Main
Main
Artwork
Artwork
Books
Books
Donate
Donate
Licenses
Licenses
Shorts
Shorts
Software
Software
Source
Source

Another Reason Gmail Is a Non-secure Piece of Shit (like you needed one)

02-02-2020

So over a year ago (as of 02-02-2020)-- I was at work at this failing company (that's not going to be around much longer). And, I got a call from my girlfriend's sister at like-- 8:30 in the morning. I didn't know who the caller was. Because, the caller's phone number wasn't stored in my internet-of-stings device ("smartphone" as people have taken to calling it). But, I could see it was a Michigan phone number (where my baby is from). So, I answered the call.

And-- it was my girlfriend's sister. And, she told me my girlfriend's son just shot himself. xP

Long story short-- I took off *immediately* from this worthless, piece of shit place where I was stuck babysitting useless people (who are supposedly "working"). And, I flew to Michigan to see my baby-doll. And (a few days later), we were at a funeral home. And, a lady running the place asked if I could respond to an email. That way, I could send her this picture my girlfriend wanted to use for her son's funeral. So-- I decided to use my internet-of-stings device. :/

This is a simple task. People would typically classify this task as "mundane", I would say. A user will have an email address. And, they can open an html and ECMA compliant web browser on a machine. And then, they can attach to a domain and log in with a username and password. Next, their browser will recv() (download) some terribly written, overly complicated html that takes ten to twenty minutes to translate. And once the user's web browser finishes translating 1,000 lines of unneeded ECMA code, seven advertisements that play videos (that a user cares nothing about), and downloading 200+ images to make the web page look "nice" (as a web developer sees it), a user will finally be able to do what they wanted to do in the first place-- send a message and log out.

Well-- I made a very interesting discovery that day. As it turns out, you can't just log in to a Gmail account anymore. Gmail rationalizes this by claiming that logging in to your own email account from a remote location "isn't secure" (whatever that's supposed to mean). Now-- how does this work? What are the factors involved? These were the first questions I had when I was faced with this serious problem. But, the fact was-- at that moment, I *really* needed to send a photograph to a caretaker. I didn't have time to understand this problem and develop a proper solution. That had to wait.

How did I send the email? Well-- I knew I could log in to my Gmail account from home. I never had a problem doing that before. And, that was telling me what the real problem was. But, I pushed all that to the back of my mind. What I needed to do was send an email. And, I had a way to do that-- by using an html and ECMA compliant browser from my house. So, I attached to my server's ssh daemon. And, I ran a script I wrote. It turned on an AC port in my server room.

The device that makes this possible is sold by a company called "IP Power" (if you're interested in such things). The power strip they manufacture is pretty expensive (like $100 for a single device with four AC power ports, an ethernet port, and a serial interface). But, the device allows a user to switch power ports on and off by using web software or telnet. Needless to say, I have six of IP Power's devices scattered throughout my house.

When I turned on the AC outlet in my server room, a Raspberry Pi loaded a SlackwareArm-14.2 system. And then, the Slackware system started an X server. Then, it started an xrdp server. And finally, it started a vnc server and gave it a password. From the funeral home, I attached to a Slackware system running on top of my internet-of-stings "operating system" (although, I would hardly call "Android" or whatever it is these things use nowadays an "operating system").

I started an X server on the Slackware system running on top of my local device. And, I used rdesktop to attach to the rdp compliant server running on top of the Raspberry Pi in my server room. And then, I loaded an html and ECMA compliant web browser (SeaMonkey). And, I used that browser to log in to my Gmail account. And (as usual), the web browser was able to send() login credentials to Gmail without any problem. And, the browser was then allowed to recv() Gmail's precious interface code so I could send a message. Solved.

So-- the big question was, "Why tf did this happen??" I quickly discovered that this was an incredibly mysterious problem (that Google of course *intentionally* created). If *you* are able to see why this happened, then you are more knowledgeable about Google's products than *I* am. And, I commend you!! But, me-- I spent over eight months poking around at this highly mysterious problem before I figured out how to overcome it. And now-- I am sharing the solution with you! :D

A few months later, the shitty company I worked for decided they would suddenly fire me-- with no warning and without any good reason. And, I was setting up an online timecard account for a different company a week later. And (as a result)-- I found myself in the same situation once again. I needed to log in to my Gmail account from a public location and send a single message. Again, I had to attach to my rdp Pi just to send the message. wtf??

I knew that Gmail's software wanted my GSM account name ("mobile phone number" as people have taken to calling it). And (from what I understood), Gmail's apache daemon would allow me to log in to my Gmail account if I stored my GSM name in my Gmail account. Supposedly (in a situation where I needed to log in to my account from a remote location), Gmail would send a message to my internet-of-stings device with a code. And then, I would be able to use the code to log in to my Gmail account (even from a remote location).

