5 ms·
I got the impression that step 1 isn't needed, it was more: 1. Create a google account and set your recovery email to the victims. 2. Use the new account to c
by flukus 8y ago
I got the impression that step 1 isn't needed, it was more:
1. Create a google account and set your recovery email to the victims.
2. Use the new account to commit a range of ToS violations.
3. Wait for Google to suspend the entire GSuite account and every linked account.
For step 1 I don't think there is (or at least wasn't) any validation, I found out a family member had me as their recovery address when they changed passwords.
- hknd 8y agoA "victim" would need to approve being used as a recovery account. (click link in mail etc.)
- aritmo 8y agoNo. Ironically, this is opt-out, not opt-in. That is, you (as recovery email holder) would need click the link ONLY if you want to unlink. The URL is in the footer of the email and it is easy to miss.
- whyagaindavid 8y agoNo. It is opt-in. You need to type the 6 digit code from recovery email id into your settings.
- dane-pgp 8y agoHaving to actually type in a code sounds like a smart move on Google's part, to avoid spear-phishing and XSS attacks.
- squeaky-clean 8y agoI just now added my personal email as a recovery to my work email to test this. It is opt-out. > Subject: "Someone added you as their recovery email" > Someone added <mypersonalemail>@gmail.com as their recovery email > <myworkemail>@<myworkdomain>.com wants your email address to be their recovery email. > If you don’t recognize this account, it’s likely your email address was added in error. You can remove your email address from that account. Disconnect email The "Disconnect email" at the end is an opt-out link.
- jarym 8y agoWow. Well this just keeps getting better. No wonder Google don't want to discuss their suspension practices - just another form of '(in)security through obscurity'. If the hearsay is correct then this appears to be a hole the size of a galaxy!
- giancarlostoro 8y agoThey recently started to notify the other email, they wouldn't stop emailing me to verify on my new recovery email after I added it in.