Of course, reaching out to support is moot - their RoboSupport sucks. I will never purchase a Google product if I can help it and will steer clear of them in any team setting where I can affect the decision.
That would normally raise a bunch of red flags.
If you're stuck, there are dedicated support channels to actually talk to people - or feel free to reach out to me (my non-work email is in my profile.)
I think he realizes that (although I wonder given that he tries to minimize it by saying that it was an 'old 90's cartoon').
I think this is really scary though - did he lose access to YouTube? Or all of gmail? That would really be scary. I'm guessing that he just lost access to YouTube, but if he lost access to his gmail or google docs, then that's an awfully severe penalty for violating someone's copyright. I'm sure the RIAA/MPAA/etc would be pleased... but is that just?
Maybe he just lost access to his YouTube channel?
This comment is a lot more funny now that I'm finally reading "Little Brother" by Cory Doctorow:
Yeah - screw youtube and google. The onus is on their resources vs the individual.
As opposed to what? If the city creates a public park and you decide to commit a crime there, are you somehow no longer responsible?
There is an economic incentive in terms of saved resources to bundle multiple services in a single account like this but it harms consumers to get cutoff from your entire digital life because of some minor infraction.
You use the singular form of "account", which is interesting to me. Are they preventing you in some way (IP address tracking, device tracking, etc) from creating a new account? Why would you not do so?
I wholeheartedly agree that a Youtube violation should not affect your other Google products, like a laptop or email account. Similarly, an Amazon problem should not affect an AWS account. But I will concede that they're within their rights to disable your Youtube account for uploading copyrighted material.
You violated the law and their (rather reasonable in this case) terms of service and are shocked to find they'd rather not do business with you?
so for example here, it appears that someone breached Youtube ToS and lost their whole Google account.
Now imagine you've got all your e-mail/photos/contacts etc in that account and you've just permanently lost them due to that ToS breach.
Of course as technical people we can say "ahh you should have had off-cloud backups", but realistically most non-technical people won't do that and likely won't realise the consequences of their actions.
so for example here, it appears that someone breached Youtube ToS and lost their whole Google account."
Exactly. I recall the incident[1] where some Google Pixel phone customers were reselling their phones and making a tiny profit. Google permanently deleted hundreds of accounts and never restored them, for violating a mobile phone TOS. Ban them from the Fi mobile service, sure, but don't delete their entire digital lives! That's like getting a life sentence for shoplifting in the physical world.
All your eggs in one basket is never a good strategy, and though I wasn't personally affected by it, the Pixel Phone fiasco opened my eyes to just how much Google and Facebook controlled my own digital persona. I now use neither of their services.
[1] https://www.theguardian.com/technology/2016/nov/17/google-su...
When I worked in the Intelligence Community I had to go through multiple FBI investigations and polygraphs. Every single one of them asked me about laws I may have violated in the past. One of the agents even said (paraphrased, of course) "Maybe you downloaded some movies? It's illegal but many don't realize it and probably most people do it".
Pirating is one of those crimes that has become normalized. The parent may have realized it was illegal but didn't think much of it and probably didn't realize it would lead to his account being completely disabled.
The trouble with Google accounts and becoming disabled is it can very likely ruin a good part of your life because of how much of your data they hold and there are zero ways to redeem yourself if you did do something wrong and there are zero ways to resolve the problem if it was due to something inaccurate or false (which has happened especially if someone else gets into your account).
What's the correct answer?
If you told your interviewer that yes, you have downloaded some pirated movies, then if somebody calls you up saying "hey, i'll tell your boss you're a movie pirate if you don't tell me X" you'll feel confident shutting them down.
If anything, it makes an asset vulnerable to extortion _from_ the FBI.
See also "The FBI Is Struggling to Hire Hackers Who Don't Smoke Weed". [1]
[1] https://www.reddit.com/r/news/comments/262dde/the_fbi_is_str...
[0] https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...
If that is what actually happened then it invites regulatory action considering Google's unparalleled market share and reach.
You bought a Pixel phone, and Google thinks you might be a reseller? Then your account will be terminated, too.
And yes, there should be massive regulatory action, Google is doing so much stuff that should be fixed, it’s impossible to even list it all.
