50 ms·

How likely is losing a Google account?

• sshine 4y ago
  Okay, so it's not very likely. What made me transition away from Google/Gmail as my identity provider was pondering the question: How screwed am I if I get locked out of my Google account? The answer: Well, if you're on Hacker News, you may have a chance of reaching a human. But if you broke a policy, good luck. I'm paying $5/mo. for that to not be that screwed. (I have family who got locked out. It does happen.)
  • AnotherGoodName 4y ago
    Hackernews made me realize manual recovery should never be a thing. My first account was taken over by a scammer even with a unique password. I suspect the admins of this site 'manually recovered' my account and gave it to them. The last message of my first account, areallygoodname, is spam. I couldn't be bothered getting the admins to recover it back. I just took the lesson that hackernews is really insecure due to allowing manual recovery.
    • ghaff 4y ago
      At the end of the day, you either have onerous procedures to recover an account--notarized signatures and the like--or you just don't allow it at all. Or there's always going to be some susceptibility to sophisticated social engineering.
  • column 4y ago
    I'm not sure I understand.. where do you pay $5/mo for a service similar to Gmail? Or do you mean you have a paid Google account with extra storage?
    • fortytw2 4y ago
      Fastmail!
    • fullstop 4y ago
      Fastmail is $5/mo as is ProtonMail.
    • brewdad 4y ago
      I'm paying $10 a year for https://purelymail.com https://purelymail.com. Yeah, I'm pretty sure there's a hit-by-a-bus factor at play here that could bite me but the one time I had an issue it was resolved within 8 hours with a follow-up to make sure the uptime they were seeing was also my experience. If the bus ever does meet my provider, I can move providers within a day. For my personal email, that is more than sufficient.
  • karteum 4y ago
    > I'm paying $5/mo. for that to not be that screwed (I have family who got locked out. It does happen.) But the article precisely addresses that: For example, in HN discussions people will often recommend Fastmail or Protonmail, but they've had their problems too (FM: 2017, 2020, 2022, PM: 2018, 2019, 2021). Especially given that these are much smaller services I'm not convinced that the risk is lower there. Any system is going to have to handle this sort of problem, and you're not going to find one that never has false positives. What I'd like to know is : do FM/PM more easily enable to talk to a human ?
    • toomuchtodo 4y ago
      I submitted a support request to FastMail about passkeys not working properly (enrollment failure) for 2FA and had a human response in under 15 min on a weekend.
    • mtlynch 4y ago
      I'm a Fastmail customer, and it's pretty easy to talk to a human. They don't always fix my issue quickly, but I can at least get a hold of a human within 24 hours.
    • cameronh90 4y ago
      Talking to a human doesn't necessarily make anything any easier. Lots of large companies have a bunch of customer support agents who are easy to get in touch with, but entirely powerless to solve these sorts of problems: "Computer says no". They are just, to be blunt, executing flowcharts, and have no scope to escalate beyond that. The only reliable ways to get decent customer support are, in my experience: - The CEO is a friend of yours - Your account is so large that a significant chunk of the company depends on you for their income - You have an ironclad support contract - Regulatory requirements enforce a level of customer service Unfortunately, none of those are likely to apply to an average person looking for an email provider, and running one is usually impractical due to these large companies blocking small hosts. Next best thing is taking regular backups and having your own domain with a low TTL MX record.
      • ghaff 4y ago
  • Wildgoose 4y ago
    That's the same calculation I made. It doesn't make sense to have all of your eggs in a single basket.
• Overtonwindow 4y ago
  This reminds me, again, that I should look into setting up my own home mail server. Is there an off the shelf solution for this? I don't mind setting up another PC as a server for this, but how hard is it?
  • sodality2 4y ago
    If, perhaps, you decide against self-hosting, but still want a reasonably good solution, consider owning your domain but buying a hosted mail service. You own the MX records, so you can point it to a service and change it in the future if you need to (without fiddling with setting up a new mail host). Say you use XYZ mail provider, but they shut down for business. You can buy mail hosting from someone else within a day, and all the undelivered mail (if senders follow spec) will be delivered to the new service. And, in most cases, you can import your whole mailbox if you have it synced locally. I find this to be a good balance between privacy and not fiddling with anything at all. I thoroughly respect someone who selfhosts their mail but for me it's too crucial to worry about an update bringing it down - outsourcing it to an expert with proper fallbacks is more safe to me. I personally use migadu, $19/yr (they have a student discount as well) for unlimited domains, 200 emails in/20 out daily/5GB storage. That's the lowest plan and I don't think I've ever surpassed it (the limits are soft anyhow). I get surprisingly less actual important email than I thought. (I use my gmail for rewards cards, etc) But, to actually answer you, mailcow.email seems pretty good :)
    • ant6n 4y ago
      Is it possible to „own“ a domain? I thought domains are basically rented. If you don’t pay (or payment fails), then u lose your domain.
      • sodality2 4y ago
        Well, yes, it's something you are technically renting. There has to be a balance between cost and convenience. If there was a lifetime fee to own it, think of all the domains that would be already bought up - there'd be barely any left. However, in almost every case, there is nothing that will get your domain taken from you, unless you fail to pay or break the domain registrar's TOS (copyright infringement, etc). Far higher bar than Google's AI deeming you bad. And regarding failed payments: My registrar at least emails me 30 days in advance, will email in case of failure, and will not put the domain up for sale until after a grace period (IIRC at least a week), during which they will repeatedly attempt to contact you. Also, even if you can't own it: that's true of self-hosting also and doesn't apply to just purchasing hosting
• edent 4y ago
  Yup - happened to me. https://shkspr.mobi/blog/2015/11/the-day-google-deleted-me/ https://shkspr.mobi/blog/2015/11/the-day-google-deleted-me/ "Luckily" I had enough identity documents to prove to Google's satisfaction that I was who I said I was. But even after I recovered the account, it was all screwed up. Since then I've dropped my reliance on Google. I don't use them for sign-in, my mail gets regularly backed up, I use alternative apps where I can. Google scale only works when people and processes are infallible.
