You can even log out particular devices on account.google.com (security tab ? your devices). This is a weak protection, however, since they're probably cached on the phone.
It seems possible to disable this by manually logging out of all your devices in google account management, then never using them to log into your google account again. I've done that, but the fact that this is the only solution is unbelievably insane.
The article mentions this: "session cookies that allowed access to Netflix and YouTube (and attached Gmail accounts)"
If you use Gmail it's worth knowing how to log a device off from a different device because it's likely that one day you'll have a device stop working or get lost while it was logged on: Google Account -> Manage your Google Account -> Security -> Your devices -> Manage devices -> ... -> Sign out
You should be able to de-authorize it from any working Google login on another device - the security page shows all of your other Google sessions, and you can kill any of them. It even nags you to kill ones that haven't been used in over a month or so. Seems to be even more effective than logging out on the device, though that's probably a good idea too if you can.
If you have a Google account, it might not be such a bad idea to check on it occasionally and make sure there's nothing turned on that you want to be turned off or deleted? (In particular, connections to other apps that you might have forgotten about.)
Could you try enabling advanced protection (if you are comfortable)? When I made that change I was forcefully logged out everywhere. (Disclaimer: used to work at Google, don't anymore, didn't work on accounts)
In terms of user security, that's just not a good idea. Google has likely prevented an absurd number of account compromises (and therefore identity theft, fraud, personal information leakage, espionage...) by recognizing logins from new devices and unfamiliar locations. Google's user account security practices are pretty much the best in the business.
It's silly to think Google doesn't already know everything about every device you log in from, so that horse is already out of the barn and running on the highway privacy-wise. They might as well use that information to actually protect their users since they're already using it for advertising.
This is super easy to do accidentally if you log into Google while simulating a mobile device in Chrome devtools, because your user agent string tells Google what device you are using.
reply