about other people, e.g. their mails, pictures, contact data, etc. You have a responsibility so why should you be allowed to reduce the security of your account?
- O_H_E 8y ago
  Because I "have a responsibility" if it is truly mine I should be allowed to. But just as you said, they are giving it away for free, so it is technically theirs, we are not paying customers. (Except for G-Suite users)
SmellyGeekBoy 8y ago
I travel frequently and have multiple Google accounts (3x G-Suite and one Gmail) and have never had any problems accessing any of them anywhere in the world. I do occasionally get alerts saying that they've blocked a login attempt from India or South America, though. It seems their system works pretty well.
- Bartweiss 8y ago
  This is actually surprising enough that I'm glad to hear it even as an anecdote. My experience with changing devices or cities (or god forbid both at once) is that it always requires further authentication, and often fails outright. I have an account which is simply disabled because I didn't set a recovery phone # or email and then changed machines. Everyone I've ever discussed the topic with has described similarly pervasive problems. Which makes me wonder: what's so different between usage patterns? Obvious Google's auth approach is working for lots of people, so what's distinctive about this block of users who it's constantly failing for?
passwd 8y ago
It used to be the case that these checks are not in place when you're using 2FA. The downside is that you cannot use it without using a phone to register in the first place (though you can use your own generators afterwards)
fiblye 8y ago
I get this on my own computer that I've been using for 6 years on a static IP. It happens at least once a month, sometimes several times. Each time they ask for a phone number confirmation when no phone number is linked to the account (and never will be). Google™ employees have come in and found mind-bending ways to excuse it when I've mentioned this before.

realusername 8y ago

> In my experience (it is already the case with gmail and outlook up and now), this means I will not be able to login to my account when in holiday in another city, country, or when I use a borrowed device, or when I am behind VPN/Tor, etc, unless I give google my phone number, and can afford to get a call / sms at that point of time and unblock the account. That's exactly it, there's already two Gmail accounts from high school I can't access despite knowing the passwords.

zuzun 8y ago

I also have no faith in their risk assessment. For a very long time I have only used one computer from one location to log into my Gmail account and every time I log in they consider it a suspicious activity. They even forced me to confirm my identity on my last login. What's their risk assessment doing if it can't get the baseline right?

NullPrefix 8y ago
What makes you think that their end goal wasn't getting your identity confirmed?
- O_H_E 8y ago
  I don't think they are questioning Google's end goal, but more the effectiveness of the current system.

minitech 8y ago

Yep, this happened to me when I created a separate account for travel. Immediate, permanent lockout.

jasonvorhe 8y ago

They're giving you a free account to burst out mails with. Your account will most likely contain a lot of private or privileged information about other people, e.g. their mails, pictures, contact data, etc. You have a responsibility so why should you be allowed to reduce the security of your account?

O_H_E 8y ago
Because I "have a responsibility" if it is truly mine I should be allowed to. But just as you said, they are giving it away for free, so it is technically theirs, we are not paying customers. (Except for G-Suite users)

SmellyGeekBoy 8y ago

I travel frequently and have multiple Google accounts (3x G-Suite and one Gmail) and have never had any problems accessing any of them anywhere in the world. I do occasionally get alerts saying that they've blocked a login attempt from India or South America, though. It seems their system works pretty well.

Bartweiss 8y ago
This is actually surprising enough that I'm glad to hear it even as an anecdote. My experience with changing devices or cities (or god forbid both at once) is that it always requires further authentication, and often fails outright. I have an account which is simply disabled because I didn't set a recovery phone # or email and then changed machines. Everyone I've ever discussed the topic with has described similarly pervasive problems. Which makes me wonder: what's so different between usage patterns? Obvious Google's auth approach is working for lots of people, so what's distinctive about this block of users who it's constantly failing for?

passwd 8y ago

It used to be the case that these checks are not in place when you're using 2FA. The downside is that you cannot use it without using a phone to register in the first place (though you can use your own generators afterwards)

fiblye 8y ago

I get this on my own computer that I've been using for 6 years on a static IP. It happens at least once a month, sometimes several times. Each time they ask for a phone number confirmation when no phone number is linked to the account (and never will be). Google™ employees have come in and found mind-bending ways to excuse it when I've mentioned this before.