[HN Gopher] Tell HN: A stranger is using my YouTube account and ...
___________________________________________________________________
Tell HN: A stranger is using my YouTube account and Google can't
log them out
Hi HN, I believe Google has a grave authentication issue and I
cannot burst the impenetrable tier-1 support wall to solve it.
Hopefully I'm wrong, but for the life of me and the support reps I
talked to, we cannot get a stranger logged out of my YouTube
account. The stranger is using my YouTube account through my old
Smart TV that I gave away (my bad for not logging out, but there
should be recourse for this). Once I discovered this, I have
changed passwords and revoked auth tokens on all relevant services
(Spotify, Disney+, etc.). All services no longer show the stranger
accessing them - with the exception of YouTube. The actions I've
taken multiple times (as instructed by Google support): - Changed
my Google account's password - Revoked all "devices I trust" under
my 2FA settings - Logged out of all devices in the "Your Devices"
list This did force me to log back in on my own devices (phone,
TV), but I still see new videos that the stranger watched in my
YouTube history. This has been happening for weeks. Google support
walked me through these steps and then gave generic "make sure your
password are strong" article links, but of course, refuse to
escalate this. If you wish, you can view the support transcripts
here (I admittedly got a little short during the 2nd conversation,
which I regret): https://pastebin.com/GypwBPFj --- Some details:
- The videos in my view history are in Arabic, so I know it's the
stranger who watches them - I know the stranger has access through
my old TV because I saw their activity on all apps I had installed
on my TV, and I saw my old TV signed in from a distant city under
"Your Devices" list
Author : PeledYuval
Score : 46 points
Date : 2023-01-05 19:45 UTC (3 hours ago)
| tuckerman wrote:
| Could you try enabling advanced protection (if you are
| comfortable)? When I made that change I was forcefully logged out
| everywhere. (Disclaimer: used to work at Google, don't anymore,
| didn't work on accounts)
| jimrandomh wrote:
| You shouldn't be telling this to tier-1 support, you should be
| reporting it through a contact that's labeled as specifically
| being for reporting security issues affecting Google login, ie
| https://bughunters.google.com/ . This is a significant security
| vulnerability because the existence of this TV implies the
| existence of an API somewhere which the TV has used, which can
| create revocation-resistant keys.
|
| (I ran into a similar issue with the Oculus/Meta Quest 2 and
| Facebook login tokens. I reported it as a vulnerability in the
| Facebook account system and it was fixed eventually.)
| japanman425 wrote:
| Not really. It's just a long lived refresh token. You can
| revoke the app it's associated to but OP seems unaware.
| bmitc wrote:
| How then?
| urbandw311er wrote:
| OP has listed the steps they took to revoke connected
| devices, what additional revocation are you referring to?
| feklest wrote:
| In Google's _OAuth 2.0 for TV and Limited-Input Device
| Applications_ page,
| https://developers.google.com/identity/protocols/oauth2/limi...,
| it says:
|
| "Note that there are limits on the number of refresh tokens that
| will be issued; one limit per client/user combination, and
| another per user across all clients. You should save refresh
| tokens in long-term storage and continue to use them as long as
| they remain valid. If your application requests too many refresh
| tokens, it may run into these limits, in which case older refresh
| tokens will stop working."
|
| Maybe you could try issuing thousands of OAuth refresh tokens (or
| more) for your account, in the hope that it will hit some
| internal limit and automatically revoke the one stored inside
| that Smart TV?
| saurik wrote:
| I know this is going to sound _ridiculous_ , but go to this
| random support forum and try to get ahold of Didi; they seem to
| have some kind of "in" with the account hijacking team and can
| get your account moved into a different kind of support queue.
|
| https://support.google.com/youtube/community
| creakingstairs wrote:
| I do find it ridiculous that getting Google support has gotten
| to a point where people need to post for help on a forum in
| which they are hinted to go to another community and look for a
| person who has "in" with a team.
|
| I really should move off Gmail.
| aliqot wrote:
| > I really should move off Gmail.
|
| Just curious, what's the line, if not this? Hypothetically of
| course, I'm okay with it if you're responding with "I'd
| rather not say" or "I don't know"
| mindcrash wrote:
| This should help:
|
| "1. Open https://myaccount.google.com/device-activity on any
| device.
|
| 2. Select the device you'd like to sign out of.
|
| 3. Select Sign out.
|
| You can also remove YouTube on TV access for a Google Account by
| opening https://myaccount.google.com/permissions > select YouTube
| on TV > Remove Access."
|
| https://support.google.com/youtube/answer/7612539?hl=en
| theshrike79 wrote:
| I'm guessing this smart TV is using some kind of weird
| nonstandard auth scheme that has fallen through the cracks.
|
| Maybe it's storing some kind of non-expiring login token that
| isn't invalidated using the regular process.
| kirykl wrote:
| What brand TV ?
| maerF0x0 wrote:
| Perhaps OP has Dissociative identity disorder and doesn't realize
| they're the one watching those videos?
| filoleg wrote:
| Unless there is a kind of DID that also makes you speak arabic
| (which you normally don't know how to) and shows your logged-in
| TV that you sold being located in a distant random location, I
| seriously doubt your theory.
| maerF0x0 wrote:
| aww yeah, i forgot we cant have any fun on HN xD
| Liebnitz wrote:
| Yeah, um... nope!! My minus karma ratings (on my first
| account) prove that, and yet NO ONE told me anything about
| it, even though I was a total newbie. Stoopid site for
| entitled nurbs...
| [deleted]
| codegeek wrote:
| "my old Smart TV that I gave away"
|
| Gave away to whom ? Did you donate or give it to an actual
| person. Perhaps just ask them to log you out ? Or do you think
| they are a bad actor ?
| smoothgrammer wrote:
| Try enabling advanced data protection. If they can still log in
| then you have found a huge vuln.
| psychphysic wrote:
| Get him to log you out?
|
| Maybe start watching videos on how to log out of that TVs YouTube
| app and also that weird softcore porn adjacent content. How to
| shuffle and trying on videos etc.
|
| Hopefully the new user will decide to logout to get control of
| suggested content?
| Genbox wrote:
| You mentioned you have MFA activated, so you should also remove
| any App passwords[1] you might have created for the TV.
|
| [1]https://support.google.com/accounts/answer/185833?hl=en
___________________________________________________________________
(page generated 2023-01-05 23:02 UTC)