Google Workspace - Revision history

Maltfield: paragraph formatting

2026-02-03T17:23:25Z

paragraph formatting

← Older revision		Revision as of 17:23, 3 February 2026
Line 48:		Line 48:

	= Why can't I login? =		= Why can't I login? =

			The best way to avoid lockout issues on Google is to use a [https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/ persistent single-site browser]. For more info, see:

			* https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/

	Unfortunately, Google employs an infamously faulty anomaly detection system<ref>https://support.google.com/a/answer/6002699?hl=en&ref_topic=2759193&sjid=814912251894340756-EU#zippy=%2Cwhen-does-google-consider-a-sign-in-attempt-suspicious</ref> that may false-positive due to a "suspicious login" that could lock you out of your own account -- even when you entered the correct password on the first try. Unfortunatly, Google is aware of the issue and refuses to let Google Workspace (or individual user) disable this broken "feature" for their accounts, even if it causes more harm than good <ref>https://knowledge.workspace.google.com/kb/how-to-disable-login-challenge-security-method-permanently-000007696</ref>.		Unfortunately, Google employs an infamously faulty anomaly detection system<ref>https://support.google.com/a/answer/6002699?hl=en&ref_topic=2759193&sjid=814912251894340756-EU#zippy=%2Cwhen-does-google-consider-a-sign-in-attempt-suspicious</ref> that may false-positive due to a "suspicious login" that could lock you out of your own account -- even when you entered the correct password on the first try. Unfortunatly, Google is aware of the issue and refuses to let Google Workspace (or individual user) disable this broken "feature" for their accounts, even if it causes more harm than good <ref>https://knowledge.workspace.google.com/kb/how-to-disable-login-challenge-security-method-permanently-000007696</ref>.
Line 62:		Line 66:

	Now you should be able to login and setup 2FA with TOTP to prevent this from happening again.		Now you should be able to login and setup 2FA with TOTP to prevent this from happening again.

	~~The best way to avoid lockout issues on Google is to use a [https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/ persistent single-site browser]. For more info, see:~~

	* https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/

	=References=		=References=

Maltfield: add link to article with more background info, and a solution to prevent google lockouts

2026-02-03T17:22:43Z

add link to article with more background info, and a solution to prevent google lockouts

← Older revision		Revision as of 17:22, 3 February 2026
Line 62:		Line 62:

	Now you should be able to login and setup 2FA with TOTP to prevent this from happening again.		Now you should be able to login and setup 2FA with TOTP to prevent this from happening again.

			The best way to avoid lockout issues on Google is to use a [https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/ persistent single-site browser]. For more info, see:

			* https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/

	=References=		=References=

Maltfield: /* System Alerts */

2025-02-09T00:04:17Z

System Alerts

← Older revision		Revision as of 00:04, 9 February 2025
Line 40:		Line 40:
	For more flexibility and security, rather than signing-up for an account directly with some shared <code>some-google-group-list@opensourceecology.org</code> account that's tied to a Google Group directly, we create a new user account for that account. Then you can [1] forward all of that account's mail to a Google Group and [2] grant other users to be able to access that account's mail.		For more flexibility and security, rather than signing-up for an account directly with some shared <code>some-google-group-list@opensourceecology.org</code> account that's tied to a Google Group directly, we create a new user account for that account. Then you can [1] forward all of that account's mail to a Google Group and [2] grant other users to be able to access that account's mail.

	To setup email forwarding, login as the <code>~~some~~-~~google~~-~~group~~-~~list~~@opensourceecology.org</code> account in gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Forwarding and POP/IMAP" tab. Under the "Forwarding" section, enter the email address of the Google Group. Make sure to check the correct radio button that says "Forward a copy of incoming mail to ..." and also leave the drop-down set to "keep ... copy in the inbox". This will ensure that, even if the Google Group gets moved or deleted in the future, all of the mail for this specific account will be retained in gmail. Finally, click "Save Changes".		To setup email forwarding, login as the <code>service-specific-shared-account@opensourceecology.org</code> account in gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Forwarding and POP/IMAP" tab. Under the "Forwarding" section, enter the email address of the Google Group. Make sure to check the correct radio button that says "Forward a copy of incoming mail to ..." and also leave the drop-down set to "keep ... copy in the inbox". This will ensure that, even if the Google Group gets moved or deleted in the future, all of the mail for this specific account will be retained in gmail. Finally, click "Save Changes".

