10 ms·

> My mom forgot her gmail password and no longer had the same mobile number for a reset, the secondary reset option was set to my email but would not send a res

by jjcon 6y ago

> My mom forgot her gmail password and no longer had the same mobile number for a reset, the secondary reset option was set to my email but would not send a reset despite this. I’m in a similar position except I know my password. Google decided for whatever reason that my location was too different and now requires that I verify via a phone number I no longer have. I have access to the recovery email and even get ‘suspicious login prevented emails’ at the recovery address. I tried working through google support and was given a form to fill out but never heard back. I should have kept that number until I updated it yes... but I thought knowing the password and having the recovery email would be enough.... guess not. But yeah... fuck you google.

Triv888 6y ago
I've had that problem too, multiple times, where I knew the password but Google wouldn't let me use it (I almost lost my account). Google doesn't like users that clear cookies, block trackers, etc... I wish that there was a way to disable those "protections".
- tharkun__ 6y ago
  There is a really really simple one (at least for your private life but if your company uses G-Suite, you always have the admin to take care of things you forget): Do not use Google! It's as simple as that. I have never had a Gmail account until an Android device sort of forced it on me, because I definitely didn't want to link things up to my real email address, so I just signed up for the whole thing. Do I ever use that email address? Definitely not! Why would I? What happens if I ever loose access to that account? I have to register a new one for my Android device(s). Boohoo. Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. No longer have a PC and do everything including your banking, gaming etc. with the tablet (i.e. things you really need or things you paid a lot of money for)? Well, welcome to the walled garden where Google practically owns you.
  - thaumasiotes 6y ago
    > Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. Pleco is a necessity for me, but it's not tied to the Google account. It has its own registration system. Same goes for WeChat. The Android Kindle app isn't really a necessity, but it's desirable. It, too, has its own registration system. It's certainly tied to my Amazon account, but not to my Google account.
    - everdrive 6y ago
      This is part of why I try to stay away from apps; once you become reliant, you're stuck. It's best if there's a desktop client, (and particularly one that is not bad for privacy, but usually these things work better on a desktop) since it will not keep you tied to a device or ecosystem.
    - tharkun__ 6y ago
      That is absolutely the right way to deal with it. Bravo! Use the apps that have their own accounts, don't require an account etc. I do the same actually and don't use apps or services that will only allow you to "Login with Facebook", "Login with Google" etc.
  - behringer 6y ago
    Google's screwed over more than a few g suite admins. Caution is advised in all things Google.
  - rossjudson 6y ago
    You should keep it all on paper instead, because nothing ever happens to that. ;) I do think there is substantial room for a kind of "major provider reset" service, similar (at least) to what banks do physically. Lost your account access? You need to GO to a place, be on video, have an ID check done, multiple forms of whatever identification. It costs to do this kind of thing, and as a last resort I'm pretty sure most people would want to pay it, instead of losing account access. Your argument seems to be "It would be massively inconvenient to lose access to these things so instead I will not have these things."
- geofft 6y ago
  Do you have 2FA enabled? I suspect that if you have either an authenticator app or a security key, it will use that instead of random heuristics. (This isn't a defense of Google's behavior, just a comment on things that are actually within the end user's control.)
  - Triv888 6y ago
    I don't want 2FA and I have it disabled but they often ask me for more than my password which is like forcing 2FA on me (but what you say may be true).
    - yspeak 6y ago