  • codegeek 4y ago
    This was related to Google+ (which is rightfully dead now). I wonder if they have something similar to recover for regular Gmail accounts. From the horror stories, doesn't seem like it.
  • bryanrasmussen 4y ago
    but there is not process or person that has ever existed that has been infallible, therefore you are arguing that Google scale does not work?
    • edent 4y ago
      That's correct. Google boasts that it doesn't do customer service because it can't scale to meet the demands of their user base. That can only work if their systems and processes never cause a user to have to go further than an FAQ page or community support. Given that Google are fallible, you end up in a situation where users' have a poor experience and cannot contact someone to resolve it.
      • davidhowlett 4y ago
        I suspect you mean infallible rather than fallible.
        • edent 4y ago
          Thanks. Corrected.
• zbrozek 4y ago
  I had an account from 2005 with a bunch of email with my high-school friends. I then made another account using my real name, which became my primary. A year or two ago I wanted to reach out to one of those old friends, and knowing that I had their email address in the contacts of that old account, tried to log in. Nope, got stuck in an infinite loop of errors and impossible security challenges. Ultimately I gave up and used another way of contacting that old friend. The experience also made me feel even better than I already did about having migrated to a domain I owned and a non-Google provider for my primary personal email. I also don't use any 'identity services' because I have no basis of trust in any of them.
• guptaneil 4y ago
  It's true that every service has to deal with the same policy and lockout problems, but that doesn't lead to the conclusion that the risk is the same. I pay for FastMail because 1. if something goes wrong, I can reach a human without needing to write a viral blog post first. Other services pay for a customer service department. 2. I trust FastMail more to not shut down their product because they got bored. Sure Gmail will probably not go away, but I'm honestly not as confident about Google Workspaces or whatever it's called now for individuals. 3. I'm tired of acting like using products from an ad company is a good idea. People happily use an email service, browser, OS, and more from the modern DoubleClick without a second thought.
  • jeffbee 4y ago
    "I can reach a human" is a huge security vuln. I don't want people social engineering my identity provider.
    • theptip 4y ago
      An extremely underrated (and insightful) point to consider. More generally, how do you actually get a measure of risk between two providers, when the absolute frequencies of measurable events are very low? It seems plausible to me that FastMail could have 10x or 100x the level of security incidents as GMail, and it would still net out to an undetectable difference in the number of public complaints. If we had internal data… but of course we don’t.
      • jeffbee 4y ago
        When I worked in the anti-abuse business, account security was tracked by lurking in organized crime fora and determining the market price for stolen accounts. I don't know what it looks like for FastMail, but I do recall that the range between good and bad platforms was huge. A stolen Google account was like $10, but stolen Yahoo! Mail accounts were more like a nickel per thousand.
        • drivebycomment 4y ago
• MarkusWandel 4y ago
  Two comments on this. 1. Merely looking at published noise may vastly underestimate the size of the problem. Lots of "normal" people including one close to me have several accounts containing parts of their life history lost for one reason or another, and just accepted it and moved on. 2. "Kids in the bath", ha. Carefully framed photo to avoid sensitive areas, taken with a tablet that happened to be handy that is not usually used for photography. Next thing I know I see them on another device. Darn thing had Google Photos with cloud sync enabled by default! Not for long, and I made sure to purge those photos from the cloud. But it can happen that easily.
  • bookofjoe 4y ago
    > Merely looking at published noise may vastly underestimate the size of the problem. Exactly so. My rule of thumb is that for every problem/complaint you hear about, there are [at least] 100x that many whose unhappy campers won't/can't bother to do anything about it.
• kfarr 4y ago
  Overall good analysis but this one quote is kinda crazy if you think about it "I put a little effort into avoiding grey areas (not filing chargebacks to Google, not taking pictures of my kids in the bath) but otherwise don't worry about this."
  • rootusrootus 4y ago
    Downright dystopian world we've created for ourselves. Don't anger your corporate overlords, and don't do anything that could even remotely be conceived as not Thinking Of The Children. Or, how to pave the path to hell.
  • bouke 4y ago
    Right!? Not being allowed to take pictures of your own kids as you might anger your land lord as they'll evict you without warning and burn all your stuff.
• deleted 4y ago
  [deleted]
• NelsonMinar 4y ago
  Chargebacks can get your Google account locked. If you have a dispute with Google and protect yourself by reversing a credit card charge, Google might lock you entirely out of your account. The Google Pixel subreddit has a bunch of people's stories about that: https://www.reddit.com/r/GooglePixel/search/?q=chargeback https://www.reddit.com/r/GooglePixel/search/?q=chargeback Not sure if this counts as "policy reason" for the article's purposes; he sort of dismisses payment disputes. I could argue either side about whether a suspension like this is reasonable. In the Google Pixel case the chargebacks mostly start because Google outsources hardware support to a bunch of unreliable third parties. Some of whom seem to eitiher lose or just be stealing customers' phones when they are sent in for repair. My takeaway was that if I was ever in a dispute over a couple of hundred bucks for Google, I would not risk a chargeback for fear of retaliation. My account is one of Google's very first, when I worked there I launched one of the first products to ever use a Google account. I have no faith that as an outsider now I'd ever get a reasonable hearing over an account dispute.
  • dspillett 4y ago
    > My takeaway was that if I was ever in a dispute over a couple of hundred bucks for Google, I would not risk a chargeback for fear of retaliation. My takeaway from that is to never spend more than a few quid (i.e. money I'd care about losing) on anything linked that directly to Google.
    • mmcgaha 4y ago
      Or get yourself a chime account or something that does not allow overdraft and put that debit card on your google account.
