4 ms·

I trust Google login and oAuth to be protected with better security practices than the general login. AdSense and other cookies means they probably know where y

I trust Google login and oAuth to be protected with better security practices than the general login. AdSense and other cookies means they probably know where you have an account regardless of if you login. I like that "Sign in with Google" allows me to not make another login and password. For certain sites, after using "Sign in with Google", they have made me make a local account anyway as backup. I don't think a generalization like "don't ever do this" is helpful. I am curious why you say blocked accounts happens regularly. I have heard of it happening to people, but not often.

TedDoesntTalk 4y ago
What will you do if Google decides you’ve broken some terms of service and you lose access to gmail and all other Google resources? You are giving them the power to disable access to non-Google websites. And you’re ok with that? HN is littered with people who’ve experienced Google bans. An article hits the front page about it seemingly monthly (and those are only the ones that get publicized). It happens again and again. You have no recourse. There is no one to call. There is never an explanation. I’m not here to convince you. To each his own. If you dont care about the privacy leaks, then surely you can overlook the risk of losing access to your non-Google accounts whenever Google decides.
- deleted 4y ago
  [deleted]
- Arainach 4y ago
  Then I create an account with my new email. Sure, for the few sites I care deeply about a long history with, a unique account might be worth it. Those sites are few and far between. My password manager has more than 500 entries. A huge majority are sites I used once and never again. I don't want an account there but was probably required to create one to check out. If Google deleted them they'd be doing me a favor. Google knows I went to those sites anyway since I probably found them through search results.
- hardware2win 4y ago
  >You are giving them the power to disable access to non-Google websites. And you’re ok with that? I dont care. The only services important for me are: bank, email and hosting. Losing my gh would suck but it is not serious The rest of services I treat as "nice to have" My accounts on them are irrelevant for me. Losing account on random forum, random game, some streaming platform wouldnt change my life. I would just create a new one. It would suck, but thats not important
eks391 4y ago
Perhaps my anecdote is not as strong because I got locked out rather than blocked out, but it still was inconvenient. I degoogled my life some time ago, long enough to have a new phone and computer. At a point I needed to log into my old gmail acct, and I couldn't because it was a new device, the old devices were gone to verify my identity, and knowing my password and passing several captchas wasn't enough. Months later I went to log into fb/ig for something and similarly wasn't allowed in and also don't have access to my gmail for verification. Luckily during my degoogling adventure, I had changed the email for all important accts, so the impact is minimal, but I would not like to imagine the impact if I had ever relied on oAuth
- knaik94 4y ago
  I feel a little more comfortable relying on oAuth because I have my 2FA secrets backed up. This story does make me reconsider and want to revisit how I manage certain services. I don't know if there's a reasonable self hosted alternative to all the google services I use. I even have a Google Voice account I've had for over 12 years now, I feel like that'd help if I ever do get locked out. I try my best to practice good account security hygiene. I already have multiple backup accounts, for email but also in terms of recovery emails for third party accounts too. But I appreciate your story.
- jefftk 4y ago
  > the old devices were gone to verify my identity Do you mean you had a phone number configured in the account but it was out of date, or something else?
  - eks391 4y ago
    I mean the devices themselves. When you visit a site, details about your device are sent to the webserver, such as screen dimentions and resolution, processors, gyroscope information (orientation of screen), location, default language, and more, so the website can cater to you - rendering it to a good fit for your screen, using a protocol that works with your GPU, with relevant ads, etc. This data is called your digital fingerprint. Companies that deal with high security data (banks), advertising profiles (google), or bot abuse (everyone), will store the fingerprints to every device used by you on their webservers, so they know if it is a new device and to throw a captcha, 2FA, etc. I refuse to give out my number to most sites, which is sometimes the only 2FA option, so for most of my stuff, I just don't use 2FA. Despite knowing my password and passing 5+ captchas, having a different fingerprint and not having 2FA was too much for gmail and it decided I was still not verifiable. Idk if they decided I was a user in constant attack or something, but even when I had the old laptop they were always slow to accept that I must be me, making me fill capchas everytime and reinput my password.
kodah 4y ago
> I trust Google login and oAuth to be protected with better security practices than the general login. It's not about security. It's about that the oAuth protocol relies on good faith providers. Google is demonstrably not a good faith provider in terms of tracking. Part of oAuth includes refreshing that token and validating it with the provider. > I am curious why you say blocked accounts happens regularly. As for the blocked accounts bit, it's not so much the frequency that matters. It's that Google has zero and I mean literally zero humans to contact if their security machine flags your account for something. Their appeals process is a joke and a bad one at that. If you're searching for frequency, use Algolia to get an idea of how many people have appealed to this site: https://hn.algolia.com/?q=Google+blocked+account https://hn.algolia.com/?q=Google+blocked+account Next, load up the Googler and search Twitter and Reddit for the same thing. There's a lot of occurrences, horror stories, and news articles about it. Google does not care about addressing this.
- murderfs 4y ago
  > If you're searching for frequency, use Algolia to get an idea of how many people have appealed to this site: https://hn.algolia.com/?q=Google+blocked+account https://hn.algolia.com/?q=Google+blocked+account 83 results, and the first page has like one actual appeal from a person?
- sundarurfriend 4y ago
  I did a few different versions of that search for the LessWrong discussion about this (https://www.lesswrong.com/posts/ESp3SsuqWrht7SApu/not-getting-hacked?commentId=XX2gGzwAoaTS2ErgM#comments https://www.lesswrong.com/posts/ESp3SsuqWrht7SApu/not-gettin...) and learned that a large majority of these blocked accounts are developer accounts. There are still cases where individuals' accounts get banned randomly (and if there's enough ruckus, reinstated), which I've posted about there. And thinking about it, it might be the case that developer accounts with $$$ invested in them might just be the most likely to post on HN and complain, while individuals just suffer Google's "support" and give up. In any case, they're not as easily visible as the dev account bans, so we don't know how often they occur (unless someone trawls through support.google.com posts and creates a list of such).
piokoch 4y ago
Blocked google account is one of those things like not having regular backups, you'll realize how bad it is when it will happen, even once in your lifetime.

