3 ms·

You shouldn't trust Google cloud because they'll leave you hanging out to dry. You can get yourself into a situation where your account is locked and nobody at

You shouldn't trust Google cloud because they'll leave you hanging out to dry. You can get yourself into a situation where your account is locked and nobody at Google will help you get back into your account. Even if you spend tens of thousands a month. There's no way to escalate your way to a resolution with a normal human being, because they care more about what they spend on support than the customer. AWS would never do that. However, risk based security isn't the problem. Risk based security has been implemented by every major company (interested in security for its users) for the last 15 years. It has nothing to do with whether you'll be locked out of an account without recourse or whether there are alternative ways for you to log in. I used to maintain those systems using middleware. Properly implemented, they're only an inconvenience to a tiny subset of users that constantly use new devices from new locations without 2FA. And you can turn them off for specific users, add an alternative authentication method/criteria, or even fine tune the sensors. Google's implementation is crap, and the lack of support is dangerous. But risk based security is fine.

robertlagrant 4y ago
People do get support from Google. Can you give a bit more detail about what happened? Also, I agree about risk-based security: it's coming everywhere.
tapoxi 4y ago
This seems...wrong? I spend tens of thousands a month on GCP. If we were somehow locked out I would immediately raise hell with my account manager. Who is spending that kind of money and doesn't have one?
- htrp 4y ago
  You wouldn't be able to contact your account manager as your google account would be suspended and emailing from another address wouldn't elicit any response (even if you could remember your account ID/contact info). Hopefully you have an iPhone because if you're on android, your phone wouldn't even work.
  - tapoxi 4y ago
    Thinking out loud from a DR perspective, I would directly call or email my account manager. Issues like that are direct contact, you don't go through a central support system. Worse case scenario, if my Workspace account is somehow locked, that would only impact the work profile on my Android phone. If I somehow lost access to his phone number, I have him on LinkedIn. If all of those fail, I would contact the Google office he works out of.
    - throwawaaarrgh 4y ago
      Try asking your account manager to get you into a Google Workspaces account you can't verify the challenge questions to and don't have admin access to, even though it's literally linked to the domain that you own and control in GCP. They just send you to support and support can't help you. They don't need our business apparently.
aabhay 4y ago
Same exact thing has happened to us. Real company, real customers. Locked out of account entirely for 4 days with no response from the team, no apology, no explanation. Buyer beware. We’re planning on migrating to AWS once we can get a confirmed allocation of H100 GPUs (springtime) for our DL stack.
hlandau 4y ago
Author here. The fact that 'every major company' has implemented risk based security doesn't automatically make it a good or sensible thing. I'm against the premise of nondeterministic login processes in general, not just for Google. I will also say that the idea of detecting users which login from "new devices" is nonsense, at least if you're talking about a webapp. There is no such thing as a "device" as far as the web is concerned, in fact massive amounts of effort are invested into web browsers and web standards to try and prevent any kind of fingerprinting. The web platform very intentionally does not give webapps any way to identify or remember a "device". So what "you're logging in from a new device" actually amounts to is, "you deleted the permanent cookie we tried to set". Which in my case always happens because I have cookies set to be deleted the instant the last tab from a given origin is closed. Sure enough, these sites doing this irritating 'new device' authentication incorrectly think I'm logging in from a 'new device' all the time. Reminds me of cookie popups that ironically can't be disabled when a user has cookies disabled because they use cookies to remember that they've been shown. In both cases the user is penalised for being proactive with their own privacy.
- skybrian 4y ago
  You're logging in so they know who you are, but you refuse to keep a cookie in your browser so they won't know who you are? You know what the problem is, you just refuse to fix it.
  - photon12 4y ago
    A user agent that refreshes parts of its profile at the end of a session and deletes data, hopefully, should be something a company like Google can pick up on after enough attempts. "We can't expect the nonexistence of a persistent cookie means the user is using a new user agent because of a persistent history of successful authentication attempts without such cookie present" is not a tall order for a company like Google who is running these experiments on their users. It is odd you are pathologizing what I would expect to be normal behavior. It's not common behavior, but it doesn't seem abnormal for user agents to do this. Edit: for users who only access their Google accounts via shared machines like at a public library, not having a persistent cookie on every auth attempt is going to be the expected scenario.

robertlagrant 4y ago

People do get support from Google. Can you give a bit more detail about what happened? Also, I agree about risk-based security: it's coming everywhere.

tapoxi 4y ago

This seems...wrong? I spend tens of thousands a month on GCP. If we were somehow locked out I would immediately raise hell with my account manager. Who is spending that kind of money and doesn't have one?

htrp 4y ago
You wouldn't be able to contact your account manager as your google account would be suspended and emailing from another address wouldn't elicit any response (even if you could remember your account ID/contact info). Hopefully you have an iPhone because if you're on android, your phone wouldn't even work.
- tapoxi 4y ago
  Thinking out loud from a DR perspective, I would directly call or email my account manager. Issues like that are direct contact, you don't go through a central support system. Worse case scenario, if my Workspace account is somehow locked, that would only impact the work profile on my Android phone. If I somehow lost access to his phone number, I have him on LinkedIn. If all of those fail, I would contact the Google office he works out of.
  - throwawaaarrgh 4y ago
    Try asking your account manager to get you into a Google Workspaces account you can't verify the challenge questions to and don't have admin access to, even though it's literally linked to the domain that you own and control in GCP. They just send you to support and support can't help you. They don't need our business apparently.

aabhay 4y ago

Same exact thing has happened to us. Real company, real customers. Locked out of account entirely for 4 days with no response from the team, no apology, no explanation. Buyer beware. We’re planning on migrating to AWS once we can get a confirmed allocation of H100 GPUs (springtime) for our DL stack.

hlandau 4y ago

Author here. The fact that 'every major company' has implemented risk based security doesn't automatically make it a good or sensible thing. I'm against the premise of nondeterministic login processes in general, not just for Google. I will also say that the idea of detecting users which login from "new devices" is nonsense, at least if you're talking about a webapp. There is no such thing as a "device" as far as the web is concerned, in fact massive amounts of effort are invested into web browsers and web standards to try and prevent any kind of fingerprinting. The web platform very intentionally does not give webapps any way to identify or remember a "device". So what "you're logging in from a new device" actually amounts to is, "you deleted the permanent cookie we tried to set". Which in my case always happens because I have cookies set to be deleted the instant the last tab from a given origin is closed. Sure enough, these sites doing this irritating 'new device' authentication incorrectly think I'm logging in from a 'new device' all the time. Reminds me of cookie popups that ironically can't be disabled when a user has cookies disabled because they use cookies to remember that they've been shown. In both cases the user is penalised for being proactive with their own privacy.

skybrian 4y ago
You're logging in so they know who you are, but you refuse to keep a cookie in your browser so they won't know who you are? You know what the problem is, you just refuse to fix it.
- photon12 4y ago
  A user agent that refreshes parts of its profile at the end of a session and deletes data, hopefully, should be something a company like Google can pick up on after enough attempts. "We can't expect the nonexistence of a persistent cookie means the user is using a new user agent because of a persistent history of successful authentication attempts without such cookie present" is not a tall order for a company like Google who is running these experiments on their users. It is odd you are pathologizing what I would expect to be normal behavior. It's not common behavior, but it doesn't seem abnormal for user agents to do this. Edit: for users who only access their Google accounts via shared machines like at a public library, not having a persistent cookie on every auth attempt is going to be the expected scenario.