      Why don't you want 2fa? What concern do you have? You can use fido key if you have concerns about the software authenticator. and you don't need to use your phone number.
  - Can_Not 6y ago
    I tried to setup 2FA, Google would not let me setup an authenticator app without first giving Google a phone number.
    - katbyte 6y ago
      It’s phone number -> auth app -> umbikey -> remove phone number. None of my google accounts use my number for 2fa anymore
      - TeMPOraL 6y ago
        I wonder if that last step shouldn't be followed by a GDPR notice to stop processing your phone number, if you're in Europe - because I don't imagine they aren't storing your number anyway, after you remove it from auth options.
    - kelnos 6y ago
      I have a Twilio number I use as my Google recovery number (which is only used for that purpose). In my case, it's because I want to protect against SIM swapping attacks on my real phone number, but it also works for people who don't want to give out their real number. This doesn't work for services that send SMS 2FA codes and the like from a shortcode (as Twilio does not support receiving those), but Google appears to send from a longcode, so it works there.
KMag 6y ago
As someone who occasionally moves countries, this is horrifying. Did you enable 2FA and still need to authenticate via text? I used to enable 2FA, but got worried about phone loss/damage.
- koolba 6y ago
  Do they even let you enable non-SMA 2FA anymore? Last I checked the TOTP option was gone.
  - viraptor 6y ago
    On Google? Both totp and second device authentication are still supported.
    - donmcronald 6y ago
      Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure. Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!
      - geofft 6y ago
        In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
      - viraptor 6y ago
        > Now there are 4 ways to compromise your account. No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page. They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.
meibo 6y ago
They ask you regularly if the data is still up to date and have disclaimers about situations like this when you register the phone number as an actual authentication factor. Not saying that this isn't at least partly on Google, they should have responsive customer service that can verify accounts - but you could have easily prevented that by being less lazy with keeping your data up to date. Security and account recovery is the one thing you shouldn't cheap out on.
- jjcon 6y ago
  I moved across a border like 20 minutes away and got a new number - it is extremely common that both things change at the same time for people. It wasn’t a months old number or anything.
  - nly 6y ago
    Wait, is this a mobile (cell) phone number? Why is this tied to where you live? In the UK you can take your mobile number with you between network providers and they're not tied to your location.
    - maccard 6y ago
      Not everyone moves in the same country. I moved from Ireland to the UK 8 years ago and the process of updating phone numbers and addresses is just flat out impossible on certain services.
      - fogihujy 6y ago
        Not sure about Irish/UK rules regarding this, and it might not be possible everywhere, but if anyone else happens to be in that situation in the future then I can wholeheartedly recommend transferring the old number to a prepaid card, and then simply bringing that along. That way, you can keep your old number for as long as you keep the SIM topped up (once per year where I lived).
    - Broken_Hippo 6y ago
grecy 6y ago
Yikes. I've logged into my gmail account from 55 different countries, and I've never had a problem. Some of those countries must have set some flags - Nigeria, Sudan, Mali, Rep. Congo, Bolivia, El Salvador. Maybe I'm on thin ice..
- KMag 6y ago
  Did you clear cookies before signing in from the other country? As I remember, Google made me re-authenticate via text the last time I cleared cookies, despite connecting from the same IP address as my last login.
  - grecy 6y ago
    No, often used an existing session, though back in the day I was also using computers in internet cafes around the world, so totally new sessions each time
- bserge 6y ago
