11 ms·

Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as

Had this. It was telling me to try again 'later'. Ok, i did 'try later' every day for three weeks, and they didn't let me in. Using the very same IP address as I used to always access it, no less. Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in. Needless to say, I will never again use gmail for critically important things.

jjcon 5y ago
Had the same thing happen to me, I know the password, have access to the recovery email but Google won't let me login. Spent months in a support thread with Google and eventually gave up. Still really bummed about it tbh
abider 5y ago
> Needless to say, I will never again use gmail for critically important things. That's a hot take. If it was critically important, you'd have 2FA and a recovery phone number associated with it - which would have prevented you from getting stuck in a trust-fail situation to begin with. Use whatever service you want, but your takeaway from this situation is a bit absurd. Edit to add: I'm not saying Google's algorithm is perfect here, but relying on heuristic voodoo ("I use the same IP, so I should be fine") for "critically important things" instead of using well-established means of securing access to critically important things (e.g. 2FA, backup mobile number) is a bit insane.
- ethanbond 5y ago
  Something can be critically important for a person to access on-demand and not be something they’re especially concerned about an attacker accessing. Two completely unrelated dimensions of access needs.
  - M3L0NM4N 5y ago
    They are not mutually exclusive. An attacker accessing a service can hinder or even completely stop your ability to access that service (i.e. change your password).
    - buck4roo 5y ago
      Or do things that trigger the provider to force you to change your password. See: Apple ID, where failed password attempts (by anyone) causes Apple to force users to change their known password.
- PaulHoule 5y ago
  With Google’s nonexistent customer service I’d be afraid of being locked out for any arbitrary reason and having no recourse no matter what recovery procedures I prepared for. Contrast that to my bank where I can go to the branch, show ID, and get problems logging in resolved.
  - jck 5y ago
    I personally had a great experience with google support when I once stupidly locked myself out of my account. The whole thing was resolved in about 3 days. However, google customer service is definitely erratic since loads of other people have had bad experiences. The best thing to do if you're using Gmail is to enable 2fa and backup the recovery codes offline and somewhere safe. This could probably get you into your account without needing to talk to support.
    - jiggawatts 5y ago
      I have never heard of anyone anywhere ever being able to access Google support once they were locked out -- you need to be logged in to access what little tech support they offer.
  - gerdesj 5y ago
    "With Google’s nonexistent customer service" Quite. If you play the game then all is well but if you don't then you are given very short shrift and no recourse to a higher power or anything at all. There is very little oversight. If you fall afoul of the "algorithm" or whatever bollocks is running the show, then you have to fall back on calling them out on the socials. Get enough traction on that and lo: "soz, lol, we failed here but your <whatevs> is important to us ... in this case ... etc ..."
  - josephg 5y ago
    A plug from a very satisfied customer: I pay $5/month for Fastmail. I've emailed support before and reached a human within hours. They helped me with my problem, because it was their job and I'm paying them to do it. Email is too important to rely on a free service which has a history of shutting people out, at any time, for any reason.
- Andrew_nenakhov 5y ago
  Actually, I specifically declined setting up a recovery phone number because I accessed it from the location where receiving codes would be impossible on my phones. I always accessed it from the same IP using my own VPN server, entered the correct password, and still Google decided that they are 'not sure that it is not really me, try again later'. No thanks.
  - taxyz23 5y ago
    What about downloaded back up codes ? Phone push approval? U2f key? Authenticator app? Can't imagine complaining about being shut out if you didn't have at least one or all of these set up. Google even nags you about setting these up.
    - Dylan16807 5y ago
      Why can't you imagine that? This gatekeeping you're doing is rude and doesn't make sense. 2FA's very purpose is to increase shut outs when enabled.
      - smileybarry 5y ago
        It might be 2FA's very purpose, but I've found that a 2FA-less account is a lot more distrusting of logins. Some of my relatives don't have 2FA set up and they got more "verify it's really you" prompts compared to my personal MFA'd account.
        Dylan16807 5y ago
        Because Google is abusing the concept.
- zenexer 5y ago
  I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious. This happens to me from time to time, and the only way I can get back in is through Android. I keep an Android phone on hand at all times for this very reason. Don’t blame the human for inadequate preparation; I assure you, no amount of preparation will save you from Google’s AI.
  - sgjohnson 5y ago
    Microsoft & Zoho Mail does the same, and when they do it, they also revoke all of your app specific password for good measure, so SMTP is a toast too.
  - joshuamorton 5y ago
    If you're entering a code, the 2FA method you're using is still susceptible to mitm-style phishing attacks, which is what this kind of location based check is securing against. You'd need a push notification or yubikey based 2fa check to get the same level of security.
    - zozbot234 5y ago
      AIUI, they do send push notifications if you happen to have a mobile device that's logged in to the same account. Maybe they should do the same for the "suspicious login to an unused 'secondary' account" scenario? They're already sending "recovery" emails, so it wouldn't be that big of a change.
    - zenexer 5y ago
      I have several YubiKeys linked to my account. It will decline those as well. It demands that I sign in from Android sometimes, seemingly for no reason.
      - 5y ago
- afandian 5y ago
  I do wonder how many people will be locked out of their lives when they change phone numbers. 2FA across the industry seems to have rolled out this critical dependency without drawing enough (IMHO) awareness.
- matheusmoreira 5y ago