This guy has a for-life veto on a lot of the leading technologies, and cannot use a lot of product (in an every increasing list).
that is how I feel about most of their hardware products. I had a nexus 5 and when ever there was an android release, there were all sorts of problems that filled up the message boards.
My life would have came to a grinding halt if they banned me, and I couldn't even email them about it.
I tried to switch everything to Lavabit, but then a month later the Snowden thing happened...that didn't last (and I'm still out all that money)
The only downside I've found is you have to pay the full fee for each @fastmail.com account, though I get around that by hosting my other email addresses on my own VPS and using Fastmail as my IMAP client for them.
Recently on HN I saw another email provider that offered fully encrypted email, perhaps end to end, but I've already committed to Fastmail so I didn't follow up with them too much.
I'm happy with Fastmail fwiw, and happily support them.
[1]: https://blog.fastmail.com/2013/10/07/fastmails-servers-are-i...
edit: I take that back, I'm not wrong, yay \o/.
https://blog.fastmail.com/2013/10/07/fastmails-servers-are-i...
They are in the US, it's just that the company itself isn't. So depending on your level of distrust of the US, that may or may not be an issue for you.
With that said, do you feel there's no difference in security when having servers in, or outside of the US?
A lot of people seem to distrust US involvement, and prefer out of US as much as possible. Do you think this is completely bunk, because the NSA is so unstoppable?
To me it just seems like being in the US just adds to possible problems. Thoughts?
When it's time for email renewal, 1 or 2 yrs down the line, I'll be looking at ProtonMail :)
It is also missing a lot of features compared to gmail, while the web UI is a bit clunky. These aren't real breakers for me (spam is); but it is hard to recommend. Is premium much better?
Plus, they work with SMTP/IMAP/CalDav/CardDav, so if you like the tools you're using, you can keep using them. Personally, I use third party tools on my phone, but their web UI on PC.
I did think about switching to my own domain for emails though. I have previously avoided it because it adds a new vector of attack - i.e. if an attacker gets my domain, they have my email. With that said however, I can still keep a handful of important sites hooked up to my real email. Eg, my bank can go directly to fastmail, but randomsite.com would send emails to [email protected].
That would give me freedom to move my email where ever I see fit, with minimal changes. It seems tempting.
>"I forwarded email in Gmail, and move over forwarded emails as I can."
I didn't understand what you meant by moving over forwarded emails. Once you forwarded them aren't they available on Fastmail's IMPAP server? Or is there some other cleaning process you go through? Thanks.
Fortunately I have two major, long-standing e-mail addresses, so I put one of them on fastmail.
Dissecting your three examples.
In the first case, (and based on their own statements) those people were buying up phones by the hundreds, shipping them to a single physical address and then scalping over the internet.
It's basically fraud. So yes, they probably got picked up by an automated algorithm that looks for hijacking/CC fraud or bot-nets.
From public statements though, I believe most of them got their accounts back when they reached out to confirm they were real people and not some fraud bot-net. It's still technically violation of their ToS, but I won't comment on that part.
The second case I'm not directly familiar with, and there's no public statements so I won't say anything further.
In the third case, the affected customer made a public statement afterwards:
https://twitter.com/salilstatistics/status/89986397181723852...
I can't comment any further than what's been said publicly except on general principles 1. Google does a lot of things to protect users from external attacks, everything I've seen seems to indicate they really do care about users, and 2. There are pretty clear ways to get back into your account should anything happen (https://accounts.google.com/signin/recovery is your one-stop shop), and 3. The user doesn't carry any ill-will towards Google once he realised what actually happened.
(Disclaimer: I work for Google, but the above statements are my own and do not reflect those of my employees).
Not interested in needing to beg a horrible algorithm or become internet famous just to get ahold of a human that might turn my digital life back on.
However, reselling phones is usually against the ToS of pretty much every retailer. This isn't unique to Google. Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht....
> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.
I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?
In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:
http://www.idownloadblog.com/2013/09/12/apple-store-genius-b....
Or say you create 100 email accounts - [email protected], [email protected], [email protected] etc. - and have them each buy a phone, and ship them to a single physical address.
It's certainly possible to see how this would come across as hijacking or botnet fraud.
Yeah, they prevent the purchase. That sounds reasonable. They decidedly DO NOT brick the buyer's phone, or their entire digital life, if they suspect someone bought more than the limit.
