HN Explorer

Google disables all G Suite accounts in our university due to spamming

69 points by user32556 ↗ HN
On November 5, several students reported that they cannot access their G Suite accounts. Google seems to disable all G Suite accounts in National Taiwan University (@g.ntu.edu.tw) due to spamming.

> "Your account is disabled due to spamming." https://i.imgur.com/G2ZCkcE.jpg (in traditional Chinese)

Fortunately, most services in the university do not depend on G Suite. They depend on a unversity account (@ntu.edu.tw).

24 comments

[ 3.7 ms ] story [ 53.9 ms ] thread
duxup
Sounds like something Google and that University need to work out. I am curious about what happened that they needed to shutdown G Suite.

My understanding is Google is a bit less likely to go full ban and just lock you out with no recourse with G Suite than regular services.

n_u_l_l
What might have happened is that an admin account of the university has been hacked, and someone is abusing it for spam.
duskwuff
Or a large number of accounts were created with placeholder credentials which were compromised in mass -- for example, passwords set to dummy values like "changeme", or to predictable values like the student's last name.
908B64B197
Sounds plausible.

It's a good thing to shut down early this type of spam, else other providers might start blocking *.tw domains and it will take longer for them to get unblocked.

[deleted]
(comment deleted)
someonehere
I wonder if they haven’t turned off the ability to use third party mail clients and enforce 2FA. It’s possible their accounts were compromised and someone was sending mail as them without their knowledge.

If the university has compromised credentials and allows third party mail clients to access without 2FA/unique codes enabled, then they’ve opened themselves up to being spammers.

jjd33
Trusting Google, an American company. While it is sad you shouldn't trust a foreign company nonetheless an American one.
sida
I don't know there is something inherently not trustworthy about Google or American company.

I think the main problem with Google (and perhaps part of the reason why Google is great in the first place) is that Google relies too heavily on algo solutions and when the algo makes a mistake, you cannot get to a real person for support

im3w1l
If Stanford had this issue, someone would know someone and it would get fixed.
toast0
Google is inherently untrustworthy because it's near impossible to get help if something goes wrong.

Additionaly, Google Workplace (or whatever it's called next week) is particularly unsuited for enterprise because even when you do get a hold of someone, they aren't willing or able to provide enterprise level support.

For example, we were getting a lot of spearphishing, so we wanted to disable links in inbound email; can't do that. Then we were aquired and wanted to merge our account into our acquirer; can't do that either.

FandangoRanger
>I don't know there is something inherently not trustworthy about Google or American company.

That something's called PRISM.

lern_too_spel
Why not simply disable sending email instead of shutting down the entire account? This heavy handed enforcement is what makes me want to get off Google productivity services.
londons_explore
I'm unaware of any Google product with any kind of per-user "admin" UI that only employees can access.

That kind of thing isn't good for security - an evil employee could use it for bad things.

Instead, all accounts get the same permissions, except disabled accounts (and in some cases blacklists for certain features, but these are avoided because maintainance of the list is a burden).

lern_too_spel
The permission can be marked on the account using the account management tool. The product would simply read the flag on the account, so the product would not have its own administration tool.

There is no technical reason why I should lose access to my documents if I happen to have abused some other Google service. There is just lack of will on Google's part.

tehwebguy
Apparently non-evil employees/bots can use it for bad things too.
kerng
Google automation in action. Another one bites the dust...
wcoenen
For anyone having trouble keeping up with the renames: "Google Apps" was renamed to "G Suite" in 2016, and was recently renamed again to "Google Workspace".
PsychicPebble
Also, recently Google has changed the look of the Google drive, Gmail, and probably most of G Suite's logos
homero
And Play movies is now Google TV
easytiger
At this point I think Google is being run by some runaway AI. Very little that they do makes sense to me
FandangoRanger
Good? They should have been doing this years ago. Look at how spammers operating with gmail addresses have screwed up Usenet, or as Google calls it, Groups.
user32556
Update by OP: Our university contacted Google and all G Suite accounts are back now.