	To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.		To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.

Maltfield at 19:53, 21 September 2024

2024-09-21T19:53:34Z

← Older revision		Revision as of 19:53, 21 September 2024
Line 8:		Line 8:
	= Why? =		= Why? =

	Google Workspace lets us create Google accounts with a username on the @opensourceecology.org domain. For example, when OSE users manage email, we can do so from a gmail-like UI. While we have access to numerous apps in Google Workspace, OSE specifically makes heavy use of the following apps:		Google Workspace lets us create Google accounts with a username on the <code>@opensourceecology.org</code> domain. For example, when OSE users manage email, we can do so from a gmail-like UI. While we have access to numerous apps in Google Workspace, OSE specifically makes heavy use of the following apps:

	# Google Mail		# Google Mail

Maltfield at 19:53, 21 September 2024

2024-09-21T19:53:12Z

← Older revision		Revision as of 19:53, 21 September 2024
Line 1:		Line 1:
	As a legally-registered NGO (non-profit in the US), Open Source Ecology has a free Google Workspace ~~(aka~~ Google Apps [gapps~~] or~~ Google Suite [gsuite]) ~~account.~~		As a legally-registered NGO (non-profit in the US), Open Source Ecology has a free Google Workspace account.

			Note that Google Workspace is also known as:

			# Google Apps (or gapps) and
			# Google Suite (or gsuite)

	= Why? =		= Why? =

Maltfield: /* Why can't I login? */

2024-09-21T19:51:57Z

Why can't I login?

← Older revision		Revision as of 19:51, 21 September 2024
Line 55:		Line 55:
	# Click on the "Security" tab		# Click on the "Security" tab
	# Scroll-down to "Login challenge" and clicked the "TURN OFF FOR 10 MINS" button <ref>https://knowledge.workspace.google.com/kb/how-to-turn-off-2-step-verification-for-specific-users-000007496</ref>		# Scroll-down to "Login challenge" and clicked the "TURN OFF FOR 10 MINS" button <ref>https://knowledge.workspace.google.com/kb/how-to-turn-off-2-step-verification-for-specific-users-000007496</ref>

			Now you should be able to login and setup 2FA with TOTP to prevent this from happening again.

	=References=		=References=

Maltfield: /* Why can't I login? */

2024-09-21T19:50:38Z

Why can't I login?

← Older revision		Revision as of 19:50, 21 September 2024
Line 44:		Line 44:
	= Why can't I login? =		= Why can't I login? =

	Unfortunately, Google employs an infamously faulty anomaly detection system<ref>https://support.google.com/a/answer/6002699?hl=en&ref_topic=2759193&sjid=814912251894340756-EU#zippy=%2Cwhen-does-google-consider-a-sign-in-attempt-suspicious</ref> that may false-positive ~~and~~ due to a "suspicious login" that could lock you out of your own account -- even when you entered the correct password on the first try. Unfortunatly, Google is aware of the issue and refuses to let Google Workspace (or individual user) disable this broken "feature" for their accounts, even if it causes more harm than good <ref>https://knowledge.workspace.google.com/kb/how-to-disable-login-challenge-security-method-permanently-000007696</ref>.		Unfortunately, Google employs an infamously faulty anomaly detection system<ref>https://support.google.com/a/answer/6002699?hl=en&ref_topic=2759193&sjid=814912251894340756-EU#zippy=%2Cwhen-does-google-consider-a-sign-in-attempt-suspicious</ref> that may false-positive due to a "suspicious login" that could lock you out of your own account -- even when you entered the correct password on the first try. Unfortunatly, Google is aware of the issue and refuses to let Google Workspace (or individual user) disable this broken "feature" for their accounts, even if it causes more harm than good <ref>https://knowledge.workspace.google.com/kb/how-to-disable-login-challenge-security-method-permanently-000007696</ref>.

