3 ms·

Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people

Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people who get locked out are for fairly pedestrian reasons like password reuse across sites, and they got hijacked. It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). Trust me, there are a lot of bad actors out there, The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys. If you ever get locked out (e.g. account is suspected as compromised/hijacked), then: https://accounts.google.com/signin/recovery https://accounts.google.com/signin/recovery is your one-stop shop to prove you're really you.

kuschku 9y ago
> It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). That’s what happened to me. I had a Google account, abandoned since 2012, disabled. A few weeks ago I got an email telling me someone from russia was trying to log in, and this was prevented. The next day, another email – telling me that I successfully logged in from Russia, and had successfully changed the password. Google offered no way to get the account back. I had the creation date, a list of every email in the account, the used phone number (although it had since been shut down and recycled), the old password, and control over backup email. This was not enough, Google left the account in control of the attacker. I requested through a Google employee friend their internal form to handle this. Also, no success. Instead, they talked with the hijacker. In the end, I managed to contact the new owner of the recycled phone number, and together with him, I managed to run the account reset procedure, and regain control. ________________________ Conclusion: Google’s account "security" is useless against hijackers, prevents you from getting your account back, and is just a fucking pain in the ass.
AlexCoventry 9y ago
I had 2FA via a yubikey, though.

kuschku 9y ago

> It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft). That’s what happened to me. I had a Google account, abandoned since 2012, disabled. A few weeks ago I got an email telling me someone from russia was trying to log in, and this was prevented. The next day, another email – telling me that I successfully logged in from Russia, and had successfully changed the password. Google offered no way to get the account back. I had the creation date, a list of every email in the account, the used phone number (although it had since been shut down and recycled), the old password, and control over backup email. This was not enough, Google left the account in control of the attacker. I requested through a Google employee friend their internal form to handle this. Also, no success. Instead, they talked with the hijacker. In the end, I managed to contact the new owner of the recycled phone number, and together with him, I managed to run the account reset procedure, and regain control. ________________________ Conclusion: Google’s account "security" is useless against hijackers, prevents you from getting your account back, and is just a fucking pain in the ass.

AlexCoventry 9y ago

I had 2FA via a yubikey, though.