TedDoesntTalk 4y ago

What will you do if Google decides you’ve broken some terms of service and you lose access to gmail and all other Google resources? You are giving them the power to disable access to non-Google websites. And you’re ok with that? HN is littered with people who’ve experienced Google bans. An article hits the front page about it seemingly monthly (and those are only the ones that get publicized). It happens again and again. You have no recourse. There is no one to call. There is never an explanation. I’m not here to convince you. To each his own. If you dont care about the privacy leaks, then surely you can overlook the risk of losing access to your non-Google accounts whenever Google decides.

deleted 4y ago
[deleted]
Arainach 4y ago
Then I create an account with my new email. Sure, for the few sites I care deeply about a long history with, a unique account might be worth it. Those sites are few and far between. My password manager has more than 500 entries. A huge majority are sites I used once and never again. I don't want an account there but was probably required to create one to check out. If Google deleted them they'd be doing me a favor. Google knows I went to those sites anyway since I probably found them through search results.
hardware2win 4y ago
>You are giving them the power to disable access to non-Google websites. And you’re ok with that? I dont care. The only services important for me are: bank, email and hosting. Losing my gh would suck but it is not serious The rest of services I treat as "nice to have" My accounts on them are irrelevant for me. Losing account on random forum, random game, some streaming platform wouldnt change my life. I would just create a new one. It would suck, but thats not important

eks391 4y ago

Perhaps my anecdote is not as strong because I got locked out rather than blocked out, but it still was inconvenient. I degoogled my life some time ago, long enough to have a new phone and computer. At a point I needed to log into my old gmail acct, and I couldn't because it was a new device, the old devices were gone to verify my identity, and knowing my password and passing several captchas wasn't enough. Months later I went to log into fb/ig for something and similarly wasn't allowed in and also don't have access to my gmail for verification. Luckily during my degoogling adventure, I had changed the email for all important accts, so the impact is minimal, but I would not like to imagine the impact if I had ever relied on oAuth