  Android devices get a pass. I'm guessing Google verifies some ID on the phone. This, btw, is what I think caused me to lose a Google account. It was an old one I was checking very rarely, someone reset my (strong!) password from a phone. I reset it again, along with the questions, thought I was fine. They once again reset it and then Google's recovery page was not letting me do anything, apparently I was the suspicious person. Oook Google.
_jal 6y ago
This is one reason I will not give out a phone number for the vast majority of services. If that means I can't use something, so be it. Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system, it is a design for randomly fucking me over. If your system is designed to fuck me over, I would prefer to use something else, thanks.
- whenitrains 6y ago
  This is a great point. I'm going to try and onboard this thinking into my life.
- handedness 6y ago
  I'm locked out of a Google account I configured without a phone number. It won't let me reset to email, and when I provide a new number it does no good. The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.
  - jerry80 6y ago
    Same thing happened to me when I changed ISPs. I never lost my password, but Gmail locked me out anyway.
- 1vuio0pswjnm7 6y ago
  "Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system." It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it. From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices. Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.
Kaze404 6y ago
Same situation here. This service is a joke.
lemonspat 6y ago
Same thing happened to me with other services too. Sadly this is too common
billylindeman 6y ago
I had this same problem - correct password but google wouldn’t let me in. The alternate email was from a domain I owned 10 years ago. I didn’t have access for a few years, but eventually I resorted to re purchasing that domain and setting up a mail server. Fuck you google.
tsjq 6y ago
This is very scary situation
handedness 6y ago
To add my voice to the ever-growing chorus: I'm in a similar situation, except in this case despite my still having session cookies stored on several devices, all of which were logged-out simultaneously, it's requiring a new phone number. When I eventually gave one grudgingly (one used on most of the other accounts listed along side this account in Google's account switcher), it still tells me I'm locked out and to "try again later". It's been about a month. I have a very short list of companies, the collapse of which I'd celebrate with a party, and Google is vying very successfully for that top spot against some pretty reprehensible competitors.
- nucleardog 6y ago
  Yeah, I've got an account I haven't had access to in about ten years that I still can't get in to. I try and reset it from time to time and just always get the "try again later". I'm pretty sure I even have the correct password, but it thinks my login is suspicious since it's from a new/unfamiliar device so requires me to further authenticate myself except I no longer have access to the phone number associated with it. I'm fairly sure I have the answers to the security questions as well as have succeeded at the other recovery options, but best I've been able to get is "try again later". The email is being forwarded to another address of mine, so I can still receive email I just... can never actually get into the account ever again. Thankfully I don't/didn't ever use it for anything all that important.
  - faeyanpiraat 6y ago
    Keep in mind gmail doesnt forward messages regarded as spam.
jasonv 6y ago
For this reason and spam calls, I have a free Google Voice number that I use for all services. I never give my cell #...
- artificialLimbs 6y ago
  Their numbers aren't always accepted with various entities. I just tried to register with irs.gov, for example, unsuccessfully.
  - hansvm 6y ago
    There are whole blocks of legitimate carriers that aren't accepted with various entities. Last time I tried to make a Facebook account I went so far as to buy a phone and a cell plan to try to get a number that would validate in their system, but they wouldn't budge.
  - zucked 6y ago
    Yup - the numbers Google Voice has are tagged as 'VoIP numbers' in some dataset somewhere and are blacklisted by a fair number of services and blocked from 2FA or Sign-up. This has also happened to me when using MVNO carriers (Cricket, for example).
- kwanbix 6y ago