Also, even if they did, which would be just as horrible and outrageous as when Google does it, at least they have reasonable phone support and retail stores. It's not just about Google's indefensible behavior in terminating Google accounts, it's about how the company wants to be relied on for everything digital without providing even a bare minimum level of support.
The issue is making it seem like your account is hijacked, or part of a bot-net, or committing payment fraud (e.g. stolen credit cards).
Say you create 100 email accounts - [email protected], [email protected], [email protected] etc. - and have them each buy a phone, and ship them to a single physical address. Most people would see that as a major red flag for something fishing going on.
Or say suddenly all of these otherwise unrelated accounts suddenly started ordering goods online, and shipping to a PO Box in the Ukraine.
As a consumer, I most definitely want all of this stopped.
In fact, my bank will regularly call me up and ask me to confirm transactions that seem suspicious (or send me an SMS) - if I don't respond in time (e.g. I'm travelling), they will lock out my credit card.
That is exactly what you want as a customer.
So in this case - it seems these people knew they were engaging in something shady - but perhaps they didn't put two and two together and think, gee, if I let somebody order something on my credit card, yet addressed to him, I wonder if it will look like my account was hijacked?
Many people have experienced financial protections, but few have experienced an adversarial bank, and I imagine that would scare a lot of people.
It sounds like to me Google does both things. Google does things which are comparable to customer fraud protection, and Google also does things which maximally asserts its positions in a punitive manner, at which point, is it time for lawyers and media PR battles?
It's basically fraud. So yes, they probably got picked up by an automated algorithm that looks for hijacking/CC fraud or bot-nets."
No, it's not "basically fraud". Yes, it violates Google's terms, and banning the customers from using Fi would have been a reasonable response, but Google's TOS is not enshrined in criminal law. Unless your position at Google is on the legal team, you might want to be careful about throwing around phrases like that with nothing to back it up. By admitting you work there, you are officially speaking for the company with such statements.
I suspect you and I are talking about two different things however.
I'm using fraud as an ordinary layman would use it - that is - deliberate deception to secure unfair or unlawful gain.
In this case, I think most people would agree that spawning up multiple dummy accounts (e.g. [email protected], [email protected], [email protected]) and then using them to get around ordering restrictions is definitely deceptive. (These account names are obviously illustrative).
And in terms of what's a "reasonable" response, that's above my paygrade. All I can comment on is the public statements that those people made around the time, and around their interactions with Google and their interpretation of them.
However, are you a legal practitioner? If so, then perhaps you are using the term in the other sense? Also, if you're willing to comment IAAL, that would be very interesting.
Fair enough, my point was more that I was so surprised you were willing to stick your neck out by officially speaking for Google here, especially regarding legal matters.
No, I'm not a lawyer, but I do have nearly 20 years in law enforcement and LE-related work, enough to have a bit of an informed take on things like this.
I do feel that Google was wrong to permanently and irrevocably delete their entire Google account rather than simply banning their account from using Fi. It's Google's prerogative, but it told me everything I needed to know about them as a company. Suddenly I was acutely aware that if I were to violate, say, YouTube's TOS by uploading something that I thought was fair use when it wasn't, I could permanently lose my entire online life. That's quite simply unacceptable.
In terms of handling and deleting user data, I do know we have some pretty clear guidelines around this - user data is sacrosanct. You can read up in the ToS, or if you need specific guidance around your personal circumstances, I would always encourage you to consult a legal professional.
The very disclaimer he added saying he was a Googler also said he wasn't speaking for the company.
Secondly, the per case details don't look good for Google - in the first case, buying and reselling phones for a profit sounds perfectly above the board. Even something a "don't be evil" company might do... In the third case, the statement reads exactly like legalese that would be grudgingly put out by someone who's had a tussle with lawyers.
To your second point - scalping phones is most definitely against ToS. This is true for Google, Apple, Smsung anybody.
Here are our ToS - https://store.google.com/intl/en-US_us/about/device-terms.ht...
> You may only purchase Devices for your personal use. You may not commercially resell any Device, but you may give the Device as a gift. Recipients of gifts may need to open and maintain a Google Payments account in order to receive any support offered by Google. These Terms apply to any gift recipient.
This isn't unique to Google. I'd like to see you walk into an Apple store, and buy 10 iPhones. Or say, 100?