    • ryandrake 4y ago
      To me, a chargeback is a 'burn the bridges' moment. If a company has wronged me to the point I'm prepared to do a chargeback, then I obviously don't want anything to do with that company anymore, and I welcome them to close my account since I will never do business with them again. Why would you want to continue doing business with a company that has frustrated you to the point of doing a chargeback?
• nimbius 4y ago
  I feel like this is interesting anecdotal evidence, but its asking the wrong question: what is the risk of losing a google account. if the scope and impact of the loss is significant enough (and in most cases it poses a serious impediment) then you may wish to revisit the google offered service entirely. It is well documented that google accounts can be rescinded for any number of arbitrary reasons, and remediation is either time consuming and cumbersome or entirely impossible. There is a strong consensus forming in the tech community that core services like email or authentication should be delegated to google only as a last resort.
• jeffbee 4y ago
  I am amused by the way HN collectively expresses contradictory opinions on this topic. When presented as getting locked out of Google, a vanishingly small probability of losing access to your account, sometimes only temporarily and often through the fault of the user, is a crime against humanity. When framed as American-style "voter ID", a 15% false positive rate is just the natural price of ballot security. Maybe the sets of commenters on the two categories of articles are disjoint, but I still find it puzzling.
  • unity1001 4y ago
    With the government, you have legal recourses for anything. You can eventually get to someone to be able to recover something. You can even take them to court. With the unregulated private tyrannies that the US tech corporations have become, you have no recourse if some algorithm or someone just nukes your account in some major provider. Your history, your business contacts, even your infra may be gone in seconds. We still treat the Internet as if its mid-2000s and its still a mostly hobbyist thing with some big business doing their thing elsewhere while the plebs go about their lives in the fringes of some user-run websites and forums. Losing nothing was a problem then. But now everyone's lives, businesses & livelihoods, professional histories are hooked up to the Internet. Its no longer a hobbyist's ground. Its amazing how corporations that could kill your business within a second have gone unregulated this long. If some company holds the livelihoods of millions of people in its hands, its not a mere business - its infrastructure.
  • deleted 4y ago
    [deleted]
  • H4ZB7 4y ago
    no. whats amazing is that a bunch of people who supposedly care about such basic fundamentals like having open protocols always unanimously agree with "the company has an advanced proprietary risk analytics model to decide whether and how you get to log in. we can't talk about it because of security reasons". well, the article is just wrong but i don't feel like going into the nuances of how identity works with a bunch of zero attention span web devs but i blame UN*X for this situation by making computers too hard to use (both securely and at all) with contraptions like email and PGP. all authentication should be done with public keys. open protocols require solid foundations which include the user being security-competent. you can layer on the "poor old dumb user" stuff on top of that, for example by letting him have a 3rd party company hold his private key. but again, this article is just wrong and scoped into very specific things people like to "debate" while having no clue about the big picture. it's absurd to even imagine that the web meta (a bunch of dot com boomers who dont give a fuck about anything other than going with the flow and creating solutions looking for problems, and knee jerk solutions to current problems) represents anything about established security engineering literature
• davidelettieri 4y ago
  I find that owning the email address domain it is safe enough with any decent provider. If you get locked out just change the provider and dns configuration. Even if you are storing passwords in Google account you should be able to reset all of them since you have access to the email.
• endisneigh 4y ago
  Given the low likelihood of this happening (for Google, Fastmail, Outlook, etc.) it's really not worth thinking that much about this. My approach is to have a custom domain and forwarding to another provider. Gmail -> Outlook forwarding iCloud Photos -> OneDrive etc
  • timbit42 4y ago
    You seem to be only thinking about Gmail. What about the other Google services that would be lost? Anyone who makes their living making YouTube videos will be devastated by the loss of their YouTube account. It can also be a huge problem for those who log into other websites using their Google account.
• blfr 4y ago
  Google is too good not to roll the dice. I use Gmail in my own domain with a different registrar. Push comes to shove, I'll move, restore backups, and carry on. But damn are non-Google ecosystems bad. At work we use m365 and everything is atrocious compared to Google. Loggin in is a mess, email search is dreadful, OneNote search unhelpfully defaults to searching the current pagwe, integration with Android is weak, Outlook Calendar never seems to do what I want it to and doesn't seem to handle location in any sane way... I could go on but every time I switch to my private machine and Google-first setup, it's like a weight has been lifted.
  • ocdtrekkie 4y ago
    I would tell you that after using Fastmail, Gmail seems positively glacial and slow. Like, it's borderline "why would anyone put up with this, except maybe because they haven't used good email before". And we just got a huge fine for missing a bill here because a family Gmail account spam-binned it, which isn't an issue for my Fastmail, which handles spam better.
    • blfr 4y ago
      It could be a little faster, maybe, but with good indicators of things happening under the hood, which Google offers, reliable results, and the daily comparison to m365, I have no complaints. And really, the only faster email setup I have ever used was mutt right on the MTA. I haven't used Fastmail but ProtonMail (my backup choice due to their combo mail+VPN+drive offer) certainly doesn't feel faster than Google.
    • creata 4y ago
      > which isn't an issue for my Fastmail, which handles spam better. That's interesting, can you expand on this?
      • ocdtrekkie 4y ago
        My Fastmail account receives, at most, a handful of spam emails a week. And Fastmail uses a personal spam filter heavily weighted off your own mail and reported spam as opposed to the whole world's emails. Obviously it has weighting rules that are easily understandable and readable in the headers, but my own trained filter has a really strong impact on the spam score. Whereas I find Gmail both often misclassifies legitimate mail as spam, and fails to catch obvious spam, the biggest issue is it rarely is fixable by my actions, because it's mostly based on Gmail-as-a-whole's perspective on spam. My Gmail is also receives an absolute deluge of junk even though I haven't used it as my primary mail since 2016. I have a somewhat short Gmail address and I strongly suspect it gets dictionary-spammed because the server name is a given, it also gets signed up to random things I never signed up for (including the NRA and Shutterstock, both of whom I had to contact and ask to remove me).
