"Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system."

It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it.

From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices.

Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.

Ironically, Google likely has enough data that they could conclusively prove you are who you say you are and own the target account, just by looking at your Chrome's telemetry for the past 10 minutes...

since the user agent is supposed to be locked (soon if not already) for newer agents, and Google is probably most responsible for this feature, you would think they did not detect new devices by user header changes?

s/sacrafice/sacrifice/

I'm locked out of a Google account I configured without a phone number. It won't let me reset to email, and when I provide a new number it does no good.

The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.

Same thing happened to me when I changed ISPs. I never lost my password, but Gmail locked me out anyway.

I keep a phone number I never answer, with a voip provider I've used for decades. That number forwards to whatever number I care about. I give out only the movable voip number, never my physical cellphone number, when it comes to services.

This is what iNUM was supposed to solve. Sadly it didn't take off.

Does that mean you could be screwed if that voip provider disappears before you have time to change things? Or do you own the number somehow (like a domain name?) so that you can move it elsewhere in that situation?

I know nothing about voip providers and this makes the setup sound scary to me.

Yes, you'd be screwed if that happens. But it's significantly less likely that they're skiffed than a telco provider, given how they work. I know way too many people who have had the latter happen - and none the former.

This is a great point.

I'm going to try and onboard this thinking into my life.

> I would prefer to use something else, thanks.

What is the alternative to Gmail? Genuinely interested. I'd be willing to switch if I found a future-proof email solution for both personal and business usage.

Step 1, get a custom domain so you can migrate providers easily. It costs like 6€ a year, definitely worth it.

Step 2, Fastmail, Protonmail M$, ... will be happy to offer you email for few € a month. If you'd desperately need to save money on that, there is Czech provider Seznam.cz that offers email on custom domain for free. Only issue is that the registration is in Czech, but Google Translate your friend: https://emailprofi.seznam.cz/login It's like a biggest local internet company, not totally random provider, so should not just steal data or disappear right away and works reasonably.

Thanks, will have to make some time to do the switch, but at least I will sleep well at night knowing that Google doesn't own my life.

There are so many email providers you'll have to explain in a bit more detail why you think the alternatives you've seen aren't appropriate for you.

I just use my own domain and then forward incoming email to whatever service. This way it doesn't really matter what I use: if I get locked out I simply change the forwarding email. It's free with most providers.

Seriously? Fastmail is awesome and so much better than gmail. And I'm sure there are plenty of good alternatives as well, this just happens to be the one I use.

Protonmail is a really solid solution as long as you have your own domain. It's pretty privacy focused and has worked well for me for a decent while. They've got a decent VPN service as well (I think it comes bundled with Protonmail at some tier level) and they just recently rolled out a beta for their Google Drive replacement.

All in all I've enjoyed their services. Their security/E2E Encryption support is nice (could still use a bit more functionality though) and they are definitely a lot more FOSS friendly than Google when it comes to actually using their services.

And, to boot, as frustratingly low as their free usage tier limits are, the fact that they openly publish them and that they are quite low tells me that they're at least being realistic about what they can offer without monetizing the service in other ways.

I actually pay for ProtonMail now and I'm in the process of moving all my communication to it. My Google account will stick around, but I'm diversifying my dependencies and it feels so good.

Fastmail, Protonmail, Microsoft365

I've been using iCloud Mail for 10 years now.

Never had a problem, and allows up to 3 aliases at a time that can actually be completely different instead of Gmail's useless [email protected]

I've been very happy with kolabnow.com services for a biz email acct, and I'm likely to switch personal over there too. Not free, but inexpensive, FOSS, Private, Swiss-located, and really solid service and support. Among a ~dozen others I've tried or still using, Kolab is the best of the lot.

(&yes, I use Gmail for junk or transactional stuff; need the acct for an Android mobile, and their UI is a horrific kludge of UI conceits trying to showcase their 'mad design skilz' - yuk!)

Get a domain at namecheap, plus email. Ten or twenty a year. Web and thunderbird support. Become the customer instead of the product.

When this question is asked, there's always a hundred people eagerly telling you to switch to Fastmail, forgetting that 14 years ago, everyone was saying switch to Gmail because it was the good option.

I would just suggest people think about what might happen if Fastmail gets enough of a userbase to be the next Gmail.

Fastmail is monetized in a completely different way from gmail.

14 years ago, Google was a very different company. I don't think it's reasonable to criticise people for not seeing what they would become that far in advance.

I agree with you, I just caution that they may not have become what they are today if we didn't all flock to Google. Fastmail is good today, will they be good if they become the dominant player?

Protonmail seems to work pretty good for me, although I still have a gmail address as well.

I use Office365. Yes it costs money, and yes they provide good support. I also use Outlook so ALL my mail, both sent and received are stored locally and remotely. If my mail bombs I lose max a couple hours' worth of email.

> future-proof email solution for both personal and business usage

Apple iCloud for personal use.

If you can tolerate a completely different way of doing email, I wholeheartedly recommend HEY[0]. I've been a customer since it went live and their business model is very straightforward. You pay $99, you get email for a year. Their track record running Basecamp instills confidence in the longevity of the service and that they won't sell out their customers.

I honestly think it's a much better approach to email. One of the key issues with having an email address is that anyone who knows it is granted permission to get your attention, whereas with HEY you get rid of that problem for the most part but without having to 'program' your inbox.

[0]: https://hey.com