In fact - Apple even introduced controls to stop scalping of Genius Bar appointments:
http://www.idownloadblog.com/2013/09/12/apple-store-genius-b...
Or say you create 100 email accounts - [email protected], [email protected], [email protected] etc. - and have them each buy a phone, and ship them to a single physical address.
You can see why this would come across as hijacking/botnet fraud, right? (That's separate to the ToS violations).
But from public statements - the scalping itself wasn't what got them, it was probably the bot-net like account creation, and indications of payment fraud.
Thirdly point - it doesn't sound remotely like legalese, and there's no indication lawyers were even involved. In fact, why would they be? I would have preferred him to post some more technical details, as that would have cleared things up, but he posted a nice message of his own volition, which I suppose is fine.
It reads more like the message of somebody who's relieved, and glad he got an explanation of what actually happened behind the scenes.
Google is not at all transparent about how or why accounts get closed, and their support when it happens is utterly terrible. The fact that the links in the parent posts had to resort to PR shaming is proof of that. Most people don't have the online following to pull that off.
In reality, an average person who loses access to their Google account is screwed, and that should be an important consideration when looking at Google products.
That kind of solution is unlikely to be of use to customers who don't have the ability to bypass the common process...
It's one of those things where you want to tread carefully.
I mean, say my account got hijacked.
I want to get back in. So does the hijacker. I would much rather prefer waiting an extra day or so, than risk having the hijacker purporting to be me getting back in.
I've actually had to deal with the exact above scenario for a friend before - they had a Gmail email account, and another (unnamed) email provider. The hijacker did try to get back in, and it's a pretty scary proposition. So having a bit of peace of mind that the bar is suitably high is good.
(Disclaimer: I work for Google, but any statements above are my own, and do not reflect those of my employer).
Except, that’s not what happens.
Google lets the hijacker in, and locks you out. I live in Germany, and yet, as detailed in https://news.ycombinator.com/item?id=15404541, Google let a hijacker from Russia with knowledge over nothing except my password in, and I had no way to reset it despite access to all reset questions and reset email (but no access to the reset phone number).
Not even a Google employee friend was able to help me, as their internal escalation team for this... contacted my hijacked account via Gmail.
Google’s system is useless, and if you honestly rely on it, you should stop right now.
Go into Gmail, IMAP settings, and write down the "POP3 activated since" date, that’s the only place you find your account creation date, it’s required for account recovery. Update your phone number, and choose an ISP that NEVER deactivates unused phone numbers.
doesn't sound a lot like the standard support process to me.
My understanding was he'd already kickstarted a normal recovery process https://accounts.google.com/signin/recovery
And he wanted more details, so I assume he spoke to somebody up the escalation chain in our support org, who gave him more details.
"Mehta was lucky. The public outcry and press attention prompted Google to manually review his case."
"It could have turned out differently. Without his impressive credentials and far-reaching network, Mehta never would have found out why his Google account was shut down. He wouldn't have been able to access his correspondence or restore his blog, which he says has been read by the likes of Elon Musk and Warren Buffett."
I actually work in a support org at Google (on the Enterprise side, admittedly).
That account recovery link I provided (https://accounts.google.com/signin/recovery) is available to anybody (This is for consumer - i.e. GMail. If you have an enterprise - i.e. GSuite account, it's slightly different in that your domain administrator can also restore you as well).
You don't need to be anybody special - you just go to that URL, fill in your details, and somebody will review it for you.
Yes, it will take time. If you make noise, it's possibly it will get escalated and you will get assurances from somebody that it's being looked into. But in general, it will take some time to process it, simply to ensure that we're giving you (and not somebody else) access to your account.
I know it sucks, but account security is tough, and I have nothing but respect for the hardworking people that handle that. In my second week at Google, I accidentally typed my password into a non-secure (but still legitimate) web-form. Within minutes, I got an alert asking me to change my password immediately. They take security very seriously.
Disclaimer: I work for Google, but any opinions above are my own.
" A Google spokesperson told Inc. that Mehta mistakenly marked some of his own email as spam, which confused the algorithm and triggered the shutdown. By August 21, the account had been fully restored."
Given that you think that a person without that reach would have had a similar experience....
that's your perogative of course, but you should forgive a little doubt from outsiders that things would've been so smooth for those without recourse to similar avenues.
