4 ms·

A few years back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it. I tried to go through the

by 40four 7y ago

A few years back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it. I tried to go through the appropriate support channels more than once. Filled out extensive forms, even identified recent emails like they asked, to no avail. It was very disappointing, considering I had spent a good amount of money purchasing apps/ games etc. with that account. What a waste. Unless you get rescued here by a personal favor of a Googler, I would imagine that account is good as dead.

zozbot234 7y ago
2 factor authentication (w/ security tokens, mobile "apps" etc.) comes with an inherent risk of getting locked out of stuff. Most of the time you can mitigate that risk by generating "recovery" codes in advance, but it's still something to be aware of.
- 40four 7y ago
  Yeah for sure, It was kind of my fault. It all happened very quickly, I think 2FA was relatively new at the time. I kept getting ‘recommendations’ from Google to enable it to be more secure. As a dutiful user I obliged, and downloaded the authenticator app. I think it gave me 10 one time recovery codes, but of course I didn’t back them up externally :) I was having some performance issues with my Samsung phone at the time, and a couple days later, did a factory reset. Then when it came back on and I tried to log into my google account, my stomach sank to the floor when I realized I could not get in without the authenticator app. That was that. Everything gone. What an idiot :) Couldn’t even get on through a computer without the stupid codes I could no longer generate. Answered all the questions, identified specific emails, personal info etc. Google was not impressed.
  - zozbot234 7y ago
    > I kept getting ‘recommendations’ from Google to enable it to be more secure. Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.
    - 40four 7y ago
      Agreed. The whole app based 2FA does not seem great in retrospect. I accidentally bricked my whole account, by simple user error. That’s a good point, that it could just happen from a hardware malfunction as well. Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.
  - petee 7y ago
    I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too. This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.
- hysan 7y ago
  While true, this is more of a Google problem than a 2FA problem. Google will lock you out of your account even without 2FA if it cannot recognize you. It happened to me on a Google Apps account that does not have 2FA.[1] Customer service should be present to handle edge cases. [1] https://news.ycombinator.com/item?id=21168834 https://news.ycombinator.com/item?id=21168834
gambler 7y ago
>A few year back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it. This is the downside (or hidden cost) of 2FA that most security experts purposefully ignore, because they work for companies like Google and only care about account security rather than user security.
- kabdib 7y ago
  I did a 2FA system a while back. The happy login path and crypto work took a couple of days, and the mobile app work was similarly easy. Probably 80% of the effort was working through account recovery and other support-related issues.
LockAndLol 7y ago
Do you still use Google?
- 40four 7y ago
  Haha, no I have almost completely removed myself from their grip. I still use a couple accounts, but they are not primary. Only throwaway purposes, and the only app I use with them is gmail. All activity settings and history are turned off and cleared. I have an iPhone now. I should probably go ahead and cut ties with the throwaway gmails, not serving much purpose now. I do find it hard to stop using Google maps and Waze. But I use maps without logging in, not sure it makes a difference though.

by 40four 7y ago

zozbot234 7y ago

2 factor authentication (w/ security tokens, mobile "apps" etc.) comes with an inherent risk of getting locked out of stuff. Most of the time you can mitigate that risk by generating "recovery" codes in advance, but it's still something to be aware of.

40four 7y ago
Yeah for sure, It was kind of my fault. It all happened very quickly, I think 2FA was relatively new at the time. I kept getting ‘recommendations’ from Google to enable it to be more secure. As a dutiful user I obliged, and downloaded the authenticator app. I think it gave me 10 one time recovery codes, but of course I didn’t back them up externally :) I was having some performance issues with my Samsung phone at the time, and a couple days later, did a factory reset. Then when it came back on and I tried to log into my google account, my stomach sank to the floor when I realized I could not get in without the authenticator app. That was that. Everything gone. What an idiot :) Couldn’t even get on through a computer without the stupid codes I could no longer generate. Answered all the questions, identified specific emails, personal info etc. Google was not impressed.
- zozbot234 7y ago
  > I kept getting ‘recommendations’ from Google to enable it to be more secure. Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.
  - 40four 7y ago
    Agreed. The whole app based 2FA does not seem great in retrospect. I accidentally bricked my whole account, by simple user error. That’s a good point, that it could just happen from a hardware malfunction as well. Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.
- petee 7y ago
  I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice. Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too. This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.
hysan 7y ago
While true, this is more of a Google problem than a 2FA problem. Google will lock you out of your account even without 2FA if it cannot recognize you. It happened to me on a Google Apps account that does not have 2FA.[1] Customer service should be present to handle edge cases. [1] https://news.ycombinator.com/item?id=21168834 https://news.ycombinator.com/item?id=21168834

gambler 7y ago

>A few year back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it. This is the downside (or hidden cost) of 2FA that most security experts purposefully ignore, because they work for companies like Google and only care about account security rather than user security.

kabdib 7y ago
I did a 2FA system a while back. The happy login path and crypto work took a couple of days, and the mobile app work was similarly easy. Probably 80% of the effort was working through account recovery and other support-related issues.

LockAndLol 7y ago

Do you still use Google?

40four 7y ago
Haha, no I have almost completely removed myself from their grip. I still use a couple accounts, but they are not primary. Only throwaway purposes, and the only app I use with them is gmail. All activity settings and history are turned off and cleared. I have an iPhone now. I should probably go ahead and cut ties with the throwaway gmails, not serving much purpose now. I do find it hard to stop using Google maps and Waze. But I use maps without logging in, not sure it makes a difference though.