• armchairhacker 4y ago
  > For example, in HN discussions people will often recommend Fastmail or Protonmail, but they've had their problems too (FM: 2017, 2020, 2022, PM: 2018, 2019, 2021). I think this is a bit dismissive of Fastmail: in all three of the linked reports (2017, 2020, and 2022) Fastmail has apologized and reinstated the account or provided some other mitigation. Nobody is perfect, any service will have bugs causing lockouts and false-positive fraud claims. But what makes Google untrustworthy is that they don't seem to have any recourse if you are caught in a mess. To the point where engineers in other Google departments can't get human support, and the linked case which made mainstream news did not get his account back despite being proven beyond-doubt innocent. A good service can make some mistakes, what differentiates them from a bad service that they attempt to correct them. Like how a good company can do layoffs if they provide good severance and also cut top executives' pay.
  • jefftk 4y ago
    In cases where someone was able to get their Google account back only after taking their case public (ex: [1][2]) I'm still counting this as a lockout, under the assumption that if they hadn't been able to draw attention to the situation they would have been stuck. Are the Fastmail cases different, or was taking it public and getting noticed a necessary part of the resolution process? [1] https://techcrunch.com/2017/12/22/that-time-i-got-locked-out-of-my-google-account-for-a-month/ https://techcrunch.com/2017/12/22/that-time-i-got-locked-out... [2] https://news.ycombinator.com/item?id=2794529 https://news.ycombinator.com/item?id=2794529
  • ProAm 4y ago
    > Nobody is perfect, any service will have bugs causing lockouts and false-positive fraud claims The HUGE difference is both Fastmail and I assume Protonmail (I only have personal experience with FM) actually have customer service departments, with real people.
• OmarAssadi 4y ago
  I had already begun using my own domain for emails by the time it happened to me, but nothing accelerated that process faster than getting locked out of my Google account. I was lucky it wasn't permanent in my case, at least, but it was a wake up call that I really cannot trust them. For me, it all happened because I tried to purchase, of all things, Minecraft from the Google Play store and typed my CVV in wrong a couple of times. That locked me out of my email and all Google services for about three days while they did some sort of fraud verification. While, yes, things can happen to FastMail, etc, the likelihood of having my domain stolen from my registrar (which is very possible) is a lot lower than something happening to my Google account. And, god forbid it did happen, in my experience, getting in contact with a human at a domain registrar is easier than getting in contact with a human at Google.
• ckemere 4y ago
  Has anyone else had trouble with Google takeout? I tried to download my GMail history and it just failed with no extra info. (I made a post about this that didn't get any traction... https://news.ycombinator.com/item?id=34456459 https://news.ycombinator.com/item?id=34456459)
  • userOuterSpace 4y ago
    In my experience, you need to have been logged in on a particular device for 7 straight days before Google will let you use Takeout.
• dr_kiszonka 4y ago
  It is about the expected value, and not the likelihood alone. For some of us, the expected value is so much in the red that using Gmail is not worth it.
• unixhero 4y ago
  I have decided to multiplu Cloud services by 2. So I also use Microsoft 365, onedrive and Outlook. It feels more solid than Google nowadays anyways.
  • timbit42 4y ago
    Just last week someone called my shop saying they couldn't get into their Outlook.com account. They had a backup email and had a code sent to it but Outlook.com said the code was bad. I told them to look into FastMail, preferably with their own domain name. It's not free but it's inexpensive and you can contact someone if there is a problem, and worst case, you can re-point your domain. Mailbox.org is another option.
    • unixhero 4y ago
      I like getting an Office license wand functionnality with my email.
• DontchaKnowit 4y ago
  If anyone can help woththis,please reach out : My father owns a business that has been family owned and operated by my grandpa and my father for nearly 50 years. The name of the business contaibs our last name. The google street view of the business is my fathers home. Recently my fathers domain registration lapsed and someone bought the domain. We changed the website to a different address and went to change the google listing for his business only to find that someone had also claimed the business. We have tried requesting ownership, we filed a formal 3rd party dispute, and we have requested a domain change. Through all of this we have just been completely ignored by google. I cannot figure out for the life of me how to get someone from google to help us verify his ownership of the business. Its had a real impact on how many calls he's getting for work and has created financual hardship for my parents and there is seemingly nothing we can do about it. If anyones been through this or something similar and has advice please leave a comment. Any help is greatly appreciated.
  • deintumi 4y ago
    Can you share the domain?
    • DontchaKnowit 4y ago
      Well since it involves my last name and former home address unfortunately I cannot without doxxing the shit out of myself
• trinsic2 4y ago
  > Even if the risk is low, however, maybe it would still be better to switch to something else that is even lower risk? The problem is that security and policy lockouts are something you can find with any service. For example, in HN discussions people will often recommend Fastmail or Protonmail, but they've had their problems too (FM: 2017, 2020, 2022, PM: 2018, 2019, 2021). Especially given that these are much smaller services I'm not convinced that the risk is lower there. Any system is going to have to handle this sort of problem, and you're not going to find one that never has false positives. Good breakdown for this person's use case. I disagree with the conclusion above though. My experience (as a person who handles technical support around these issues, for customers of Gmail and more specifically ATT/Yahoo/SBCGlobal) is that many people that get locked out of their accounts do not understand all the options available to them to regain access. Also it appears, to me, that at least for Fastmail, their security protocols are a bit more friendly, less strict about how the security is applied (I.E not spamming customers to use the security methods, changing the methods willy/nilly without warning). Also Fastmail sends an email to your mail email account if you accidentally trying to use your main account password in an app specific use-case, I.E makes it easier to understand how the security measures are being applied. Also the security measures implemented by providers that you pay for, appear to me, to be designed to be customer centric, rather than trying to create a blanket one size fits all approach to security that I feel google tries to implement (because they have so many customers). My meaning about this is that the control of the security options appear, to me, to be more in the hands of the customer to implement how they see fit, where as google security measures appear to be implemented from a cover our assess approach and not really designed for the customer per say.