That's a straw man argument because, as far as anybody can tell, the account in question wasn't hijacked.
In reality, this person had a big, multi-day inconvenience foisted onto them out of nowhere, for reasons they apparently can't even talk about. And that's assuming Google even told them what the violation was.
If Google wants people to buy in to their platform then they need something better than an across the board zero tolerance policy.
Let's be honest, nothing is 100% safe. If you decide to keep everything off of the cloud also has its own risks.
Either could be true...
If it is possible / likely that a court would hear the case, would your only option then be to sue for monetary damages, or could you sue for them to perform an action (such as reinstating your account)?
What a horrible piece of privacy abusing junk this Chromebook is.
https://gsuite.google.com/security/
I think $5/mo per person in exchange for some degree of privacy and being the customer instead of the product is a reasonable deal. $10 for unlimited storage.
In addition that price gets you 24/7 live support from a real person.
I'm not suggesting this answers the general privacy concerns and other issues presented here.
YET.
GMail also launched without ads and datamining.
Google retroactively added it, without opt-in, and mined all your data later anyway.
If Google can physically access something, you have to assume they will data mine and publish it at some point.
This happened to me recently (though I think for security concerns, not TOS violations), and was quite distressing. What steps can be taken to avoid this?
Trust me, there are a lot of bad actors out there,
The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys.
If you ever get locked out (e.g. account is suspected as compromised/hijacked), then:
https://accounts.google.com/signin/recovery
is your one-stop shop to prove you're really you.
That’s what happened to me.
I had a Google account, abandoned since 2012, disabled. A few weeks ago I got an email telling me someone from russia was trying to log in, and this was prevented. The next day, another email – telling me that I successfully logged in from Russia, and had successfully changed the password.
Google offered no way to get the account back.
I had the creation date, a list of every email in the account, the used phone number (although it had since been shut down and recycled), the old password, and control over backup email.
This was not enough, Google left the account in control of the attacker.
I requested through a Google employee friend their internal form to handle this. Also, no success. Instead, they talked with the hijacker.
In the end, I managed to contact the new owner of the recycled phone number, and together with him, I managed to run the account reset procedure, and regain control.
________________________
Conclusion: Google’s account "security" is useless against hijackers, prevents you from getting your account back, and is just a fucking pain in the ass.Google accounts have far more security options than most online banking platforms. There's no reason you should lose your google account as long as you listen to the notifications that tell you to review your account security and go through the steps.
1. Spread all activity on multiple mail accounts?
2. Get a G-Suite account + own domain, so in a case of a lock out you just change the MX records?
Option 2 is expensive for a lifelong private account and 1 is cumbersome.
Any other ideas?
I don't think anyone (reasonable) should be concerned and I think most people, developer or not, are not concerned.
This is just yet another example of this vocal minority on HN that regularly talks shit about every Google hardware product, where the argument against this specific product actually comes down to a larger argument against Google and how much access and gatekeeping they have with regards to your computer use.
What irritates me is that this is Google's core business and if you're not interested in Google products because of that, then who the hell cares what you have to say about this product? It's like if Google launched a volleyball net and the top comment was something like, "Well, I don't have a house or a backyard and so I won't buy this because I won't have space for it!"
Well then clearly you weren't going to buy this product in the first place, so what use is your opinion here? Why would Google make a laptop that has nothing to do with the rest of their business? Is the parent comment suggesting that Google should make a general purpose laptop that doesn't integrate with Google accounts?
On top of all of this, it's not like the laptop becomes a brick in the event that your account would get locked. You can still use it in incognito mode, albeit without Android apps and such.
Furthermore, doesn't this exact same argument apply to Windows 10 with a live.com account login, and Apple with iCloud account logins? Seems to me like the privacy zealots seem to come out stronger against Google.
As others have pointed out, Google has capriciously cut off account access to numerous people. When they do that, you lose your email account, which is the de-facto access key to a very large number of other accounts. This is to say nothing of the documents, spreadsheets, photos, PURCHASED movies and music associated with that account.
Bear in mind the Jordan Peterson case, on which Google has yet to answer, is only one we know about due to its high profile nature. How many other users without access to the ears of the media get rolled over in similar manner?
When any other entity chooses not to do business with you, they don't show up to your house and make off with your DVD and CD collection, the home movies of your kids, as well as contents of your filing cabinet and a good number of the backup keys you have for other accounts.
