News for hackers. Stuff that matters.
Re:Ask HN: Gmail account security by supermatou on Sunday January 23, 2022 @06:09PM (#30051588)
Yep, and it was even more aggravating.

> have three gmail accounts

> primary, [email protected]

> secondary, [email protected]

> tertiary, [email protected]

> secondary and tertiary have primary as a recovery address

> log in/out once a week in 2nd and 3rd

> last August, try to log into name.surname.work

> "Password is incorrect"

> WTH?! of course it's correct.

> try several times, Google blocks me ("temporarily")

> next day, try again, no dice.

> OK, the hell with this: let's reset the password

> "what's the last password you remember?" duh, the last and only password is the one I already gave you, you stupid machine.

> "we need additional verification; input the recovery address" Finally! type my main address

> mail from Google arrives pronto, code in it

> type code in verification field

> new mail from Google: "Thank you for verifying your mail address" [my primary one?!] Based on the information provided, we cannot ascertain that [tertiary account] belongs to you"

This has been happening since. A few weeks ago, secondary account went down too, yielding the same error OP got.

Note: a) I have been using the same IP and the same machine to log into those accounts for many years; there is no other device or location where I've signed in before! b) primary account has multiple (4) Yubikeys associated with it, so it should be clear I'm a real person and not a bot.

I'm currently in panic mode: if my main account goes down, it will take a huge part of my life with it, from banks to government stuff.

Re:Ask HN: Gmail account security by jadedtuna on Monday January 24, 2022 @05:22AM (#30055683)
I've had exactly the same issue before. The only way I could resolve it was by "confirming" my phone number. I didn't have a phone number connected to that account, but Google helpfully let me confirm it anyways (i.e. it just accepted the phone number as proof of me being me, despite never seeing that phone number before).
Re:Ask HN: Gmail account security by bbarnett on Sunday January 23, 2022 @06:16PM (#30051648)
Set up a real email provider, forward your mail from google to them, and transition over.

If you want real identity security, reg your own domain, and move it with you.

Re:Ask HN: Gmail account security by fn-mote on Sunday January 23, 2022 @06:58PM (#30052020)
> If you want real identity security, reg your own domain, and move it with you.

I'm pretty confident that Gmail is more secure than the domain registrar if you're really attacked. At least do your research carefully on this one. Domains do get stolen.

As always, consider your own threat model. But if you're a civilian? Wow, just hope you can walk away from the lockout.

Re:Ask HN: Gmail account security by megous on Sunday January 23, 2022 @09:18PM (#30052914)
Maybe. I guess it depends on the TLD. My country's TLD manager allows owners to lock their domains against transfers by registrars, or against changing the NS sets.

At that point, registrar can't do much to harm you.

Choosing your country's TLD for the most important domain is probably a good idea, if your country has well functioing and fair TLD manager. I certainly feel I have more of a chance when someone steals my country's domain, rather than some .com or .org. Country domain can be registered only to citizens, and so both the TLD manager and the thief will at least be in the same jurisdiction as me.

Re:Ask HN: Gmail account security by foxfluff on Sunday January 23, 2022 @07:03PM (#30052059)
I am my own domain registrar.
Re:Ask HN: Gmail account security by jeroenhd on Sunday January 23, 2022 @07:41PM (#30052254)
The $3500 ICANN registration fee and the accompanying $4000 yearly accreditation fee hardly make running your own personal registrar worth it, and that doesn't even cover the necessary legal fees and paperwork you need to fill out to become a proper registrar.

The entire process also seems rather lengthy to me if all you want is set up secure email: https://www.icann.org/resources/pages/accreditation-2012-02-...

Re:Ask HN: Gmail account security by BenjiWiebe on Sunday January 23, 2022 @07:29PM (#30052190)
And can any random person with a gmail or outlook or yahoo email address successfully email you and get replies back?
Re:Ask HN: Gmail account security by jeroenhd on Sunday January 23, 2022 @07:46PM (#30052282)
In my experience, the moment someone emails your domain (at least on Gmail) your domain seems to become whitelisted almost instantaneously, even if others receive your email as spam. I don't know about Yahoo, but the problem is usually reaching out first. Generally, deliverability seems quite fine as long as you don't go for the cheapest package deal and implement all the modern protocols (SPF, DKIM, DMARC, etc.). Amazon IP addresses also seem to do quite well because Amazon has its own spam prevention system that's tied to your AWS account.