  I tried to use mine, and it is not recognized as a cellphone number, I imagine as a landline one.
- Broken_Hippo 6y ago
  Isn't Google Voice only in the US, though?
  - deleted 6y ago
    [deleted]
- robertlagrant 6y ago
  How do you log into Google Voice?
mrslave 6y ago
I'll echo the sentiments in this thread except for the swear words at Google. Losing access to a Gmail for similar reasons has been a net positive, though at the time it was mildly frustrating. I haven't gotten sucked into their aggressive cross-selling of all their products, and the consequences of always being logged in. Occasionally I can't view or comment on something. You can bookmark 5 YouTube channels without Subscribing, and some Twitter feeds without Following. The oligopolies of 2020 have made the internet a much more boring place than 10+ years ago. YouTube resembles cable television more and more every day. Rather than get mad and watch poor content, I now have more time to read and think.
- solstice 6y ago
  Same here. I use Teddit.net for Reddit, Newpipe for Youtube and one of the nitter.net instances for Twitter. All the content without the clutter and fast, as well as a lower temptation to get into flamewars etc. (In Newpipe you can subscribe to creators' channels, see the comments and their other videos. You just can't comment from there.)
  - mackrevinack 6y ago
    freetube is another youtube alternative if anyone is more of a desktop user, and invidious is web based
    - Fjolsvith 6y ago
      FYI, freetube.com is NSFW
- visarga 6y ago
  > YouTube resembles cable television more and more every day. Depends on what you're searching, there is also the perspective that YT is a vast library of content that would never have appeared on TV, such as lectures, talks, conferences, courses, demos, gameplay, cooking, home improvement, product reviews, obscure music. It's the library of Alexandria of modern age. I would be devastated if I lost access to it. Wikipedia and Arxiv are complementary collections.
Leherenn 6y ago
I've had the same issue twice, but it worked fine for me. I just filled the form on the login page, and after a couple of days I received an email telling me 2-fa has been disabled. The only issue I had was that 2-fa was only temporarily disabled and not permanently as I thought, so I had to do it a second time when I tried to relog a few days after and then I changed my number.
BrandoElFollito 6y ago
Same here. I have a Google account I can reach via POP and wanted to log into (after a very long time). They requested to send the confirmation code to a phone I do not have anymore. I replied the "security question" correctly. Then I had to provide the recovery email I once set up. Which I forgot. So yes, I should have kept that up to date but it would not be difficult to prove I own the account (my usual google account pulls from that unavailable on for years) - it is just that there is nobody at Google to contact and have a look. I will seriously look into fastmail or protonmail, despite being with Google for 14 years
melbourne_mat 6y ago
I see a lot of people complaining about not getting what expect out of free Google services. How about choosing a non free provider of those services that has support?
nicolas_ 6y ago
I'm facing the exact same issue on a 11 years old Google Account with Adsense, Gmail, and a lot of Google services tied to it. Since I know the password, have access to the recovery email, know the recovery questions and answers but Google doesn't even let me enter the recovery process and block me from doing so because of my "unknown device". I'm stuck and I have all the info needed... Happy Edit: Following your post and just for the fun I tried to log back in and instead of the usual error message Google asked me to enter my full recovery email address. Then, I had to enter a valid phone number and to create a new password. I HAVE ACCESS TO MY ACCOUNT AGAIN!!!!! I don't know how the fuck it worked but if you're in the same position try to log again in a few weeks. What I did the past few months: fill out the Gmail recovery form. (no impact). Bought Google One and asked for support at least 3 times (no impact). Tried to log back in multiple times over the course of a month or two (no impact). Thought the account was toast, I was looking to alternative solutions but I tried again and it fucking worked!