knaik94 4y ago
I feel a little more comfortable relying on oAuth because I have my 2FA secrets backed up. This story does make me reconsider and want to revisit how I manage certain services. I don't know if there's a reasonable self hosted alternative to all the google services I use. I even have a Google Voice account I've had for over 12 years now, I feel like that'd help if I ever do get locked out. I try my best to practice good account security hygiene. I already have multiple backup accounts, for email but also in terms of recovery emails for third party accounts too. But I appreciate your story.
jefftk 4y ago
> the old devices were gone to verify my identity Do you mean you had a phone number configured in the account but it was out of date, or something else?
- eks391 4y ago
  I mean the devices themselves. When you visit a site, details about your device are sent to the webserver, such as screen dimentions and resolution, processors, gyroscope information (orientation of screen), location, default language, and more, so the website can cater to you - rendering it to a good fit for your screen, using a protocol that works with your GPU, with relevant ads, etc. This data is called your digital fingerprint. Companies that deal with high security data (banks), advertising profiles (google), or bot abuse (everyone), will store the fingerprints to every device used by you on their webservers, so they know if it is a new device and to throw a captcha, 2FA, etc. I refuse to give out my number to most sites, which is sometimes the only 2FA option, so for most of my stuff, I just don't use 2FA. Despite knowing my password and passing 5+ captchas, having a different fingerprint and not having 2FA was too much for gmail and it decided I was still not verifiable. Idk if they decided I was a user in constant attack or something, but even when I had the old laptop they were always slow to accept that I must be me, making me fill capchas everytime and reinput my password.

kodah 4y ago

> I trust Google login and oAuth to be protected with better security practices than the general login. It's not about security. It's about that the oAuth protocol relies on good faith providers. Google is demonstrably not a good faith provider in terms of tracking. Part of oAuth includes refreshing that token and validating it with the provider. > I am curious why you say blocked accounts happens regularly. As for the blocked accounts bit, it's not so much the frequency that matters. It's that Google has zero and I mean literally zero humans to contact if their security machine flags your account for something. Their appeals process is a joke and a bad one at that. If you're searching for frequency, use Algolia to get an idea of how many people have appealed to this site: https://hn.algolia.com/?q=Google+blocked+account https://hn.algolia.com/?q=Google+blocked+account Next, load up the Googler and search Twitter and Reddit for the same thing. There's a lot of occurrences, horror stories, and news articles about it. Google does not care about addressing this.

murderfs 4y ago
> If you're searching for frequency, use Algolia to get an idea of how many people have appealed to this site: https://hn.algolia.com/?q=Google+blocked+account https://hn.algolia.com/?q=Google+blocked+account 83 results, and the first page has like one actual appeal from a person?
sundarurfriend 4y ago
I did a few different versions of that search for the LessWrong discussion about this (https://www.lesswrong.com/posts/ESp3SsuqWrht7SApu/not-getting-hacked?commentId=XX2gGzwAoaTS2ErgM#comments https://www.lesswrong.com/posts/ESp3SsuqWrht7SApu/not-gettin...) and learned that a large majority of these blocked accounts are developer accounts. There are still cases where individuals' accounts get banned randomly (and if there's enough ruckus, reinstated), which I've posted about there. And thinking about it, it might be the case that developer accounts with $$$ invested in them might just be the most likely to post on HN and complain, while individuals just suffer Google's "support" and give up. In any case, they're not as easily visible as the dev account bans, so we don't know how often they occur (unless someone trawls through support.google.com posts and creates a list of such).

piokoch 4y ago

Blocked google account is one of those things like not having regular backups, you'll realize how bad it is when it will happen, even once in your lifetime.