I believe APP Suffers from the exact same issue, though APP is something I recently enabled anyway. I don't know of a way, even with full gsuite enterprise pol

I believe APP Suffers from the exact same issue, though APP is something I recently enabled anyway. I don't know of a way, even with full gsuite enterprise policy access, to prevent an attack where the attacker has an active session and your password. Some things you could do, but would not be full mitigations and likely just annoy an attacker in many cases (though that's often enough): * via GSuite, enforce 2FA * Enforce 2FA via hardware tokens/ APP * Context Aware Access that validates that the login is coming from a specific verified device that is provisioned via your GSuite / conforms to policy, that way the attacker can't just steal the session/password and log in from another device? Maybe? Really, the attack described requires like 3 different things to go wrong. I agree that there should be changes made to the system to improve this, but it's a rough model to protect a user when the attacker is sitting on the box they're logged into.