by jjcon 6y ago

Triv888 6y ago

I've had that problem too, multiple times, where I knew the password but Google wouldn't let me use it (I almost lost my account). Google doesn't like users that clear cookies, block trackers, etc... I wish that there was a way to disable those "protections".

tharkun__ 6y ago
There is a really really simple one (at least for your private life but if your company uses G-Suite, you always have the admin to take care of things you forget): Do not use Google! It's as simple as that. I have never had a Gmail account until an Android device sort of forced it on me, because I definitely didn't want to link things up to my real email address, so I just signed up for the whole thing. Do I ever use that email address? Definitely not! Why would I? What happens if I ever loose access to that account? I have to register a new one for my Android device(s). Boohoo. Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. No longer have a PC and do everything including your banking, gaming etc. with the tablet (i.e. things you really need or things you paid a lot of money for)? Well, welcome to the walled garden where Google practically owns you.
- thaumasiotes 6y ago
  > Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. Pleco is a necessity for me, but it's not tied to the Google account. It has its own registration system. Same goes for WeChat. The Android Kindle app isn't really a necessity, but it's desirable. It, too, has its own registration system. It's certainly tied to my Amazon account, but not to my Google account.
  - everdrive 6y ago
    This is part of why I try to stay away from apps; once you become reliant, you're stuck. It's best if there's a desktop client, (and particularly one that is not bad for privacy, but usually these things work better on a desktop) since it will not keep you tied to a device or ecosystem.
  - tharkun__ 6y ago
    That is absolutely the right way to deal with it. Bravo! Use the apps that have their own accounts, don't require an account etc. I do the same actually and don't use apps or services that will only allow you to "Login with Facebook", "Login with Google" etc.
- behringer 6y ago
  Google's screwed over more than a few g suite admins. Caution is advised in all things Google.
- rossjudson 6y ago
  You should keep it all on paper instead, because nothing ever happens to that. ;) I do think there is substantial room for a kind of "major provider reset" service, similar (at least) to what banks do physically. Lost your account access? You need to GO to a place, be on video, have an ID check done, multiple forms of whatever identification. It costs to do this kind of thing, and as a last resort I'm pretty sure most people would want to pay it, instead of losing account access. Your argument seems to be "It would be massively inconvenient to lose access to these things so instead I will not have these things."
geofft 6y ago
Do you have 2FA enabled? I suspect that if you have either an authenticator app or a security key, it will use that instead of random heuristics. (This isn't a defense of Google's behavior, just a comment on things that are actually within the end user's control.)
- Triv888 6y ago
  I don't want 2FA and I have it disabled but they often ask me for more than my password which is like forcing 2FA on me (but what you say may be true).
  - yspeak 6y ago
    Why don't you want 2fa? What concern do you have? You can use fido key if you have concerns about the software authenticator. and you don't need to use your phone number.
- Can_Not 6y ago
  I tried to setup 2FA, Google would not let me setup an authenticator app without first giving Google a phone number.
  - katbyte 6y ago
    It’s phone number -> auth app -> umbikey -> remove phone number. None of my google accounts use my number for 2fa anymore
    - TeMPOraL 6y ago
      I wonder if that last step shouldn't be followed by a GDPR notice to stop processing your phone number, if you're in Europe - because I don't imagine they aren't storing your number anyway, after you remove it from auth options.
  - kelnos 6y ago
    I have a Twilio number I use as my Google recovery number (which is only used for that purpose). In my case, it's because I want to protect against SIM swapping attacks on my real phone number, but it also works for people who don't want to give out their real number. This doesn't work for services that send SMS 2FA codes and the like from a shortcode (as Twilio does not support receiving those), but Google appears to send from a longcode, so it works there.

KMag 6y ago

As someone who occasionally moves countries, this is horrifying. Did you enable 2FA and still need to authenticate via text? I used to enable 2FA, but got worried about phone loss/damage.

koolba 6y ago
Do they even let you enable non-SMA 2FA anymore? Last I checked the TOTP option was gone.
- viraptor 6y ago
  On Google? Both totp and second device authentication are still supported.
  - donmcronald 6y ago
    Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure. Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!
    - geofft 6y ago
      In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
    - viraptor 6y ago
      > Now there are 4 ways to compromise your account. No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page. They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.

meibo 6y ago

They ask you regularly if the data is still up to date and have disclaimers about situations like this when you register the phone number as an actual authentication factor. Not saying that this isn't at least partly on Google, they should have responsive customer service that can verify accounts - but you could have easily prevented that by being less lazy with keeping your data up to date. Security and account recovery is the one thing you shouldn't cheap out on.

jjcon 6y ago
I moved across a border like 20 minutes away and got a new number - it is extremely common that both things change at the same time for people. It wasn’t a months old number or anything.
- nly 6y ago
  Wait, is this a mobile (cell) phone number? Why is this tied to where you live? In the UK you can take your mobile number with you between network providers and they're not tied to your location.
  - maccard 6y ago
    Not everyone moves in the same country. I moved from Ireland to the UK 8 years ago and the process of updating phone numbers and addresses is just flat out impossible on certain services.
    - fogihujy 6y ago
      Not sure about Irish/UK rules regarding this, and it might not be possible everywhere, but if anyone else happens to be in that situation in the future then I can wholeheartedly recommend transferring the old number to a prepaid card, and then simply bringing that along. That way, you can keep your old number for as long as you keep the SIM topped up (once per year where I lived).
  - Broken_Hippo 6y ago

grecy 6y ago

Yikes. I've logged into my gmail account from 55 different countries, and I've never had a problem. Some of those countries must have set some flags - Nigeria, Sudan, Mali, Rep. Congo, Bolivia, El Salvador. Maybe I'm on thin ice..

