6 ms·
“If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover y
by pinum 5y ago
“If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify that it’s you and restore your access.”
I trust that it would be (potentially much) harder than normal, but it still seems to be possible.
- cinntaile 5y agoI was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.
- withinboredom 5y agoIIRC, Google will stop the "several day process" if you log in at any time.
- someguydave 5y agoStill sounds like a significant barrier to most phishing attacks.
- cinntaile 5y agoA little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
- Marsymars 5y ago> It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure. e.g. To enable "Extra Advanced Protection" you have to visit Google HQ in your region, where your DNA is sampled. If you ever need to recover your account, you have to visit Google HQ again for another DNA sample, after which you're provided with account access, in person.
- darkwater 5y ago> DNA sample and who's gonna pay for that? Seems pricey and doesn't scale exactly well.
- cinntaile 5y agoDefinitely also a good, but still very extreme option. This might actually be more secure, depending on the threats you have to take into account. It would be possible to retrieve the account after a (physical) hack.
- someguydave 5y agoJust showing up in person by itself (with a stored photograph and maybe audio recording) is a pretty high barrier.
- someguydave 5y agoI presume in this scenario you would have multiple keys and multiple backup accounts, so fallback to a likewise secured account is reasonable.