social.noyu.me

what was the activity? you give me no information, only that it is “suspicious”

what IP address was the user using? you won't tell me

do you know anything else? well, you won't tell me that either

this is incredibly unhelpful

oh, they do give very approximate location info, but not on the page for the activity itself, and less precisely than when i get a 2FA prompt. google what the fuck are you doing

look at this shit. LOOK AT IT. this is all the information google provides me accessing the page by the most normal route, the one that you take when they send you an email warning

things that would be infinitely more helpful:

• google, i have more than one device that you think is a Mac. you're wrong about that, but still. but i know you have more information than this. at least tell me the history of the session token!!!
• GIVE ME THE IP DAMNIT

while i'm at it, the “Next” button on the “Verify your recovery email” screen (part of the “Add or confirm your recovery email or phone number” sequence, after confirming the phone number) seems to do nothing whatsoever????

have google never heard of the concept of the boy who cries wolf. to know whether their warnings are credible i need to know WHY it thinks activity is suspicious, WHAT that activity is, and WHICH device it happened on. not just some “Mac”. which. i know you know more than that.

see google could, if they cared, tell me all of the following:

• the full user-agent string
• the IP address
• when that session token was created (when did someone log in)
• what has that session token been doing recently
• what characteristics the device has (screen size?)

i can probably tell if it's my phone or my laptop whose session token has been hijacked, or not hijacked, based on this information! i can probably tell if the false positive is caused by me using the “desktop mode” option in my browser! but you have to give me INFORMATION

@hikari if they work anything like how it seems to work here, then they probably did a “user study” (showed people thee different photoshop mockups), found one person that said “well it’s a bit confusing with so much information”, and too that as justification to create a “clean design” or such

@hikari Workspaces for business is maybe even worse. As an admin on the company account, I get spam and phishing notifications, but literally no actionable information or tools to address it. There are no logs, no headers, usually nothing about the sender. And, even if there were actionable information, I don't have the ability to do anything on user accounts (I can create/delete/disable users, but nothing useful WRT mail). It's just, "There was some kind of abuse, worry about it."