KMag 6y ago
Did you clear cookies before signing in from the other country? As I remember, Google made me re-authenticate via text the last time I cleared cookies, despite connecting from the same IP address as my last login.
- grecy 6y ago
  No, often used an existing session, though back in the day I was also using computers in internet cafes around the world, so totally new sessions each time
bserge 6y ago
Android devices get a pass. I'm guessing Google verifies some ID on the phone. This, btw, is what I think caused me to lose a Google account. It was an old one I was checking very rarely, someone reset my (strong!) password from a phone. I reset it again, along with the questions, thought I was fine. They once again reset it and then Google's recovery page was not letting me do anything, apparently I was the suspicious person. Oook Google.

_jal 6y ago

This is one reason I will not give out a phone number for the vast majority of services. If that means I can't use something, so be it. Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system, it is a design for randomly fucking me over. If your system is designed to fuck me over, I would prefer to use something else, thanks.

whenitrains 6y ago
This is a great point. I'm going to try and onboard this thinking into my life.
handedness 6y ago
I'm locked out of a Google account I configured without a phone number. It won't let me reset to email, and when I provide a new number it does no good. The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.
- jerry80 6y ago
  Same thing happened to me when I changed ISPs. I never lost my password, but Gmail locked me out anyway.
1vuio0pswjnm7 6y ago
"Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system." It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it. From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices. Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.

Kaze404 6y ago

Same situation here. This service is a joke.

lemonspat 6y ago

Same thing happened to me with other services too. Sadly this is too common

billylindeman 6y ago

I had this same problem - correct password but google wouldn’t let me in. The alternate email was from a domain I owned 10 years ago. I didn’t have access for a few years, but eventually I resorted to re purchasing that domain and setting up a mail server. Fuck you google.

tsjq 6y ago

This is very scary situation

handedness 6y ago

To add my voice to the ever-growing chorus: I'm in a similar situation, except in this case despite my still having session cookies stored on several devices, all of which were logged-out simultaneously, it's requiring a new phone number. When I eventually gave one grudgingly (one used on most of the other accounts listed along side this account in Google's account switcher), it still tells me I'm locked out and to "try again later". It's been about a month. I have a very short list of companies, the collapse of which I'd celebrate with a party, and Google is vying very successfully for that top spot against some pretty reprehensible competitors.

nucleardog 6y ago
Yeah, I've got an account I haven't had access to in about ten years that I still can't get in to. I try and reset it from time to time and just always get the "try again later". I'm pretty sure I even have the correct password, but it thinks my login is suspicious since it's from a new/unfamiliar device so requires me to further authenticate myself except I no longer have access to the phone number associated with it. I'm fairly sure I have the answers to the security questions as well as have succeeded at the other recovery options, but best I've been able to get is "try again later". The email is being forwarded to another address of mine, so I can still receive email I just... can never actually get into the account ever again. Thankfully I don't/didn't ever use it for anything all that important.
- faeyanpiraat 6y ago
  Keep in mind gmail doesnt forward messages regarded as spam.

jasonv 6y ago

For this reason and spam calls, I have a free Google Voice number that I use for all services. I never give my cell #...

