4 ms·

Three people sharing a personal account, with one of them frequently traveling internationally, is such an unusual usage pattern that I'd be really disappointed

Three people sharing a personal account, with one of them frequently traveling internationally, is such an unusual usage pattern that I'd be really disappointed with a service provider if they _didn't_ flag it for extra verification.

freedomben 5y ago
The frustrating thing to me is that as a user they don't give us any tools to help ourselves. I would gladly make it a "team" account and login individually if we could. I would gladly do a shared TOTP, or whitelist login locations, or anything like that. Or at least give us the option to accept the risk and disable whatever anomaly detection they are applying. But no, that's not how the software world works anymore. Extreme paternalism mode is the only option as a user.
- throwaway48375 5y ago
  Why do you need to all access the same account though? Can't you grant access to whatever resource you need to multiple accounts?
  - freedomben 5y ago
    For some of them we can, for others no. Sadly it seems as though supporting this sort of thing is not a priority for most SaaS
- blackrobot 5y ago
  Why don't you share a TOTP between all of you? Just take a screenshot of the authenticator QR code, or save it to a shared 1password secret. Google's login protection mechanisms seem to be satisfied by TOTP usage, and you won't be locked out anymore (or at least much less likely to be).
  - freedomben 5y ago
    You're right that would totally work with Google. In our case the boss is quite computer illiterate and trying to get him to use LastPass was hard enough. He will tolerate a lot of pain from getting locked out before he'll be willing to learn TOTP :-( And for many of the SaaS that we use, TOTP doesn't help you avoid the security lock outs.
kortilla 5y ago
This is the problem with this kind of thing. It just perfectly captures the privilege/shelter of the programmers who come up with these heuristics of “obviously unusual”. You just described the usage pattern of a pilot with a family, a truck driver, a seaman, etc. It’s only unusual if your definition of usual is “relatively rich, computer power user”.
- seized 5y ago
  Not really. What's the use case there, everyone sharing a Google account? I travelled a lot for work, and never had issues with account access. Nor did my wife ever have issues related to accounts. We don't share Google accounts though. It sounds like that user has personal accounts being used by three people for business use... Which isn't "A seaman and his family".
  - iszomer 5y ago
    It may be true about 10 years ago but I imagine the heuristics to have been improved since; I remember being locked out of my Google account while abroad for a month and all it took was to log back in within my "country of origin". Or a more recent example: my father forgot to bring his Android phone back abroad which subsequently locked him out of his account/services; had to wipe it for him to get his access back.
  - kortilla 5y ago
    > What's the use case there, everyone sharing a Google account? Yes. Everyone having their own distinct accounts is a property of high computer literacy in the family. Many of my older extended family members have a single email account shared by a husband and wife. Or in one case the way to email my aunt is to send an email to an account operated by a daughter in a different town. Aunt and daughter are both signed in so the daughter can help with attachments or “emails that go missing”, etc. > Which isn't "A seaman and his family". The seaman in this scenario has a smartphone with the email signed in. It’s also signed in on the family computer at home. Both the wife and him send email from it. Maybe a kid does to from a tablet. This isn’t that difficult.

freedomben 5y ago

The frustrating thing to me is that as a user they don't give us any tools to help ourselves. I would gladly make it a "team" account and login individually if we could. I would gladly do a shared TOTP, or whitelist login locations, or anything like that. Or at least give us the option to accept the risk and disable whatever anomaly detection they are applying. But no, that's not how the software world works anymore. Extreme paternalism mode is the only option as a user.

throwaway48375 5y ago
Why do you need to all access the same account though? Can't you grant access to whatever resource you need to multiple accounts?
- freedomben 5y ago
  For some of them we can, for others no. Sadly it seems as though supporting this sort of thing is not a priority for most SaaS
blackrobot 5y ago
Why don't you share a TOTP between all of you? Just take a screenshot of the authenticator QR code, or save it to a shared 1password secret. Google's login protection mechanisms seem to be satisfied by TOTP usage, and you won't be locked out anymore (or at least much less likely to be).
- freedomben 5y ago
  You're right that would totally work with Google. In our case the boss is quite computer illiterate and trying to get him to use LastPass was hard enough. He will tolerate a lot of pain from getting locked out before he'll be willing to learn TOTP :-( And for many of the SaaS that we use, TOTP doesn't help you avoid the security lock outs.

kortilla 5y ago

This is the problem with this kind of thing. It just perfectly captures the privilege/shelter of the programmers who come up with these heuristics of “obviously unusual”. You just described the usage pattern of a pilot with a family, a truck driver, a seaman, etc. It’s only unusual if your definition of usual is “relatively rich, computer power user”.

seized 5y ago
Not really. What's the use case there, everyone sharing a Google account? I travelled a lot for work, and never had issues with account access. Nor did my wife ever have issues related to accounts. We don't share Google accounts though. It sounds like that user has personal accounts being used by three people for business use... Which isn't "A seaman and his family".
- iszomer 5y ago
  It may be true about 10 years ago but I imagine the heuristics to have been improved since; I remember being locked out of my Google account while abroad for a month and all it took was to log back in within my "country of origin". Or a more recent example: my father forgot to bring his Android phone back abroad which subsequently locked him out of his account/services; had to wipe it for him to get his access back.
- kortilla 5y ago
  > What's the use case there, everyone sharing a Google account? Yes. Everyone having their own distinct accounts is a property of high computer literacy in the family. Many of my older extended family members have a single email account shared by a husband and wife. Or in one case the way to email my aunt is to send an email to an account operated by a daughter in a different town. Aunt and daughter are both signed in so the daughter can help with attachments or “emails that go missing”, etc. > Which isn't "A seaman and his family". The seaman in this scenario has a smartphone with the email signed in. It’s also signed in on the family computer at home. Both the wife and him send email from it. Maybe a kid does to from a tablet. This isn’t that difficult.