5 ms·

Could they just...stop locking us out of our accounts? For some reason, even knowing the password, being on a device+network combination I've used a dozen times

by franga2000 3y ago

Could they just...stop locking us out of our accounts? For some reason, even knowing the password, being on a device+network combination I've used a dozen times before and entering a login code generated on an already-logged-in device still isn't enough to prove my right to use the account these days...

hsbauauvhabzb 3y ago
I think there’s a functional bug with very early (2006) accounts due to MFA or something. Good thing google has a high quality help desk to report bugs /s
- londons_explore 3y ago
  I think if they have ever seen your account password in any password dump/leak (ie. if you reused the password elsewhere), then they effectively prevent password login. You have to have another already-active session. Makes sense really.
  - sodality2 3y ago
    It would make more sense to inform the user this, then enforce these checks until the user changes it. Anecdotally, my Google account's password has never been in any dump (password manager, very long random alphanumeric, changes every 6 months) and I too deal with these annoying prompts.
  - hsbauauvhabzb 3y ago
    In my case, the workflow requires a recovery token which was sent to an email account I have access to, authenticating with the token results in a security error. Despite having access to the password, the recovery email account and an active session, I could not activate a new session. It didn’t make sense, not that it matters when google refused to have a help desk or meaningful way to report bugs.
    - _zoltan_ 3y ago
      With Google One, you get support. And if you use storage from them you have google One.
akkartik 3y ago
Just turn off MFA for Google. I did this during 2023 and started sleeping so much better at night. (Curious how easy it was for me to forget that it's something I can turn off, once I turned it on.)
- franga2000 3y ago
  2FA wasn't turned on for that particular account, Google just decided to "double check" one day.
  - akkartik 3y ago
    Oh interesting. I think I haven't noticed this because I'm trying to disconnect from Google lately. These days I login on an incognito tab and log out when I'm done. But just with a password.
  - firecall 3y ago
    Yep - even with 2FA off they still like to check. I have a client who tries to share one Google / Gmail Inbox account between users internationally and Google does not like that at all! Google constantly requires verification for logins!
    - a_dabbler 3y ago
      Sounds like they should be doing automatic email forwarding or something instead
      - jalk 3y ago
        That only works for reading emails, not sending/replying using the shared account.
    - toomuchtodo 3y ago
      What happens if passkeys are created for the account on everyone’s workstation?
    - 3y ago
deleted 3y ago
[deleted]
jefftk 3y ago
The issue is account hijacking, and it's a matter of tradeoffs: the more relaxed your login process is the more unhappy ex-users you'll have losing their accounts to hackers (mostly reused passwords getting leaked), while the stricter you make it the more unhappy ex-users you'll have losing their accounts to lockouts (mostly stale recovery methods).
- franga2000 3y ago
  It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. And the answer should never be just "sorry, we can't confirm your identity right now". If I pass every challenge Google throws at me, I should be let into the account, period. If they have more, sure, whatever, let's play the game, but if I did everything right and still can't get in, that's a broken authentication system.
  - omnifischer 3y ago
    > It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. If that is your argument then it is their service. They can decide how to offer it. Services like this are designed for majority - and a majority are happy. If you don't prefer then you can find alternate services. Market is wide open.

hsbauauvhabzb 3y ago

I think there’s a functional bug with very early (2006) accounts due to MFA or something. Good thing google has a high quality help desk to report bugs /s

londons_explore 3y ago
I think if they have ever seen your account password in any password dump/leak (ie. if you reused the password elsewhere), then they effectively prevent password login. You have to have another already-active session. Makes sense really.
- sodality2 3y ago
  It would make more sense to inform the user this, then enforce these checks until the user changes it. Anecdotally, my Google account's password has never been in any dump (password manager, very long random alphanumeric, changes every 6 months) and I too deal with these annoying prompts.
- hsbauauvhabzb 3y ago
  In my case, the workflow requires a recovery token which was sent to an email account I have access to, authenticating with the token results in a security error. Despite having access to the password, the recovery email account and an active session, I could not activate a new session. It didn’t make sense, not that it matters when google refused to have a help desk or meaningful way to report bugs.
  - _zoltan_ 3y ago
    With Google One, you get support. And if you use storage from them you have google One.

akkartik 3y ago

Just turn off MFA for Google. I did this during 2023 and started sleeping so much better at night. (Curious how easy it was for me to forget that it's something I can turn off, once I turned it on.)

franga2000 3y ago
2FA wasn't turned on for that particular account, Google just decided to "double check" one day.
- akkartik 3y ago
  Oh interesting. I think I haven't noticed this because I'm trying to disconnect from Google lately. These days I login on an incognito tab and log out when I'm done. But just with a password.
- firecall 3y ago
  Yep - even with 2FA off they still like to check. I have a client who tries to share one Google / Gmail Inbox account between users internationally and Google does not like that at all! Google constantly requires verification for logins!
  - a_dabbler 3y ago
    Sounds like they should be doing automatic email forwarding or something instead
    - jalk 3y ago
      That only works for reading emails, not sending/replying using the shared account.
  - toomuchtodo 3y ago
    What happens if passkeys are created for the account on everyone’s workstation?
  - 3y ago

deleted 3y ago

[deleted]

jefftk 3y ago

The issue is account hijacking, and it's a matter of tradeoffs: the more relaxed your login process is the more unhappy ex-users you'll have losing their accounts to hackers (mostly reused passwords getting leaked), while the stricter you make it the more unhappy ex-users you'll have losing their accounts to lockouts (mostly stale recovery methods).

franga2000 3y ago
It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. And the answer should never be just "sorry, we can't confirm your identity right now". If I pass every challenge Google throws at me, I should be let into the account, period. If they have more, sure, whatever, let's play the game, but if I did everything right and still can't get in, that's a broken authentication system.
- omnifischer 3y ago
  > It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision. If that is your argument then it is their service. They can decide how to offer it. Services like this are designed for majority - and a majority are happy. If you don't prefer then you can find alternate services. Market is wide open.