• gspencley 4y ago
  > The problem is that security and policy lockouts are something you can find with any service. This is one of the reasons I don't like or trust SaaS as an end-user, at least for critical failure points. It's not just about policy lockouts; the company can go out of business or get sold and the product shut down. Data leaks and breaches can be a greater risk since you're too small to target as an individual but all users collectively is another story. Outages, both locally and service-level, can prevent you from having access to your data when you absolutely need it (doctor or legal appointment etc.). Oh and they will track you, make you a perpetual guinea pig for A/B testing purposes and can change critical features that you depend on at any time of their choosing without notice. There are trade-offs in the other direction, like the mobility and the convenience to access data across multiple devices. For historically expensive products (like Photoshop and Pro Tools), subscription based models make services more accessible. It's just too bad that we can't seem to land on the best of both worlds as the common case. I'd like a subscription model and the ability to sync data across devices automatically (preferably using e2e encryption) without the software being at all "web based."
• layer8 4y ago
  Using your own domain with a well-reputed registrar is the way to go IMO. It makes you independent of the email provider used. Registrars don’t run algorithms to lock out domain owners. You can also move between registrars when needed. Domains can be locked ("Client Transfer Prohibited") and set to auto-renew, which nowadays is the default. You can have an actual paper trail proving your domain ownership. Depending on jurisdiction, you have certain rights associated with your domain.
  • bookofjoe 4y ago
    For the 99+% of us who aren't computer savvy, "using your own domain with a well-reputed registrar..." is as achievable as suddenly speaking Sanskrit. Think outside the echo chamber.
    • layer8 4y ago
      While my recommendation was targeting the HN crowd, where I assume some level of computer savviness, buying a domain doesn’t require technical expertise. Wiring it up with an email provider may require some, although providers often provide good instructions, and, more pertinently, you can also buy this as a service, or have a friend or family member take care of it. The important part is that you own the domain. I fully agree that it should be made easier. But people have to create the demand for that to improve.
      • bookofjoe 4y ago
        >... buying a domain doesn’t require technical expertise. I respectfully disagree. I succeeded in buying my own domain but it was a VERY painful, confusing, and disagreeable experience, which I wouldn't recommend to anyone who's not amongst the HN techie crowd.
        • brewdad 4y ago
          When I bought my domain, granted a decade ago when there were fewer TLDs, it was a typical search bar. Then click Buy then enter payment and user info. It wasn't any more difficult than any other online purchase. The config/DNS steps require a certain level of techiness but buying the domain, the key step, was easy.
• aktuel 4y ago
  What is usually not mentioned is that enabling two factor authentication is a mayor reason for people getting locked out of their accounts.
  • Linux-Fan 4y ago
    Actually, in my experience it can also bite the other way around: I was locked out of my Google account after using it in Italy and coming back to Germany. Unable to login: It would first ask username, password, then send me an a-mail, then ask for the code from the e-mail (which I provided) and then either tell me to enter a phone number (Google is not going to get it from me!) or alternatively: “You're trying to sign in on a device Google doesn't recognize, and we don't have enough information to verify that it's you. For your protection, you can't sign in here right now.” If that isn't dystopian. I interpreted the phone number requirement as a signal that “had I setup 2FA, it would not have asked for the phone number but maybe just the second factor?”. Then I went on an odyssey to setup a Google account without linking it to a phone and with 2FA enabled (also not linked to a phone!). Seems OK so far, but the procedure is highly complicated and partially luck-dependent. I am probably going to publish it, because there are tons of articles about how to setup Google account without phone number, but none of them worked for me at the time :) I still do not rely on Google for anything but the search engine which still works without any login...
    • ridgered4 4y ago
      > I interpreted the phone number requirement as a signal that “had I setup 2FA, it would not have asked for the phone number but maybe just the second factor?”. Then I went on an odyssey to setup a Google account without linking it to a phone and with 2FA enabled (also not linked to a phone!). Seems OK so far, but the procedure is highly complicated and partially luck-dependent. I am probably going to publish it, because there are tons of articles about how to setup Google account without phone number, but none of them worked for me at the time :) I'd be interested, even if it was just a rough guide. My experience has been that some services apparently let you sign up without a phone number, but then try to extort it out of you either at first login (or worse) after you've used the service for awhile. I've noticed some of my own old accounts (not google anyway) seem to be grandfathered in and do not have a hard requirement here.
• weird-eye-issue 4y ago
  There is a lot of bias at play here. You only hear about the newsworthy lockouts because they are in the news. You don't hear about lockouts that didn't hit the news because, well, they didn't go viral. But they still got locked out...
• fencepost 4y ago
  This doesn't mention what I think is the most egregious example of Google account risk - viewers of Markiplier's YouTube live stream getting mass banned. That included access to Gmail accounts from some reporting at the time (https://gamerant.com/markiplier-stream-ban-lock-users-out-of-gmail/ https://gamerant.com/markiplier-stream-ban-lock-users-out-of...). Combine that with automoderation and you have a recipe for people with no recourse getting hammered. At least when Nick (Trainer Tips) got algorithmically terminated for talking about "CP" in Pokémon Go he was prominent enough to get attention, but what if it happened to some no-name with 100 subscribers? (https://www.reddit.com/r/youtube/comments/armac3/youtube_just_terminated_trainer_tips_nicks/ https://www.reddit.com/r/youtube/comments/armac3/youtube_jus...) And haven't there been cases where developers who'd had accounts banned in the past got hired somewhere and ended up with an employer dev account linked to the banned personal account and also locked? And of course there's the whole question of phones - banned from Google and the entire Android ecosystem? Not like Google can't figure it out if you create a new account with the same phone number and geolocation.