The parent is not worried about PRIVACY, they are worried, rightly so, of LOSING THEIR DIGITAL LIFE on a whim of a third party.
The probability is low, sure, but the impact is very high. Evaluating risk is not just about likelihood, but also impact.
The obvious objection, that one should use G Suite from a domain name they control, and do hour-by-hour snapshot backups of every document and photo they host with Google, is a fair one, but it puts the user in a position in which the very value Google services offers -- convenience -- is no longer there. So what's the point?
It would seriously surprise me to learn that this exact scenario does not apply to iTunes with iCloud and Microsoft with live.com accounts, azure, onedrive, and whatever xbox music store they have now. What sets Google apart here? I'd argue that the only thing that sets them apart is that they give users more opportunities to expose themselves to ToS violations via the fact that they own YouTube and other popular content sharing platforms (eg: gdrive), and also that many more people have Google accounts than have iCloud or Microsoft accounts.
> Bear in mind the Jordan Peterson case, on which Google has yet to answer, is only one we know about due to its high profile nature. How many other users without access to the ears of the media get rolled over in similar manner?
He's a YouTuber with nearly half a million subscribers and a ton of videos. The reason his account was likely flagged in the first place was due to his high profile nature, probably some kind of conflict with copyrighted content and/or adsense. I don't think Jordan Peterson's account lock should be taken as evidence that this is randomly happening to a lot of other ordinary Google users.
(... and why is he uploading on YouTube with a personal Google account in the first place?)
> The probability is low, sure, but the impact is very high. Evaluating risk is not just about likelihood, but also impact.
I don't think that's right. The probability is low, and the impact is only as much as you allow it to be. I don't understand why it's all or nothing. You don't trust yourself to have a Google account and not overexpose yourself?
> The obvious objection, that one should use G Suite from a domain name they control, and do hour-by-hour snapshot backups of every document and photo they host with Google, is a fair one, but it puts the user in a position in which the very value Google services offers -- convenience -- is no longer there. So what's the point?
It doesn't have to be that dramatic, you download the really important stuff off of Google and save it on a USB stick or something. They make it absurdly easy to download all of your data with their exporter tool.
Actually, under "tech specs" on the product page, it says a Google account is required.
These devices are very different to traditional computing devices (e.g. Windows/Linux PCs) which mostly store content locally as there lockout from a single cloud is unlikely to be catastropic.
As the major consumer OS makers (Apple/Google/Microsoft) go more in the direction of an integrated experience where cloud storage is key, how they handle possible ToS violation and account lockout/closure will become increasingly important.
The first example - was basically fraud, that probably got picked up in hijacking/bot-net detection (based on public statements).
The second - I can't comment, as there are no public statements.
The third - the author made a public statement, and seems to harbour no ill-will to Google after it was explained to him what actually happened. I can't comment on that conversation, but I will say that in general, Google does a lot to protect its users from all kinds of security issues and attacks.
If someone has to know to e-mail you personally to help fix an issue, that concept doesn't scale to x million accounts.
I'm not trying to get at Google specifically here, I'm suggesting that as all the tech. companies move more of people's digital lives to the cloud, these accounts become more important and how they deal with ToS violations, reactivations and the like will require a lot of thought.
However, these things take a while to process.
As I commented elsewhere - if your account got hijacked - the last thing you want is for the hijacked to get back in, via some automated form.
I had to deal with exactly this nightmare scenario for a friend a few months back. Two email accounts, one from Gmail, one from another (unnamed) provider. The hijacker tried to get back in, several times (and did on the other one).
Knowing that the bar is reasonably high that only you yourself can get back in (even if it may take a few days) is very reassuring.
Trust me - if it's between waiting 2-3 days, versus having somebody get back in, pilfer all your email and commit identity fraud, I would pick the former more secure any day of the year.
http://m.gadgets.ndtv.com/mobiles/news/google-pixel-reseller...
http://m.washingtontimes.com/news/2017/aug/1/jordan-b-peters...
http://www.zerohedge.com/news/2017-08-21/one-statistics-prof...
Given that Google has a propensity to lock you out of your account completely if they suspect you violating TOS on any of their services, I would be very wary of this device. Do you want this computer and anything you created with it inaccessible because Google didn't like a video or blog post you made?