Hacker News Reader

Comment by RulerOf | Hacker News Reader

>Am I the only person who loathes this form of 2FA?

Not in the slightest. I tried to configure TOTP-only and Google effectively tells me to go fuck myself, because they apparently know how to secure my account better than I do.

View on HN

I've found that if you move away from Gmail (and there are much better providers around), a Google account doesn't contain much. Turn off your history and someone compromising your account can do... what? Search for things you'd like? View your YouTube favorites? Meh.

Agreed. I have moved off of Gmail (went to fastmail, very happy) and I also removed my other services off of my gmail account for logins. My google account has my calendar and youtube and that’s it.

Me too! However, my fastmail app is slow on my phone (a Nokia 6.1), compared to the Gmail app which, while not buttery smooth, is still faster than Fastmail...

And the Gmail app refuses to allow IMAP accounts to archive emails, so that's pointless...

docs, drive and photos are pretty packed for me at least

I was in that same boat, which is why I decided to migrate off gmail and move to a paid provider. One day I just woke up an realized I had to much important shit tied to my email to not be a customer. Paid services to replace google are surprisingly affordable. And best yet, if there is ever an issue, there is also a number I can call. Totally recommend migrating away.

«there is also a number I can call»

Unfortunately that's a number a hacker can call to social engineer the employee and steal your account. Same method as in SIM swapping attacks.

Assuming reasonable levels of competence on the part of the service, which scenario seems more likely for the average user:

1.) Some unexpected glitch occurs (could be the user's fault or could be the company's), and the user's ability to access the service is temporarily interrupted until a human is able to investigate and resolve the problem.

2.) The user is specifically targeted by a malicious actor performing SIM swap and/or social engineering attack.

I'm not really a gambler, but if I'm forced to guess, I'd say #1.

EDIT: clarify initial assumptions

what do you use for photos storage ?

Not OP. While I've personally not yet fully migrated out of Google, I found Synching and Resilio Sync quite useful to transparently backup photos to my own computer. And to prevent losses, I have a Backblaze subscription.

While I do have a VPS, it only has like 20GB, so I've yet to find an affordable and easy photo sharing solution.

You can set up PhotoStructure to build smaller (4k, 1080p, whatever you want) previews on your home server, and rsync just the previews dir and DB periodically up to your VPS. A couple of my beta users do this. (I'm the author, btw).

https://photostructure.com/faq/why-photostructure/

Hey thanks, I'll take a look!

I have a NAS that backs up to rsync.net.

I use Wasabi with Clouberry for backups and otherwise store all data on my hard disks.

But if you're into "cloud" storage, Mega.nz gives you 50GB of free and very reliable storage.

As always in this threads I hear people talking about SyncThing etc (and i have it and it's neat) but that works for Android. How do you exit the iCloud land in an easy and reliable way? There is no SyncThing for iOS.

I wish SyncThing was more userfriendly or something. I've tried it on different Android phones and computers and have never gotten it to work.

The hardest thing for me to replace so far has been Google Maps. I use a handful of OSM map apps, but none of them come close to the local business lookups of Google, which I need quite often.

Right but you don't need an account for that.

You don't need an account for that yet. I've been using Maps in "incognito mode" for 6 months, but I wouldn't be surprised if they're still using Maps to collect data about me.

Better yet, always be logged out of google (and everything else really) unless you must. Then log out and erase all cookies ASAP.

The issue with moving away from Gmail is that some sites don't allow you to change your email address. I can only imagine the chaos that will be when Google decides to kill Gmail.

> they apparently know how to secure my account better than I do

This is definitely true for 99% of people though

And the company is taking full advantage of that.

"Trust us."

Yet no company wants more personal information from you than this one. They want everything. Even when they have so much, they are going to great lengths to get more.

They are not in the security business, they are in the online ad sales business.

And you aren't even exaggerating. They now require ID verification to watch age-restricted videos on YouTube.

Windows with a Yubikey is like this, most particularly in Edge. It'll accept your key once but you'll have trouble using it again. It'll tell you that it doesn't recognise the key.

Some bullshit with Windows Hello, I'm sure, since using a hardware key in the browser triggers it.

Reply on news.ycombinator.com