  • crazygringo 4y ago
    I'd never heard of that, but it doesn't appear anyone was banned for viewing a stream. Rather, accounts were banned because he asked people to vote via comments using just single emojis, and the repetitive emoji comments were classified as spamming, so accounts were blocked for spamming. Once Google recognized the error of over-aggressive spam classification, it reinstated all the accounts. [1] [1] https://www.engadget.com/2019-11-10-youtube-reinstates-banned-markiplier-fan-accounts.html https://www.engadget.com/2019-11-10-youtube-reinstates-banne...
    • mort96 4y ago
      Even if those comments had truly been spam, it's horrifying that you can get your whole e-mail address locked simply for spamming in a live stream. Having your Google account locked is tantamount to being locked out of your entire digital life for most people, and the fact that Google doesn't take that seriously would have been criminal negligence in any just world.
    • 4y ago
• progx 4y ago
  It is not really a good idea to give one of the important things in the hand of google. Choose a local provider, even it cost more, in case of whatever, you can talk to them.
• jb1991 4y ago
  I was once (not long ago) locked out of a Gmail account until I used a VPN to login from the last country I lived and had used the account, then it promptly let me in. But otherwise there was nothing at all I could do to login, as it claimed it wasn't sure I was who I am. Considering how often people move between countries, this surprised me.
• suhastech 4y ago
  I lost my Google account almost a decade ago. After that, I make sure I have 3 things: - Email on my own domain - Ideally self host - Make sure you have backups I wrote an application to help with the last part: https://thehorcrux.com/about/ https://thehorcrux.com/about/
• alexlehm 4y ago
  I have lost other email accounts before like a Yahoo account or a AOL account since I used them only very sparingly, but I have not lost my Gmail account since I created it in 2004
• drsopp 4y ago
  I, on the other hand, have the opposite problem. I want google to delete my old unused Workspace with gmail, as I moved to Protonmail. I tried to figure out how to get rid of it but have up. After a while I got emails from Google saying "x days remaining to set up billing for Google Workspace Business Starter", and "You have until this and this date to set up your billing information, after which your subscription will be suspended", and I thought, "Make my day!". This counter has reset at least 5 times now...
• emurray 4y ago
  There's another way to "lose" accounts that's a bit more likely depending on your circumstances. I had set up a google account for my kid, so we could lock down the old tablet we let him poke at. I was happy that I had managed to get him his firstname.lastname gmail address in the process. However recently the family moved to a new country. This basically isn't something google lets you do with a family group, and until you change your play store country, your play store won't have the local variants of a lot of apps, so you can't install them. You have to delete your family group, change country then recreate it. But you can't delete a family group with a child account. The only thing you can do is delete the child account. The help docs mention being able to restore it, but that didn't work, it just said it couldn't be restored. And since google doesn't allow an email address to ever be recycled once it's deleted, I forever locked my kid out of possibly having his firstname.lastname gmail address. Very frustrating.
• mortigi 4y ago
  This isn't limited to Google. I had a paid for Hotmail account back in the day, someone attacked a domain I held, and as part of that sent multiple abuse reports to every tech provider I used. My Hotmail was listed on the whois - Microsoft removed the email account, didn't refund and provided no human support that I could get a hold of to get the wrongful termination looked at. It was a nightmare and a good reminder that an attacker with sufficient resources can create more issues than you can possibly dig yourself out of.
• meindnoch 4y ago
  "On a long enough timeline, the survival rate for everyone drops to zero."
• prima-facie 4y ago
  This boils down to not having all your eggs in one basket. Instead of relying on Google to provide all these services you could split them up between different parties. These parties will often do a better job for their speciality. I found that migrating and managing my credentials with Bitwarden has brought a lot of clarity and independence. I can now use these credentials with any browser, any mobile platform, and desktop platform. If I ever need to migrate away from Bitwarden I have the credentials periodically backed-up in JSON format, so they can be transformed into any other format. Not logging in with Google SSO everywhere and relying on plain old username + password credentials wherever possible (+2fa for important stuff) has also been very liberating. Using a good password manager makes this trivial. Same with email, having your own domain means you can switch providers in an hour or so if something bad happens. It's also worth keeping a backup of all emails in a common format like Maildir; so they can be restored to the new provider even if you lose access to the old account. Which brings me to the last point which you've probably figured out by now - backups. Keep backups of everything locally + somewhere remote if you can. Backup emails, google drive contents, google photos, contacts, email filters, etc. Everything! B2 or S3-compatible storage is cheap.
• hnbear 4y ago
  Really assessing likelihood is just part of a larger risk assessment how you manage, store, and backup your data It's worth segregating out the risk here into: - What can easily be backed up and restored (eg. email, calendars), and so loss of access is easy to tolerate Email, Calendars, etc can generally be dumped pretty easily using LDAP, CalDAV, whatever in a cronjob and saved locally. Drive data can obviously be synced off too. The value here is pretty low and it's pretty easy to do. - The value of the email address itself (ie. if you need to go change a hundred accounts using it for signing in vs just change the MX record and send to a different provider) This is the argument for a custom domain that you own with a different register, and have different DNS hosting, so you can keep it segregated and send email anywhere. You could move to Apple, Fastmail, etc with a custom domain pretty quickly. Some sites will also send you an email to both old and new email and require hitting links you might not have access to if you lost email, or use email for 2FA. eg. Steam using SteamGuard which is all email based. Losing a large Steam library after losing a Gmail account would be horrible. - The value of other account using federated GSuite sign-in. It's horrible to lose Google, but then also lose all the sites using it. A strong argument not to use federated accounts and always use email/password (2FA obvs). 1Pass FTW. None the above advocates for a specific provider, but personally I'm a fan of Fastmail. Not only because it's ad-free and paid for, but also because they advocate for stronger privacy practices, eg. random emails for accounts in partnership with 1Pass. I know you can use + addressing in Gmail but some providers and spammers detect and handle it. Truly random forwarding Ala Apple and Fastmail is better. Although, also, harder to move away from as you can't redirect those. I use Fastmail's domain and user forwarding. eg. service@service.mydomain.com forwards to my personal email.
