Against risk-based authentication (or, why I wouldn't trust Google Cloud)
You shouldn't trust Google cloud because they'll leave you hanging out to dry. You can get yourself into a situation where your account is locked and nobody at Google will help you get back into your account. Even if you spend tens of thousands a month. There's no way to escalate your way to a resolution with a normal human being, because they care more about what they spend on support than the customer. AWS would never do that.<p>However, risk based security isn't the problem. Risk based security has been implemented by every major company (interested in security for its users) for the last 15 years. It has nothing to do with whether you'll be locked out of an account without recourse or whether there are alternative ways for you to log in. I used to maintain those systems using middleware. Properly implemented, they're only an inconvenience to a tiny subset of users that constantly use new devices from new locations without 2FA. <i>And</i> you can turn them off for specific users, add an alternative authentication method/criteria, or even fine tune the sensors.<p>Google's implementation is crap, and the lack of support is dangerous. But risk based security is fine.