artificialLimbs 6y ago
Their numbers aren't always accepted with various entities. I just tried to register with irs.gov, for example, unsuccessfully.
- hansvm 6y ago
  There are whole blocks of legitimate carriers that aren't accepted with various entities. Last time I tried to make a Facebook account I went so far as to buy a phone and a cell plan to try to get a number that would validate in their system, but they wouldn't budge.
- zucked 6y ago
  Yup - the numbers Google Voice has are tagged as 'VoIP numbers' in some dataset somewhere and are blacklisted by a fair number of services and blocked from 2FA or Sign-up. This has also happened to me when using MVNO carriers (Cricket, for example).
kwanbix 6y ago
I tried to use mine, and it is not recognized as a cellphone number, I imagine as a landline one.
Broken_Hippo 6y ago
Isn't Google Voice only in the US, though?
- deleted 6y ago
  [deleted]
robertlagrant 6y ago
How do you log into Google Voice?

mrslave 6y ago

I'll echo the sentiments in this thread except for the swear words at Google. Losing access to a Gmail for similar reasons has been a net positive, though at the time it was mildly frustrating. I haven't gotten sucked into their aggressive cross-selling of all their products, and the consequences of always being logged in. Occasionally I can't view or comment on something. You can bookmark 5 YouTube channels without Subscribing, and some Twitter feeds without Following. The oligopolies of 2020 have made the internet a much more boring place than 10+ years ago. YouTube resembles cable television more and more every day. Rather than get mad and watch poor content, I now have more time to read and think.

solstice 6y ago
Same here. I use Teddit.net for Reddit, Newpipe for Youtube and one of the nitter.net instances for Twitter. All the content without the clutter and fast, as well as a lower temptation to get into flamewars etc. (In Newpipe you can subscribe to creators' channels, see the comments and their other videos. You just can't comment from there.)
- mackrevinack 6y ago
  freetube is another youtube alternative if anyone is more of a desktop user, and invidious is web based
  - Fjolsvith 6y ago
    FYI, freetube.com is NSFW
visarga 6y ago
> YouTube resembles cable television more and more every day. Depends on what you're searching, there is also the perspective that YT is a vast library of content that would never have appeared on TV, such as lectures, talks, conferences, courses, demos, gameplay, cooking, home improvement, product reviews, obscure music. It's the library of Alexandria of modern age. I would be devastated if I lost access to it. Wikipedia and Arxiv are complementary collections.

Leherenn 6y ago

I've had the same issue twice, but it worked fine for me. I just filled the form on the login page, and after a couple of days I received an email telling me 2-fa has been disabled. The only issue I had was that 2-fa was only temporarily disabled and not permanently as I thought, so I had to do it a second time when I tried to relog a few days after and then I changed my number.

BrandoElFollito 6y ago

Same here. I have a Google account I can reach via POP and wanted to log into (after a very long time). They requested to send the confirmation code to a phone I do not have anymore. I replied the "security question" correctly. Then I had to provide the recovery email I once set up. Which I forgot. So yes, I should have kept that up to date but it would not be difficult to prove I own the account (my usual google account pulls from that unavailable on for years) - it is just that there is nobody at Google to contact and have a look. I will seriously look into fastmail or protonmail, despite being with Google for 14 years

melbourne_mat 6y ago

I see a lot of people complaining about not getting what expect out of free Google services. How about choosing a non free provider of those services that has support?

nicolas_ 6y ago

I'm facing the exact same issue on a 11 years old Google Account with Adsense, Gmail, and a lot of Google services tied to it. Since I know the password, have access to the recovery email, know the recovery questions and answers but Google doesn't even let me enter the recovery process and block me from doing so because of my "unknown device". I'm stuck and I have all the info needed... Happy Edit: Following your post and just for the fun I tried to log back in and instead of the usual error message Google asked me to enter my full recovery email address. Then, I had to enter a valid phone number and to create a new password. I HAVE ACCESS TO MY ACCOUNT AGAIN!!!!! I don't know how the fuck it worked but if you're in the same position try to log again in a few weeks. What I did the past few months: fill out the Gmail recovery form. (no impact). Bought Google One and asked for support at least 3 times (no impact). Tried to log back in multiple times over the course of a month or two (no impact). Thought the account was toast, I was looking to alternative solutions but I tried again and it fucking worked!