6 ms·

This is one reason I will not give out a phone number for the vast majority of services. If that means I can't use something, so be it. Building proprietary, i

by _jal 6y ago

This is one reason I will not give out a phone number for the vast majority of services. If that means I can't use something, so be it. Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system, it is a design for randomly fucking me over. If your system is designed to fuck me over, I would prefer to use something else, thanks.

whenitrains 6y ago
This is a great point. I'm going to try and onboard this thinking into my life.
handedness 6y ago
I'm locked out of a Google account I configured without a phone number. It won't let me reset to email, and when I provide a new number it does no good. The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.
- jerry80 6y ago
  Same thing happened to me when I changed ISPs. I never lost my password, but Gmail locked me out anyway.
1vuio0pswjnm7 6y ago
"Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system." It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it. From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices. Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.
- bryanrasmussen 6y ago
  since the user agent is supposed to be locked (soon if not already) for newer agents, and Google is probably most responsible for this feature, you would think they did not detect new devices by user header changes?
- TeMPOraL 6y ago
  Ironically, Google likely has enough data that they could conclusively prove you are who you say you are and own the target account, just by looking at your Chrome's telemetry for the past 10 minutes...
- 1vuio0pswjnm7 6y ago
  s/sacrafice/sacrifice/
dsnr 6y ago
> I would prefer to use something else, thanks. What is the alternative to Gmail? Genuinely interested. I'd be willing to switch if I found a future-proof email solution for both personal and business usage.
- krageon 6y ago
  There are so many email providers you'll have to explain in a bit more detail why you think the alternatives you've seen aren't appropriate for you.
- skrebbel 6y ago
  Fastmail, Protonmail, Microsoft365
- nunodonato 6y ago
  Seriously? Fastmail is awesome and so much better than gmail. And I'm sure there are plenty of good alternatives as well, this just happens to be the one I use.
- laurentdc 6y ago
  I just use my own domain and then forward incoming email to whatever service. This way it doesn't really matter what I use: if I get locked out I simply change the forwarding email. It's free with most providers.
- Spearchucker 6y ago
  I use Office365. Yes it costs money, and yes they provide good support. I also use Outlook so ALL my mail, both sent and received are stored locally and remotely. If my mail bombs I lose max a couple hours' worth of email.
- jacoblambda 6y ago
  Protonmail is a really solid solution as long as you have your own domain. It's pretty privacy focused and has worked well for me for a decent while. They've got a decent VPN service as well (I think it comes bundled with Protonmail at some tier level) and they just recently rolled out a beta for their Google Drive replacement. All in all I've enjoyed their services. Their security/E2E Encryption support is nice (could still use a bit more functionality though) and they are definitely a lot more FOSS friendly than Google when it comes to actually using their services.
cik 6y ago
I keep a phone number I never answer, with a voip provider I've used for decades. That number forwards to whatever number I care about. I give out only the movable voip number, never my physical cellphone number, when it comes to services. This is what iNUM was supposed to solve. Sadly it didn't take off.
- RamRodification 6y ago
  Does that mean you could be screwed if that voip provider disappears before you have time to change things? Or do you own the number somehow (like a domain name?) so that you can move it elsewhere in that situation? I know nothing about voip providers and this makes the setup sound scary to me.
  - cik 6y ago
    Yes, you'd be screwed if that happens. But it's significantly less likely that they're skiffed than a telco provider, given how they work. I know way too many people who have had the latter happen - and none the former.

by _jal 6y ago

whenitrains 6y ago

This is a great point. I'm going to try and onboard this thinking into my life.

handedness 6y ago

I'm locked out of a Google account I configured without a phone number. It won't let me reset to email, and when I provide a new number it does no good. The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.

jerry80 6y ago
Same thing happened to me when I changed ISPs. I never lost my password, but Gmail locked me out anyway.

1vuio0pswjnm7 6y ago

"Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system." It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it. From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices. Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.

bryanrasmussen 6y ago
since the user agent is supposed to be locked (soon if not already) for newer agents, and Google is probably most responsible for this feature, you would think they did not detect new devices by user header changes?
TeMPOraL 6y ago
Ironically, Google likely has enough data that they could conclusively prove you are who you say you are and own the target account, just by looking at your Chrome's telemetry for the past 10 minutes...
1vuio0pswjnm7 6y ago
s/sacrafice/sacrifice/

dsnr 6y ago

> I would prefer to use something else, thanks. What is the alternative to Gmail? Genuinely interested. I'd be willing to switch if I found a future-proof email solution for both personal and business usage.

krageon 6y ago
There are so many email providers you'll have to explain in a bit more detail why you think the alternatives you've seen aren't appropriate for you.
skrebbel 6y ago
Fastmail, Protonmail, Microsoft365
nunodonato 6y ago
Seriously? Fastmail is awesome and so much better than gmail. And I'm sure there are plenty of good alternatives as well, this just happens to be the one I use.
laurentdc 6y ago
I just use my own domain and then forward incoming email to whatever service. This way it doesn't really matter what I use: if I get locked out I simply change the forwarding email. It's free with most providers.
Spearchucker 6y ago
I use Office365. Yes it costs money, and yes they provide good support. I also use Outlook so ALL my mail, both sent and received are stored locally and remotely. If my mail bombs I lose max a couple hours' worth of email.
jacoblambda 6y ago
Protonmail is a really solid solution as long as you have your own domain. It's pretty privacy focused and has worked well for me for a decent while. They've got a decent VPN service as well (I think it comes bundled with Protonmail at some tier level) and they just recently rolled out a beta for their Google Drive replacement. All in all I've enjoyed their services. Their security/E2E Encryption support is nice (could still use a bit more functionality though) and they are definitely a lot more FOSS friendly than Google when it comes to actually using their services.

cik 6y ago

I keep a phone number I never answer, with a voip provider I've used for decades. That number forwards to whatever number I care about. I give out only the movable voip number, never my physical cellphone number, when it comes to services. This is what iNUM was supposed to solve. Sadly it didn't take off.

RamRodification 6y ago
Does that mean you could be screwed if that voip provider disappears before you have time to change things? Or do you own the number somehow (like a domain name?) so that you can move it elsewhere in that situation? I know nothing about voip providers and this makes the setup sound scary to me.
- cik 6y ago
  Yes, you'd be screwed if that happens. But it's significantly less likely that they're skiffed than a telco provider, given how they work. I know way too many people who have had the latter happen - and none the former.