Having said that said, I haven't had a failed delivery in years and I host my email on a cheap VPS. I only started getting deliverability problems when I ignored my mail client's (and server's) warnings before sending a 100MiB email through a mail server that also hosted a TOR relay, which was pretty stupid in hindsight.

Mail deliverability isn't quite as bad as people seem to think it is, but if mail delivery to the big four fails, there's almost never a way to troubleshoot it. That's kind of a pain, I suppose.

Re:Ask HN: Gmail account security by yjftsjthsd-h on Sunday January 23, 2022 @07:43PM (#30052271)
Having your own domain doesn't mean running the email server yourself. Or are you suggesting that they filter by registrar?
Re:Ask HN: Gmail account security by __d on Sunday January 23, 2022 @06:57PM (#30052011)
This 100%. It's the only way you can move your email between providers.

Of course, it just shifts your risk to the domain registrar, so don't use someone too cheap. It's worth paying a decent fee for decent service here.

Re:Ask HN: Gmail account security by amelius on Sunday January 23, 2022 @06:39PM (#30051854)
Perhaps you're not supposed to have more than 1 gmail account, and the assumptions in their code cannot deal with more than 1 account per user, or worse, they actively try to discourage it.
Re:Ask HN: Gmail account security by jeroenhd on Sunday January 23, 2022 @07:36PM (#30052224)
I've been using multiple accounts for years, almost every part of the UI has the ability to switch between accounts. Youtube even still has the old Youtube account available from before the Google+ era, and switching to it is painless.

There could be many useful and useless reasons for why accounts get flagged, but using multiple accounts isn't one in my experience.

Re:Ask HN: Gmail account security by supermatou on Sunday January 23, 2022 @06:55PM (#30051996)
All of a sudden? I've had those accounts for a very long time - I created them when I got an invitation to test the service (Gmail was in beta and not open to the general public.) The year was 2003, I think.
Re:Ask HN: Gmail account security by asdff on Sunday January 23, 2022 @10:54PM (#30053557)
This would be pretty foolish on their end to discriminate this way, because I'm willing to bet 99% of their enterprise customers employees also have personal gmail accounts.
Re:Ask HN: Gmail account security by AnonC on Sunday January 23, 2022 @10:50PM (#30053525)
There’s nothing of that sort. Gmail has long had a feature where you could link your accounts and switch between them too.
Re:Ask HN: Gmail account security by the_snooze on Sunday January 23, 2022 @06:44PM (#30051900)
Shared accounts are a nightmare too. Google makes it a pain for a team of developers to share a single "test" account completely seperate from their individual accounts.
Re:Ask HN: Gmail account security by resueman on Sunday January 23, 2022 @06:29PM (#30051770)
I had something like this happen becasue I was logging in to some microsoft service, and thought I was supposed to be giving them my microsoft account password but apparently they wanted my gmail password for whatever they were up to. And doing a password reset on this microsoft service actually reset my stupid gmail account. Then once I figured out what happened, google wouldn't let me use an old password to set it back.
Re:Ask HN: Gmail account security by rattray on Sunday January 23, 2022 @08:35PM (#30052644)
Is it possible that your secondary/tertiary accounts were victims of account takeover? Did you have 2FA on them?
Re:Ask HN: Gmail account security by lucb1e on Sunday January 23, 2022 @09:06PM (#30052835)
Are you quoting from somewhere or is this bullet points? (I only know this bullet points style from 4chan so not sure if this might be a quote instead.)
Re:Ask HN: Gmail account security by cbsmith on Monday January 24, 2022 @12:47AM (#30054112)
Could be some bot is trying to log in to your account, triggering your account being locked down.