Hacker News Reader

Comment by lukasb | Hacker News Reader

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.)

We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

View on HN

I get notifications about that from Facebook sometimes. It is a bit unnerving to hear that someone is attempting to repeatedly log in with my email address, but it certainly prompts me to make sure my accounts are locked down well.

Do you have an email address that may be similar to others?

My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).

> login

> emails

There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.

Unfortunately that was a management decision rather than technical decision!

Then nobody remembers their user name, I don't remember any of mine. If I didn't have LastPass I'd be password resetting on every financial account I have.

> We do send an email when you log in from a new device.

Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)

Why wouldn't you store cookies?

From the biggest ad network in the world? The real question is: why do you?!

So that I get ads for microcontrollers, FPGAs, and PLL synthesizer chips, and not fishing supplies, groceries, or feminine hygiene products.

> We do send an email when you log in from a new device.

AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs.

Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regular users more security conscious.

+1 same. Rssponses like the one you just replied to completely drive me nuts. If you don't think it'll be useful for me then let me disable it. Don't use it as an excuse.

In the last week my host has blocked 173 different IPs for attempting to guess passwords on SSH. And I don't even have psasword authentication enabled on SSH.

And this is on a nothing host. Almost completely anonymous and yet under constant attack.

Did you even read my comment? The most important scenario I just referred to was AFTER the password is typed correctly. Not before. I'm pretty damn sure botnets aren't going around entering my password correctly.

> We do send an email when you log in from a new device.

Which is useless, because whoever got access can just delete it or change your password.

They send emails to the alternate account.

Which is very nice as a family member who is the recovery contact for many other family members. Wish this shit could be turned off, I've never heard it help anyone (though I'm sure we can find a stranger on the internet who can testify how useful it was for them).

Use rules and labels to bypass your inbox. I use it in the same manner as you and it has come useful to recover their passwords.

Reply on news.ycombinator.com