  The only way to avoid getting into a trust-fail situation with Google is to be completely signed into it at all times so they can monitor you 24/7.
- trasz 5y ago
  You didn’t understand the story. It’s google that’s using heuristic voodoo for critical things.
alerighi 5y ago
My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (since you can just move to another provider). Also, use an email client on your PC (such as Thunderbird) and configure it to keep a copy of all your emails locally (and possibly have the PC backed up). That way if you loose access to your account you don't loose access to your mail, that you can even upload again in the new provider server.
- deleted 5y ago
  [deleted]
- SMAAART 5y ago
  - djbusby 5y ago
    Not FUD, putting your eggs in the Google basket "considered harmful" - unless you pay (Gmail for your domain). I had a similar lockout but on my paid account, got fixed in about 48h. It's happened to like 10 other folk I know over the last 2-3 years
  - stavros 5y ago
    I don't know if it's FUD, but it's true. It happened to a person I know, and in her case, the resolution was "ask around until a friend of a friend of a friend of a friend works at Google". She literally had to ask her friend, who asked me, I asked one of my friends to ask one of his friends who works at Google to put in an internal ticket. It was thankfully resolved quickly (she lost access to all her work materials), but the process is insane. Use your own domain with Fastmail. Yesterday.
    - rovr138 5y ago
      > It was thankfully resolved quickly (she lost access to all her work materials), More than your own domain, BACKUPS.
alisonatwork 5y ago
This is exactly my experience too. My Google accounts just randomly decide to stop working from time to time, and if I no longer have the same phone number that I did before (or if I'm traveling overseas and cannot get a "confirmation call"), there is no way at all to get in. Usually after a mysterious and unexplained period of time, my account gets un-flagged again and I can log in as per normal. The first time this happened I completely lost all access to my Google account. I transferred all of my important email correspondence over to a Microsoft account and I have never looked back. Unfortunately I still need to maintain another Google account for my phone (Android) to work properly, so there are times I still get bitten by it. It's absolutely infuriating when you get a new phone and specifically need to log in with your Google account to be able to do anything, that's exactly the time Google blocks you from being able to get into your account, because it's apparently detected the new phone and decided you're a hacker. This also happens to me regularly with PayPal, almost always when I am traveling overseas, at exactly the moments that I really need PayPal to work so I can pay for something related to my travel. It's so annoying. Tech support never, ever solve the problem. All you can do is wait and try again later until magically it works. Sometimes weeks later. The only thing I can say for certain is to never try log into your account over open wifi or over a VPN connection, because somehow Google (and PayPal) seem to flag that as a hack attempt no matter how many times you correctly confirm your identity. And once you've been flagged once, your account gets caught in some kind of loop where even after you get back onto an apparently blessed IP address, you're still locked out for some unspecified period.
- markdown 5y ago
  I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you". They won't let me reset my password.
- markdown 5y ago
  I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you". They won't let me reset my password.
dheera 5y ago
Yeah this sounds like utter bullshit to me. What if you're travelling, all your devices get stolen, and you're logging in from a public computer or friend's computer to contact your family? This is mindblowingly idiotic. Do they have such a bad vacation policy for their employees that not a single ONE of their engineering managers has experienced the above? Do they just sit in front of their desks for 365 days a year and never leave their country borders?
- Spooky23 5y ago
  My guess is they get defrauded more often. The scenario you present is a really obvious risk as phone thieves often compromise those devices.
  - dheera 5y ago
    No, I think it's a huge risk to be stuck somewhere these days without any means of contacting your family or getting emergency money sent to you. Especially if you're in a place that's politically unstable or where helping strangers isn't the norm. One of these days someone will not be able to get their heart medications or a flight home because of this damn Gmail policy.
- KarlKemp 5y ago
  It's definitely more complicated than that. I travel a lot, sometimes to places where borders are dotted lines, cities use a script I can't read, but every hill is "charlie-5" or somesutch... VPNs, public terminals, government networks on .mil.<country> domains, etc. I have been quite impressed with the improvement they've made in the last year or so regarding these locks. It's probably a sudden change when you've been more predictable before that gets flagged. Only trouble I sometimes run into is Google Search (or Books?) locking me out with increasingly difficult captchas if you keep running searches for 18 hours straight.
hansvm 5y ago
Not just Google, I'm regularly locked out of banks, state resources, and all kinds of other shit because of various combinations of bad decisions producing toxic login flows. One of my personal favorites -- a bank automatically associated phone numbers you called them from to the account, and later they forced SMS 2FA onto the account regardless of any other security you had in place (and of course made the common mistake of allowing account takeovers with JUST that 2FA and a username). Those automatically registered numbers weren't exempted.
- GoblinSlayer 5y ago
  If they need only SMS for a takeover, it's 1fa, not 2fa.
croutonwagon 5y ago
I make a habit of 1. Forwarding everything to my free tier google apps for business on my domain 2. Annually logging into my throwaways. it seems if i login to them once a year from home, they dont pull this. 3. do NOT attempt to login to my throwaways from a proxies connection (SSH/SOCKS on a VPS or something like that, which i frequently use at work)
- chias 5y ago
  > my free tier google apps for business on my domain your habits are going to have to change soon...
  - croutonwagon 5y ago
    Yeah....its unfortunate. Currently I may just pay the cost. Or move to a more privacy focused service like ProtonMail and at least give my money to a place I support.

