4 ms·

I created a GSuite account a long time ago for my family members. I've been screwed over by Google every few months the past few years. * My kid can't get Goog

I created a GSuite account a long time ago for my family members. I've been screwed over by Google every few months the past few years. * My kid can't get Google Voice * There is no support * Google intentionally tries to make things as insecure as possible * And so on.... It's one of the many harsh lessons I've had about relying on Google for anything. They're trying to upsell on a premium account, but that's not how it's playing out. The way it's playing out is they lose millions of dollars in cloud business in my professional life.

meibo 6y ago
> * Google intentionally tries to make things as insecure as possible Can you elaborate on this? I maintain a big GSuite organization for a NGO and Google consistently pushes for better security guidelines and gives admins powerful tools and policies to manage them. These(with the exception of vault licenses, which you probably won't need for your family) are not usually locked behind upgrades either. Same with the support, the times I've had to contact them it was really just a click and maybe half a minute of waiting until I've had a representative on the line via chat/Phone that was able to help rather quickly.
- CamJN 6y ago
  Not who you asked, but if you have signed into a Google app (Gmail, youtube, etc) on a phone then they will send a push notification to that phone that bypasses 2FA. This cannot be disabled, you can choose to login with the second factor you setup, but it doesn't provide any security anymore.
  - Daho0n 6y ago
    If you are signing into something from a phone and get the prompt on that same phone you already have 1) chosen to add the account phone-wide on that phone and 2) provided 2FA to do so. What you are doing is browsing the web on your 2FA hardware and complaining it isn't secure.
    - p49k 6y ago
      1. I don’t want every device I login with Google to automatically become a 2FA device. There are plenty of scenarios where this reduces account security. 2. They send these non-optional push notifications as part of the account recovery process as well. Once someone was relentlessly trying to get into my gmail account (not maliciously, I think they probably had a similar address and got confused) and I was deluged with these notifications for hours with no way to make them stop.
      - mindslight 6y ago
        3. They then go on to disable your actual recovery options that they've deemed "less secure". I recently tried to sign on to my grandfathered Gapps account to reset its activity timeout (Google demands I perform the account recovery process for every login). This time, Google decided I couldn't authenticate with my longstanding recovery email, instead demanding that I use some long cleared browser/tablet session (lol, such surveillance culture assumptions). I was eventually able to contact what appeared to be a real live human in GSuite support that took on my case even though it was a free account (after going a few rounds of them referring me to gmail account support, and gmail support bot referring me back to them). So believe it or not, it is possible to contact a human at Google. Of course after I got the grandfathered Gapps account back, I was trying to figure out what it's actually good for, especially now that they've restricted adding domain names. The only things I could find are if I wanted to use gmail on my personal domain (no thanks), or if I want my published Google identity to include my own domain name (shrug). So back into storage it goes, this time with an explicit "2FA" tablet.
    - CamJN 6y ago
      You seem to be labouring under some pretty egregious misconceptions. I am not signing into something from my phone. The flow is: i try to log into gmail/google docs/whatever on my laptop's browser. Google sends my phone, tablet, any other mobile device I own a notification. if someone taps that notification, the laptop's browser is logged in, with no 2fa. There's no such thing as a phone-wide google account on iPhones. There are google made apps, which completely fuck the security for your google account.
  - deleted 6y ago
    [deleted]
- woofie11 6y ago
  GSuite started free. Google's goal is to up-sell me on a $6/month plan. With my whole family on, that'd be many thousands of dollars over our lifetimes. We had an account compromised. We were trying to understand what happened, and ideally, get the attacker prosecuted. Google has the auditing tools which would have allowed us to do this, but: 1) Google removed access to security/auditing tools for legacy accounts, in an attempt to up-sell their $$$ accounts. 2) As a "legacy" account, we can't get Google support (the free support directs us to Workspace support, and Workspace blocks legacy accounts from contacting their support). There is no human being who will talk to us. This would have been an open-and-shut issue, but I couldn't afford thousands of dollars to Google just to be able to do the right thing and prosecute the attacker. On my end, that means that I don't know what was stolen or destroyed, which is kind of a bummer. On your end, that means a cybercriminal is going free, and I'm pretty sure they'll pull the same shtick a few other places. Maybe your company. There are viable places to do freemium (even if it is sleazy after promising free-for-life), but security isn't one of them. Intentionally bad security hurts the ecosystem. It's pissing in the pool. I know you've got a paid account, but the callous attitude toward customer security and data translates over. You're a statistic. I'd never use Google Cloud in a B2B setting voluntarily, with viable alternatives.
Daho0n 6y ago
>The way it's playing out is they lose millions of dollars in cloud business in my professional life. You not being happy with something and for that reason not wanting to use something else makes no sense. As another comment points out using it as an actual "million dollar business" (to passphrase your words) gives support with a click and none of the problems you complain about. >Google intentionally tries to make things as insecure as possible Hyperbole. It doesn't. Just don't browse the internet on your 2FA device.
- gcatalfamo 6y ago
  > Just don't browse the internet on your 2FA device. I can’t tell if this is supposed to be a joke
  - Bancakes 6y ago
    You should buy a separate Google Pixel dedicated 2fa device. /s