• dhosek 4y ago
  I had Google take away a blogspot account from me, claiming it was spam. The people who stole the name from me used it for—spam. Anything digital and online can be arbitrarily taken from you with no recourse.
• Zamicol 4y ago
  Bankless was talking about that this past week with sign-in with Ethereum: https://www.youtube.com/watch?v=VHwzE6mVm_s https://www.youtube.com/watch?v=VHwzE6mVm_s Separate from any blockchain project, we're using public key auth for account authentication, so our site doesn't have the ability to cancel someone's account for third parties.
• parasubvert 4y ago
  A popular reviewer in the headphone/IEM audiophile community, Crinacle, had lost his Google account in early 2022, and thus his 100k+ subscriber Youtube channel. It was locked, with no explanation, and no recourse other than an appeal (that went unanswered afaik). Curiously, his old Youtube channel stayed up for most of the year, he just couldn't access it, but it was removed too late last year. He created a new account and rebuilt his following, here's the original video when he lost his account: https://www.youtube.com/watch?v=Jn1b3DztWnc https://www.youtube.com/watch?v=Jn1b3DztWnc The biggest issue to me is that Google has a history of not caring about customer service, or any sort of human touch to handle fuzzy situations the algorithms get wrong.
  • donmcronald 4y ago
    This is the biggest issue. It's not a loss of a single service, but multiple services that are all linked to that account. It's bad enough when it's all of your Google or Microsoft or Apple services, but it's going to get worse. I'm convinced the whole passwordless movement isn't much more than a strategy for big tech to completely usurp control of identity. People on Hacker News might not get trapped because they understand enough to have some contingencies, but the average person is going to end up with their identity completely depending on having access to an account at one of the big tech companies. Just wait until they lobby the government and get "Passwordless Login" pushed as a preferred way to access government services. Then they own us.
    • parasubvert 4y ago
      Consolidated identity and delegated authentication isn’t a conspiracy, it’s a customer driven and infosec driven feature. Managing your own passwords across sites and devices is widely considered to be a security failure with easily guessed reused passwords written in sticky notes or a notebook by the computer or in text files / spreadsheets on that computer. And governments globally are already doing their own SSO services (the UK has had a version of this for 20 years) and some (Canada) are enabling partnerships with what they feel to be more secure sources of identity eg. online banking. I think the fundamental problem with Google is that their policies are inscrutable. I wouldn’t rely on any one identity provider for everything I either, and would expect all services have a recourse for resetting your login settings when a particular provider no longer works for you.
• cycomanic 4y ago
  Many people here don't seem to realized how stupid Googles algorithms are. I mean I use 2FA with a security key and still get warnings about having locked into the account from another computer. On the other hand logins from my phone protected by a much weaker 6 number pin are never questioned.
• nitwit005 4y ago
  This is in denial about how humans work. Everyone makes mistakes. Given enough time, you will do something like get a new phone and fail to update your security settings. And importantly, Google will change things on you. When I set up my account, all there was was a password. They forced everyone to fill in telephone information or two factor, which is a new unfamiliar security practice, leading to more mistakes.
• _tom_ 4y ago
  I got locked out of an account and it would not allow me to recover the account, even though it had a recovery email on file. They didn't think that was enough to prove I owned the account. What's the purpose of a recovery account, if you can't recover with it? Fair disclosure: I'm not sure why I lost access to the account, but I had been planning on changing the password. There's a non-zero chance this was self inflicted. But it should have been recoverable.
• bcatanzaro 4y ago
  So if it's unlikely to lose a Google account due to bad policies, why can't Google afford a proper ombudsman-led process for arbitration?
• ugjka 4y ago
  The crucial point is to get your mail off Google, everything else can suffer
• keskival 4y ago
  Regarding security lock-outs, many countries have national strong identity systems set up, and Google or any other "root" identity provider could utilize those.
• makach 4y ago
  yes.
• popotamonga 4y ago
  i bet google could charge 1k/yr and have thousands of paying customer. I would.
  • tiborsaas 4y ago
    Google one is available: https://one.google.com/about/plans https://one.google.com/about/plans
  • dredmorbius 4y ago
    By charging nothing, Google have billions of paying customers. Requiring a charge would permit upstarts to undercut that fee by other means (e.g., advertising, otherwise selling influence, data gathering to compete with Google or other firms in the area of AI, etc., etc.).
• anonymous344 4y ago
  my customer had a corrupted gmail account that took google about 3 weeks to fix. he could not login for 3 weeks, it was quite a bad but what saved the situation was that hes ipad email was still logged in and working. after google did som fixing, the login started working
• sva_ 4y ago
  It's kind of ironic, the US is often famed for having a great service sector (Germans love to say that we're comparably a "service desert"). Yet all these big tech companies have abysmal customer service. I wonder at what point exactly this disconnect appears.
  • JohnFen 4y ago
    That point is the point when a company feels like it can make an acceptable amount of money without worrying about satisfying customers. It's often a sign that the company is effectively a monopoly that people feel they have no option but to use.
• anderspitman 4y ago
  We need a Let's Encrypt for identity. A nonprofit that does nothing except provide social login without mining your data. It's wild that the de facto identity provider of the planet is an advertising company.
• dmje 4y ago
  I'm not convinced there's a problem but only as long as you own your own domain. Using gmail (as in blah@gmail.com) is potentially dangerous, either from "Google decided to lock you out of your account" to "Google has started charging $X a month [more than you can afford] for Gmail". I was an early Gmail adopter, and have hundreds of logins that use my gmail address. I'm now in the process of getting sensible and moving all my logins across to a domain I own. It's still using Google (as in Gmail / workspace) - the free edition - but once I'm done I won't be beholden to Google if there's a lockout or whatever. Pain in the ass though it'd be to move mail servers and to lose my archive (well, any bits I haven't downloaded / synced via IMAP), I'll be in a much better position to Do Things if I can just repoint the domain to Some New Email Service in the future. It's a pain, but I'm doing it. Slowly.