jjcon 5y ago

Had the same thing happen to me, I know the password, have access to the recovery email but Google won't let me login. Spent months in a support thread with Google and eventually gave up. Still really bummed about it tbh

abider 5y ago

> Needless to say, I will never again use gmail for critically important things. That's a hot take. If it was critically important, you'd have 2FA and a recovery phone number associated with it - which would have prevented you from getting stuck in a trust-fail situation to begin with. Use whatever service you want, but your takeaway from this situation is a bit absurd. Edit to add: I'm not saying Google's algorithm is perfect here, but relying on heuristic voodoo ("I use the same IP, so I should be fine") for "critically important things" instead of using well-established means of securing access to critically important things (e.g. 2FA, backup mobile number) is a bit insane.

ethanbond 5y ago
Something can be critically important for a person to access on-demand and not be something they’re especially concerned about an attacker accessing. Two completely unrelated dimensions of access needs.
- M3L0NM4N 5y ago
  They are not mutually exclusive. An attacker accessing a service can hinder or even completely stop your ability to access that service (i.e. change your password).
  - buck4roo 5y ago
    Or do things that trigger the provider to force you to change your password. See: Apple ID, where failed password attempts (by anyone) causes Apple to force users to change their known password.
PaulHoule 5y ago
With Google’s nonexistent customer service I’d be afraid of being locked out for any arbitrary reason and having no recourse no matter what recovery procedures I prepared for. Contrast that to my bank where I can go to the branch, show ID, and get problems logging in resolved.
- jck 5y ago
  I personally had a great experience with google support when I once stupidly locked myself out of my account. The whole thing was resolved in about 3 days. However, google customer service is definitely erratic since loads of other people have had bad experiences. The best thing to do if you're using Gmail is to enable 2fa and backup the recovery codes offline and somewhere safe. This could probably get you into your account without needing to talk to support.
  - jiggawatts 5y ago
    I have never heard of anyone anywhere ever being able to access Google support once they were locked out -- you need to be logged in to access what little tech support they offer.
- gerdesj 5y ago
  "With Google’s nonexistent customer service" Quite. If you play the game then all is well but if you don't then you are given very short shrift and no recourse to a higher power or anything at all. There is very little oversight. If you fall afoul of the "algorithm" or whatever bollocks is running the show, then you have to fall back on calling them out on the socials. Get enough traction on that and lo: "soz, lol, we failed here but your <whatevs> is important to us ... in this case ... etc ..."
- josephg 5y ago
  A plug from a very satisfied customer: I pay $5/month for Fastmail. I've emailed support before and reached a human within hours. They helped me with my problem, because it was their job and I'm paying them to do it. Email is too important to rely on a free service which has a history of shutting people out, at any time, for any reason.
Andrew_nenakhov 5y ago
Actually, I specifically declined setting up a recovery phone number because I accessed it from the location where receiving codes would be impossible on my phones. I always accessed it from the same IP using my own VPN server, entered the correct password, and still Google decided that they are 'not sure that it is not really me, try again later'. No thanks.
- taxyz23 5y ago
  What about downloaded back up codes ? Phone push approval? U2f key? Authenticator app? Can't imagine complaining about being shut out if you didn't have at least one or all of these set up. Google even nags you about setting these up.
