4 ms·

I had this in ~2014 at an event. It literally would not let me log in no matter what. This did reinforce that running my own email server was a good idea. Like

by lucb1e 5y ago

I had this in ~2014 at an event. It literally would not let me log in no matter what. This did reinforce that running my own email server was a good idea. Like, what are you going to do if it actually is important? Call google support? I'd be surprised if they have a helpdesk with humans nowadays, let alone to fix some free account at 1am in the morning. Or even if you get to talk to a human, what are they going to do? Disable a security measure because a kind voice asks them to? Google thought my IP address was in Russia (I was in Germany) and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned. Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.) I think I later checked and saw that there were no other active login sessions, so it knew that I could not possibly have done as it suggested. (Or maybe that was another instance of this problem, not sure anymore after 5+ years. I never forgot the lesson though...) The reason for logging in wasn't time-sensitive so I let it go for the four days of the event. A related problem is that I have to clean up my inbox after logging into various services. Twitter was one of the first and I apparently got annoyed enough that I stopped using it subconsciously (I only later noticed that I had stopped checking Twitter and figured that the annoyance factor must be the reason). Like yeah you don't recognize my device, I don't want your "tweet" buttons across the web to track me so of course this appears as a new login device. What would be more suspicious is a login from a known device to this account, if the machine learning functions correctly...

gruez 5y ago
>Google thought the IP address was in Russia and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned. I'm not sure why you immediately jumped to the conclusion that google is blocking entire countries. It seems fairly reasonable to block signins from russia if the account was created and has a history of signing in from another far-away country (eg. US). >Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.) Google is probably doing more checks than looking at the country code from a geoip lookup. VPN/VPS IPs are easily distinguished from typical IPs (eg. residential internet and/or mobile internet).
- lucb1e 5y ago
  I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. It didn't have a problem logging in with the same laptop from another place in Germany earlier that day. There are surely more factors, but the deciding one here seemed to be the geoip. Perhaps anyone here can prove me wrong and confirm it's merely the distance that does it? Did anyone travel between two top ~50 HDI countries (not anything Google employees would consider putting on a blacklist, e.g. rich EU countries, Australia, USA, etc.) and had their login blocked with no way to access it?
  - gruez 5y ago
    > I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. 1. even though people travel, I suspect it's far more likely that a random russian IP accessing an american account is because the account got hacked. at the very least there's a good enough chance of an account compromise to request additional verification. Obviously locking the account entirely (effectively banning it) is unwarranted, but I don't think "well people travel" is a valid excuse to ignore a red flag. 2. google probably considers far more factors than just geoip. it probably also checks whether you're logging in from a new device or not (via cookies and/or fingerprinting), and whether your other devices have moved to the new country (eg. android phone or chrome browser on your laptop). I wouldn't be surprised if it scanned your email to see if you have an itinerary booked or your search history to see if you looked up russian vacation related queries.
    - lucb1e 5y ago
      "whether you're logging in from a new device or not (via cookies and/or fingerprinting)" Every login is a new 'device' because I don't have Google tracking me across the web. Fingerprinting, sure it can see I'm a firefox on linux with the usual browser features and fonts. All is as it usually is, nothing suspicious in this category. "whether your other devices have moved to the new country" I don't have any device pinging the mothership about my every movement so that can't be taken into account. "I wouldn't be surprised if it scanned your email" lol and I definitely don't have email from google, so that's also not a factor. I also highly doubt they're actually this clever, especially over six years ago. Huge amount of work to parse the email formats of the thousands of popular travel companies from around the world in fifty different languages.

by lucb1e 5y ago

gruez 5y ago

>Google thought the IP address was in Russia and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned. I'm not sure why you immediately jumped to the conclusion that google is blocking entire countries. It seems fairly reasonable to block signins from russia if the account was created and has a history of signing in from another far-away country (eg. US). >Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.) Google is probably doing more checks than looking at the country code from a geoip lookup. VPN/VPS IPs are easily distinguished from typical IPs (eg. residential internet and/or mobile internet).

lucb1e 5y ago
I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. It didn't have a problem logging in with the same laptop from another place in Germany earlier that day. There are surely more factors, but the deciding one here seemed to be the geoip. Perhaps anyone here can prove me wrong and confirm it's merely the distance that does it? Did anyone travel between two top ~50 HDI countries (not anything Google employees would consider putting on a blacklist, e.g. rich EU countries, Australia, USA, etc.) and had their login blocked with no way to access it?
- gruez 5y ago
  > I'd be very surprised if I came to the US (not that I'd ever want to do that) and Google blocked my account there just because it is far away from my home location. People do travel, appearing far away is not uncommon, especially during a holiday season between Christmas and New Year's. 1. even though people travel, I suspect it's far more likely that a random russian IP accessing an american account is because the account got hacked. at the very least there's a good enough chance of an account compromise to request additional verification. Obviously locking the account entirely (effectively banning it) is unwarranted, but I don't think "well people travel" is a valid excuse to ignore a red flag. 2. google probably considers far more factors than just geoip. it probably also checks whether you're logging in from a new device or not (via cookies and/or fingerprinting), and whether your other devices have moved to the new country (eg. android phone or chrome browser on your laptop). I wouldn't be surprised if it scanned your email to see if you have an itinerary booked or your search history to see if you looked up russian vacation related queries.
  - lucb1e 5y ago
    "whether you're logging in from a new device or not (via cookies and/or fingerprinting)" Every login is a new 'device' because I don't have Google tracking me across the web. Fingerprinting, sure it can see I'm a firefox on linux with the usual browser features and fonts. All is as it usually is, nothing suspicious in this category. "whether your other devices have moved to the new country" I don't have any device pinging the mothership about my every movement so that can't be taken into account. "I wouldn't be surprised if it scanned your email" lol and I definitely don't have email from google, so that's also not a factor. I also highly doubt they're actually this clever, especially over six years ago. Huge amount of work to parse the email formats of the thousands of popular travel companies from around the world in fifty different languages.