	If this happens, try enabling 2FA (with TOTP) in your account. It ''should'' prevent Google from locking you out of your own account, even if you enter the correct password on the first try.		If this happens, try enabling 2FA (with TOTP) in your account. It ''should'' prevent Google from locking you out of your own account, even if you enter the correct password on the first try.
Line 55:		Line 55:
	# Click on the "Security" tab		# Click on the "Security" tab
	# Scroll-down to "Login challenge" and clicked the "TURN OFF FOR 10 MINS" button <ref>https://knowledge.workspace.google.com/kb/how-to-turn-off-2-step-verification-for-specific-users-000007496</ref>		# Scroll-down to "Login challenge" and clicked the "TURN OFF FOR 10 MINS" button <ref>https://knowledge.workspace.google.com/kb/how-to-turn-off-2-step-verification-for-specific-users-000007496</ref>


	=References=		=References=

Maltfield at 19:50, 21 September 2024

2024-09-21T19:50:15Z

@@ Line 41: / Line 41: @@
 {{Warning|Please note that "reset password" functionality usually works by sending a link to a user's email address, so we should assume that '''anyone either on the Google Groups list or under the "Grant access to your account" list will be able to login''' to these services, '''even if they don't have the account password'''. So please only ever put trusted users on this list.
 }}
 =References=

Maltfield: /* System Alerts */

2024-09-21T19:28:06Z

System Alerts

← Older revision		Revision as of 19:28, 21 September 2024
Line 33:		Line 33:
	For security reasons, it's always better to use services that ''don't'' use shared logins. If possible, create one user account per person and grant that user account access to the OSE account. Unfortunately, this isn't possible with many services -- and we're forced to use one shared account.		For security reasons, it's always better to use services that ''don't'' use shared logins. If possible, create one user account per person and grant that user account access to the OSE account. Unfortunately, this isn't possible with many services -- and we're forced to use one shared account.

	For more flexibility and security, rather than signing-up for an account directly with some shared <code>~~something~~@opensourceecology.org</code> account that's tied to a Google Group directly, we create a new user account for that account. Then you can [1] forward all of that account's mail to a Google Group and [2] grant other users to be able to access that account's mail.		For more flexibility and security, rather than signing-up for an account directly with some shared <code>some-google-group-list@opensourceecology.org</code> account that's tied to a Google Group directly, we create a new user account for that account. Then you can [1] forward all of that account's mail to a Google Group and [2] grant other users to be able to access that account's mail.

	To setup email forwarding, login as the <code>~~something~~@opensourceecology.org</code> account in gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Forwarding and POP/IMAP" tab. Under the "Forwarding" section, enter the email address of the Google Group. Make sure to check the correct radio button that says "Forward a copy of incoming mail to ..." and also leave the drop-down set to "keep ... copy in the inbox". This will ensure that, even if the Google Group gets moved or deleted in the future, all of the mail for this specific account will be retained in gmail. Finally, click "Save Changes".		To setup email forwarding, login as the <code>some-google-group-list@opensourceecology.org</code> account in gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Forwarding and POP/IMAP" tab. Under the "Forwarding" section, enter the email address of the Google Group. Make sure to check the correct radio button that says "Forward a copy of incoming mail to ..." and also leave the drop-down set to "keep ... copy in the inbox". This will ensure that, even if the Google Group gets moved or deleted in the future, all of the mail for this specific account will be retained in gmail. Finally, click "Save Changes".

	To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.		To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.

Maltfield at 19:25, 21 September 2024

2024-09-21T19:25:23Z

← Older revision		Revision as of 19:25, 21 September 2024
Line 39:		Line 39:
	To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.		To grant Marcin or anyone else access to this new service-specific account's mail, login as the account in Gmail. Click on the settings "gear icon" in the top-right of the webpage. Click on the "Accounts" tab. Under the "Grant access to your account" section, click "Add an account" and enter the email address of the person (eg Marcin) that you want to give access to be able to read and write mail on behalf of this user.

	{{Warning\|Please note that "reset password" functionality usually works by sending a link to a user's email address, so we should assume that '''anyone either on the Google Groups list or under the "Grant access to your account" list will be able to login'' to these services, '''even if they don't have the account password'''. So please only ever put trusted users on this list.		{{Warning\|Please note that "reset password" functionality usually works by sending a link to a user's email address, so we should assume that '''anyone either on the Google Groups list or under the "Grant access to your account" list will be able to login''' to these services, '''even if they don't have the account password'''. So please only ever put trusted users on this list.
	}}		}}