meibo 6y ago

> * Google intentionally tries to make things as insecure as possible Can you elaborate on this? I maintain a big GSuite organization for a NGO and Google consistently pushes for better security guidelines and gives admins powerful tools and policies to manage them. These(with the exception of vault licenses, which you probably won't need for your family) are not usually locked behind upgrades either. Same with the support, the times I've had to contact them it was really just a click and maybe half a minute of waiting until I've had a representative on the line via chat/Phone that was able to help rather quickly.

CamJN 6y ago
Not who you asked, but if you have signed into a Google app (Gmail, youtube, etc) on a phone then they will send a push notification to that phone that bypasses 2FA. This cannot be disabled, you can choose to login with the second factor you setup, but it doesn't provide any security anymore.
- Daho0n 6y ago
  If you are signing into something from a phone and get the prompt on that same phone you already have 1) chosen to add the account phone-wide on that phone and 2) provided 2FA to do so. What you are doing is browsing the web on your 2FA hardware and complaining it isn't secure.
  - p49k 6y ago
    1. I don’t want every device I login with Google to automatically become a 2FA device. There are plenty of scenarios where this reduces account security. 2. They send these non-optional push notifications as part of the account recovery process as well. Once someone was relentlessly trying to get into my gmail account (not maliciously, I think they probably had a similar address and got confused) and I was deluged with these notifications for hours with no way to make them stop.
    - mindslight 6y ago
      3. They then go on to disable your actual recovery options that they've deemed "less secure". I recently tried to sign on to my grandfathered Gapps account to reset its activity timeout (Google demands I perform the account recovery process for every login). This time, Google decided I couldn't authenticate with my longstanding recovery email, instead demanding that I use some long cleared browser/tablet session (lol, such surveillance culture assumptions). I was eventually able to contact what appeared to be a real live human in GSuite support that took on my case even though it was a free account (after going a few rounds of them referring me to gmail account support, and gmail support bot referring me back to them). So believe it or not, it is possible to contact a human at Google. Of course after I got the grandfathered Gapps account back, I was trying to figure out what it's actually good for, especially now that they've restricted adding domain names. The only things I could find are if I wanted to use gmail on my personal domain (no thanks), or if I want my published Google identity to include my own domain name (shrug). So back into storage it goes, this time with an explicit "2FA" tablet.
  - CamJN 6y ago
    You seem to be labouring under some pretty egregious misconceptions. I am not signing into something from my phone. The flow is: i try to log into gmail/google docs/whatever on my laptop's browser. Google sends my phone, tablet, any other mobile device I own a notification. if someone taps that notification, the laptop's browser is logged in, with no 2fa. There's no such thing as a phone-wide google account on iPhones. There are google made apps, which completely fuck the security for your google account.
- deleted 6y ago
  [deleted]
woofie11 6y ago
GSuite started free. Google's goal is to up-sell me on a $6/month plan. With my whole family on, that'd be many thousands of dollars over our lifetimes. We had an account compromised. We were trying to understand what happened, and ideally, get the attacker prosecuted. Google has the auditing tools which would have allowed us to do this, but: 1) Google removed access to security/auditing tools for legacy accounts, in an attempt to up-sell their $$$ accounts. 2) As a "legacy" account, we can't get Google support (the free support directs us to Workspace support, and Workspace blocks legacy accounts from contacting their support). There is no human being who will talk to us. This would have been an open-and-shut issue, but I couldn't afford thousands of dollars to Google just to be able to do the right thing and prosecute the attacker. On my end, that means that I don't know what was stolen or destroyed, which is kind of a bummer. On your end, that means a cybercriminal is going free, and I'm pretty sure they'll pull the same shtick a few other places. Maybe your company. There are viable places to do freemium (even if it is sleazy after promising free-for-life), but security isn't one of them. Intentionally bad security hurts the ecosystem. It's pissing in the pool. I know you've got a paid account, but the callous attitude toward customer security and data translates over. You're a statistic. I'd never use Google Cloud in a B2B setting voluntarily, with viable alternatives.

Daho0n 6y ago

>The way it's playing out is they lose millions of dollars in cloud business in my professional life. You not being happy with something and for that reason not wanting to use something else makes no sense. As another comment points out using it as an actual "million dollar business" (to passphrase your words) gives support with a click and none of the problems you complain about. >Google intentionally tries to make things as insecure as possible Hyperbole. It doesn't. Just don't browse the internet on your 2FA device.

gcatalfamo 6y ago
> Just don't browse the internet on your 2FA device. I can’t tell if this is supposed to be a joke
- Bancakes 6y ago
  You should buy a separate Google Pixel dedicated 2fa device. /s