Now-- you (probably) know that I'm not the kind of guy who likes storing his GSM name on some random vendor's server. So, I put off doing this for some time. But eventually, I was stuck in the same situation. So-- I decided to try sharing my GSM name with Gmail's software. And, I tried it. And-- good God, the little fucker still wouldn't let me log in! I'm not even joking!! I actually received a code (in an SMS message) and typed it into Gmail's security system as an "extra level of security". And, Gmail's server gave me a message: "This is the correct code and credentials. However, Gmail is still not going to allow you log in to your own account. Ha! Ha! Ha!" Something like that.

I researched this message (can't remember the original message, but something like "You can prove you are the owner of the phone we sent a code. But, Gmail can't be sure you are the owner of the Gmail address you are trying to access.") And-- the mystery was finally solved. The email address I wanted to use was used to register all my Android devices. *This* was the real problem!!! :o

As it turns out-- if a user registers an Android device with a Gmail account, Gmail will not allow a user to log in to that account from any IP other than the IP address the user registered the Android device from! Can you believe that?? This is ABSOLUTELY unacceptible!!

What if a user moves? They will have to purchase internet service from a new provider. That means they will lose their IP address. And (I suppose) they will no longer be allowed to log in to the Gmail account they used to register their Android device?? What if there's a power outage? And, a user's router switches its IP address (by requesting DHCP from the user's ISP)? Again-- the user will no longer be allowed to log in to the Gmail account they used to register their Android device.

The only way this will be possible is if the user's Android device prompts them with a message: "Did you just log in to your Gmail account?" If the user still has that Android device (I have found the device will sometimes prompt a user and sometimes won't), then they can override Gmail's "extra security". If that Android device is say-- in a landfill somewhere (or at home, 1,300 miles away), the Gmail account is now inaccessible.

So-- here's how I solved this stupid problem. Knowing what the real problem was is the key. That's why I will say from here on out-- Google has a responsibility to inform a user that registering an Android device with a Gmail account will prevent a user from logging in to that account from an IP address other than the one they used to register the device. The fact that they don't do this is suspicious. And, this speaks to their character as a corporation.

What *I* did is-- I created a brand new Gmail account. I wanted to put the string "android" in the account name because I wanted this Gmail account to be used for one specific purpose-- registering Android devices. But (of course)-- there was a problem. Gmail does not allow a user to create a new account with the string "android" in the name. Apparently, Gmail developers have already thought of this. I even tried using "4ndroid". And (apparently), Gmail's software doesn't allow the string "droid", either. What I finally ended up going with was something like "4ndr0id". That name (plus some extra digits, because "4ndr0id" was already taken), finally got me what I wanted.

And, the next thing I did was-- I removed my primary email address from all my Android devices. And, I reinitialized the devices with my 4ndr0id Gmail name. Then (at my new job the next day), I tried logging in to my primary Gmail account. And-- it actually worked! I am now able to log in to my Gmail account from any html and ECMA compliant browser-- anywhere-- at any time!! So if Google is stupidly plaguing you with this ridiculous problem, just do what I did-- make a brand new account just for registering Android devices. And, why not make ten others while you're at it?

Because-- fuck Google. And, fuck the way they have decided to remove a user's ability to log in to their own account. This is bullshit. And, Google deserves to pay for what they've done. I've considered DDOS attacking their servers and script generating new accounts-- and filling them with data until they're full. *You* should do this, too (if you know how). If you don't know how, you should learn. Because, only Google's users can change Google's minds. The owners are (obviously) too stupid to understand the severity of the problem they have created.

I have no plans to use my 4ndr0id account (or any variants) for sending or receiving messages. I have no plans to use this account for *anything* other than registering Android devices. If I change my IP address-- if I'm out of town-- if I'm at a football game. Doesn't matter! I won't be using this email address for its intended purpose. And, thus-- I'll never need to log in to the account. And if I ever do-- no big deal. I'll just make a brand new Gmail account. And, I'll register my Android devices with that, instead. Solved.

In other news-- I finished chapter one of Ghosts of Glory High this weekend. I'm so excited! It's the most writing work I've done in a while. Setting a deadline for myself really helped. And, the first chapter turned out great. I've got nine to go. I'm hoping to finish chapter two of the story this month (February, 2020). I'm also developing a microkernel that runs on top of other operating systems. I plan on producing a working product this month as well. We'll see.

I would also like to write a plot summary for (at least) one of two Case's Cases books I plan to release simultaneously in the near future. But, I don't think I will finish that this month. Maybe next month. Enjoy the Gmail fix (you're welcome). And-- be talking at you again very soon.

Back

______________________________________________

Random Fact: Insanely Witty Stupidity has its own manual. The site has so many unusual features (completely invisible to a casual user) that they are carefully catalogued for educational purposes.

html revised 2024-04-17 by Michael Atkins.

The maintainer of insanelywittystupidity.com does not care if people duplicate this page or any part of it-- as long as this notice remains intact.