Tell HN: A stranger is using my YouTube account and Google can't log them out

You shouldn't be telling this to tier-1 support, you should be reporting it through a contact that's labeled as specifically being for reporting security issues affecting Google login, ie https://bughunters.google.com/ . This is a significant security vulnerability because the existence of this TV implies the existence of an API somewhere which the TV has used, which can create revocation-resistant keys.

(I ran into a similar issue with the Oculus/Meta Quest 2 and Facebook login tokens. I reported it as a vulnerability in the Facebook account system and it was fixed eventually.)

I know this is going to sound ridiculous, but go to this random support forum and try to get ahold of Didi; they seem to have some kind of "in" with the account hijacking team and can get your account moved into a different kind of support queue.

https://support.google.com/youtube/community

In Google's OAuth 2.0 for TV and Limited-Input Device Applications page, https://developers.google.com/identity/protocols/oauth2/limi..., it says:

"Note that there are limits on the number of refresh tokens that will be issued; one limit per client/user combination, and another per user across all clients. You should save refresh tokens in long-term storage and continue to use them as long as they remain valid. If your application requests too many refresh tokens, it may run into these limits, in which case older refresh tokens will stop working."

Maybe you could try issuing thousands of OAuth refresh tokens (or more) for your account, in the hope that it will hit some internal limit and automatically revoke the one stored inside that Smart TV?

Some services still allow the less sensitive account actions after logging out.

Examples of this are eBay (can still edit cart) and AliExpress (can still see unread messages count).

Perhaps YouTube has decided that appending to the watch history is a sufficiently low risk operation that it's fine to do post-logout?

Implementation-wise, I can imagine that watch history is something that might be updated from logs, and therefore there isn't an opportunity to renew any Auth tokens interactively.

My uneducated guess:

The app is in fact logged out, but it is still sending search logs back to YouTube using a device or session identifier. If you use YouTube logged out, for example, you’ll still have a history, which is tied to your session/device or something. There must be some system within YouTube that’s reconciling the TV’s logs back to your account, since it used to be your device.

Get him to log you out?

Maybe start watching videos on how to log out of that TVs YouTube app and also that weird softcore porn adjacent content. How to shuffle and trying on videos etc.

Hopefully the new user will decide to logout to get control of suggested content?

This should help:

"1. Open https://myaccount.google.com/device-activity on any device.

2. Select the device you’d like to sign out of.

3. Select Sign out.

You can also remove YouTube on TV access for a Google Account by opening https://myaccount.google.com/permissions > select YouTube on TV > Remove Access."

https://support.google.com/youtube/answer/7612539?hl=en

You should try to converse with them through the search history. Search for something like "Hello I am the previous owner of this TV. Please logout from Youtube.".

If the stranger is not a bad actor, they will definitely be happy to log out.

Could you try enabling advanced protection (if you are comfortable)? When I made that change I was forcefully logged out everywhere. (Disclaimer: used to work at Google, don't anymore, didn't work on accounts)

I've actually had this issue myself. It was a rogue chrome extension that was racking up massive viewing numbers on these videos. Disable all your extensions and see if your problem stops.

Try enabling advanced data protection. If they can still log in then you have found a huge vuln.

"my old Smart TV that I gave away"

Gave away to whom ? Did you donate or give it to an actual person. Perhaps just ask them to log you out ? Or do you think they are a bad actor ?

Wife and I stayed at Ronald McDonald House when our kid needed some doctors appts up in Salt Lake 4 hours away. Someone's youtube account was logged in, and I'm not sure how long it was that way. They really liked 'dr nosleep' channel apparently.

You mentioned you have MFA activated, so you should also remove any App passwords[1] you might have created for the TV.

[1]https://support.google.com/accounts/answer/185833?hl=en

Have you tried clearing your watch history and resetting your add ID?

Or disabling and then re enabling your watch history (perhaps leave it a day in between)

Just delete your YT account, and create a new one. From what I just read, it should be possible to delete YT without deleting your whole Google account.

What brand TV ?