  • rocky1138 4y ago
    I did this a few years ago. It wasn't too bad and I'm happy I did it. I moved providers, too.
• dirtyid 4y ago
  Since last summer, I have two seperate Youtube PREMIUM accounts blocked for spam and deceptive practices, community violations for content makers. These accounts only view videos, doesn't even comment. Banned youtube account can't even access billing page to cancel, so Google's been robbing me every month until I change credit card no. Since then I've had two more new accounts banned. I don't know what's triggering these bans, but they happen every 3-4 months on a weekend so something is happening to just my hardware but not others in the house. I'm still holding out for appeal process which can be done ever 2 weeks. But so far pattern seems to be automatic rejection. Also have Google One which should get you live person support, but they basically forwarded me to Youtube support who said they were not trained to resolve issue. lol. Only saving grace is I could take out all my data and intially even that wasn't possible on my main 10+ year old account for some reason. I guess my point is, even if chance of losing account is low, chance of recovering account is even lower. For reference I've ranted about knowing people who lost Chinese social media access but actually got accounts retored by a person after submitting insincere self criticism. It's not ideal but still much more functional experience than what I'm going through with Google.
• sinoue 4y ago
  Don't use single platform sign ons. I used Twitter login for several online services and when my Twitter account got banned for arguing with covidiots it locked me out of all the accounts I used to use Twitter's sign on for. It took 3 months of appeals to get my Twitter account restored so that I could then access the other services. Never again! Don't make my mistake. Use individual account logins with their own passwords so that getting locked out doesn't take everything else with it.
• dredmorbius 4y ago
  As a research methodology, this article ... leaves much to be desired: To get a sense of how common lockouts are and how they happen I looked through lockout reports on Hacker News by searching for [google blocked account] and [google locked out]. I looked at top-level stories and the comments on them for cases where people were entirely locked out of an account... If the goal is to determine some noted classes of account lock-out, then this method might have some merits. It utterly fails however to satisfy answering the headline question itself, that is "how likely is losing a Google account?" For that case ... you'd need to have some insights into overall Google account creation and destruction, as well as some way of validating outside of Google's own accounts-adjudication process both how and why accounts were locked. I've had some very rough connection with this by way of looking into statistics concerning Google+ over the years. Given that for a substantial portion of its life, Google were creating accounts on its little-lamented social service for every Google account (Gmail, YouTube, and most especially Android), there were a lot of accounts. About 2.2 billion when I ran the numbers, hitting a high-water mark of about 3--4 billion accounts. (Again, not active users, for the most part, but registered users.) I'd measured members and a few other characteristics both in 2015, when the site was still fairly vibrant, and in 2018/2019 after its shutdown was announced. Among other observations, I noticed that highly active members were among the most likely to not have a valid account when checked later. In particular, I'd found a list of popular profiles and Communities, and found that a large fraction of these were no longer visible at all on the system. That is, one of the highest signifiers for "account will not exist in future" is "account is presently highly active". I've speculated as to why this is, though I don't know what the specific mechanisms were. Among the options, comparing highly active accounts with little-used or unused ones: - Highly-active accounts are more likely to cross some red line or trip some automated, or crowdsourced, flagging mechanism. - Highly-active members are more likely to become discouraged with the platform itself. (That was certainly my own experience, though I never fully deleted my account.) As to the question raised by TFA: I've been locked out of several Google accounts, though I've succeeded in recovering the ones I cared about. As a result of those events, however, I've also all but entirely curtailed my use of any authenticated Google services.
• __warlord__ 4y ago
  I have a question. All my domains are registered in google domains, if my account gets locked... will those domains also be locked? Also, which domain register would you recommend besides google domains? BTW: google domains is the only service I currenly use with a google account.
  • timbit42 4y ago
    I don't know whether your domains would be locked but it's possible so I wouldn't take the chance. Any registrar where you can call or email someone and get a response would be better than Google. A lot of people recommend NameCheap. I don't recommend GoDaddy at all as their UI is full of traps and pitfalls to trick you into buying additional services.
• SebastianKra 4y ago
  > After going through these, it seems to me that the likelihood of a security lockout is low enough not to worry about [...] I disagree. I've managed to get locked out twice now. The first time I have no idea what happened. Google just disregarded the correctly completed email-verification and security questions and just said "no". I retried a month later and was able to log in. The second time, I logged in from an university-owned Android phone. Despite not even being an admin on that phone, Google decided that it would now be my only permitted 2FA method, and so, when I tried to log in away from university, I was locked out.
• FrontierPsych 4y ago
  I just lost mine a few months ago. I used to just log on. I guess at one point, I gave them my mobile phone number. I no longer have that phone or phone number. So now, google keeps sending a security code to that phone number, which I no longer own. There's no way to put in a new mobile, but I don't want to do that anymore, anyways. Nobody gets my personal info if I so choose, and for google, I so choose - they are not getting shit from me if I can help it. They also ask for a backup code, which I am positive I never had one of those for my google account. They never asked for security questions, I always have those copied if they do. So I'm locked out of my google account. My new email provider only requires a password. That's what I want. Plus, as far as email goes, Google or Yahoo or any of those commercial providers can scan through all your email. People would not put up with this if someone scanned their personal mail that came into their physical mailbox, but for some reason, it is ok if google, the largest information gathering company on the face of the earth, gathers all their data and sells it to the highest bidder. Nobody would allow this on physical mail. So now all my email goes to tutanota, who don't do this. If they did, fine, I know how the world works, but word would get out sooner or later and they would destroy their business. I'd certainly go somewhere else and they would lose my monthly income stream. I pay for email.