7 ms·

> There have been instances in the past where Google has locked the account of a user This happened to me recently (though I think for security concerns, not T

> There have been instances in the past where Google has locked the account of a user This happened to me recently (though I think for security concerns, not TOS violations), and was quite distressing. What steps can be taken to avoid this?

nickysielicki 9y ago
phone-based 2FA, physical security tokens, strong passwords, equally secured recovery email address, nontrivial recovery questions. Google accounts have far more security options than most online banking platforms. There's no reason you should lose your google account as long as you listen to the notifications that tell you to review your account security and go through the steps.
victorhooi 9y ago
Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people who get locked out are for fairly pedestrian reasons like password reuse across sites, and they got hijacked. It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). Trust me, there are a lot of bad actors out there, The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys. If you ever get locked out (e.g. account is suspected as compromised/hijacked), then: https://accounts.google.com/signin/recovery https://accounts.google.com/signin/recovery is your one-stop shop to prove you're really you.
- kuschku 9y ago
  > It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). That’s what happened to me. I had a Google account, abandoned since 2012, disabled. A few weeks ago I got an email telling me someone from russia was trying to log in, and this was prevented. The next day, another email – telling me that I successfully logged in from Russia, and had successfully changed the password. Google offered no way to get the account back. I had the creation date, a list of every email in the account, the used phone number (although it had since been shut down and recycled), the old password, and control over backup email. This was not enough, Google left the account in control of the attacker. I requested through a Google employee friend their internal form to handle this. Also, no success. Instead, they talked with the hijacker. In the end, I managed to contact the new owner of the recycled phone number, and together with him, I managed to run the account reset procedure, and regain control. ________________________ Conclusion: Google’s account "security" is useless against hijackers, prevents you from getting your account back, and is just a fucking pain in the ass.
- AlexCoventry 9y ago
  I had 2FA via a yubikey, though.

nickysielicki 9y ago

phone-based 2FA, physical security tokens, strong passwords, equally secured recovery email address, nontrivial recovery questions. Google accounts have far more security options than most online banking platforms. There's no reason you should lose your google account as long as you listen to the notifications that tell you to review your account security and go through the steps.

victorhooi 9y ago

Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people who get locked out are for fairly pedestrian reasons like password reuse across sites, and they got hijacked. It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). Trust me, there are a lot of bad actors out there, The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys. If you ever get locked out (e.g. account is suspected as compromised/hijacked), then: https://accounts.google.com/signin/recovery https://accounts.google.com/signin/recovery is your one-stop shop to prove you're really you.

kuschku 9y ago
> It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). That’s what happened to me. I had a Google account, abandoned since 2012, disabled. A few weeks ago I got an email telling me someone from russia was trying to log in, and this was prevented. The next day, another email – telling me that I successfully logged in from Russia, and had successfully changed the password. Google offered no way to get the account back. I had the creation date, a list of every email in the account, the used phone number (although it had since been shut down and recycled), the old password, and control over backup email. This was not enough, Google left the account in control of the attacker. I requested through a Google employee friend their internal form to handle this. Also, no success. Instead, they talked with the hijacker. In the end, I managed to contact the new owner of the recycled phone number, and together with him, I managed to run the account reset procedure, and regain control. ________________________ Conclusion: Google’s account "security" is useless against hijackers, prevents you from getting your account back, and is just a fucking pain in the ass.
AlexCoventry 9y ago
I had 2FA via a yubikey, though.