  - Dylan16807 5y ago
    Why can't you imagine that? This gatekeeping you're doing is rude and doesn't make sense. 2FA's very purpose is to increase shut outs when enabled.
    - smileybarry 5y ago
      It might be 2FA's very purpose, but I've found that a 2FA-less account is a lot more distrusting of logins. Some of my relatives don't have 2FA set up and they got more "verify it's really you" prompts compared to my personal MFA'd account.
      - Dylan16807 5y ago
        Because Google is abusing the concept.
zenexer 5y ago
I have 2FA and a recovery email on my Gmail account, yet I have run into this issue. If Google thinks something is suspicious, it will decline your 2FA codes and recovery attempts—it will just tell you that you entered the wrong code. Only after you finally get back in do you find an email in your inbox explaining that the correct code was entered, but Google blocked it because it was suspicious. This happens to me from time to time, and the only way I can get back in is through Android. I keep an Android phone on hand at all times for this very reason. Don’t blame the human for inadequate preparation; I assure you, no amount of preparation will save you from Google’s AI.
- sgjohnson 5y ago
  Microsoft & Zoho Mail does the same, and when they do it, they also revoke all of your app specific password for good measure, so SMTP is a toast too.
- joshuamorton 5y ago
  If you're entering a code, the 2FA method you're using is still susceptible to mitm-style phishing attacks, which is what this kind of location based check is securing against. You'd need a push notification or yubikey based 2fa check to get the same level of security.
  - zozbot234 5y ago
    AIUI, they do send push notifications if you happen to have a mobile device that's logged in to the same account. Maybe they should do the same for the "suspicious login to an unused 'secondary' account" scenario? They're already sending "recovery" emails, so it wouldn't be that big of a change.
  - zenexer 5y ago
    I have several YubiKeys linked to my account. It will decline those as well. It demands that I sign in from Android sometimes, seemingly for no reason.
    - 5y ago
afandian 5y ago
I do wonder how many people will be locked out of their lives when they change phone numbers. 2FA across the industry seems to have rolled out this critical dependency without drawing enough (IMHO) awareness.
matheusmoreira 5y ago
The only way to avoid getting into a trust-fail situation with Google is to be completely signed into it at all times so they can monitor you 24/7.
trasz 5y ago
You didn’t understand the story. It’s google that’s using heuristic voodoo for critical things.

alerighi 5y ago

My solution is, buy your own domain. It's cheap and it will cost you only 20$ a year or something like that. I'm not saying run your own email service (I do, but I recognize that it's complex and not worth for most people), but use a public email service (like also GMail) with your own domain. That way at least if you no longer can access your account, or you get banned, or whatever, you don't loose your address (since you can just move to another provider). Also, use an email client on your PC (such as Thunderbird) and configure it to keep a copy of all your emails locally (and possibly have the PC backed up). That way if you loose access to your account you don't loose access to your mail, that you can even upload again in the new provider server.

deleted 5y ago
[deleted]
SMAAART 5y ago
- djbusby 5y ago
  Not FUD, putting your eggs in the Google basket "considered harmful" - unless you pay (Gmail for your domain). I had a similar lockout but on my paid account, got fixed in about 48h. It's happened to like 10 other folk I know over the last 2-3 years
- stavros 5y ago
  I don't know if it's FUD, but it's true. It happened to a person I know, and in her case, the resolution was "ask around until a friend of a friend of a friend of a friend works at Google". She literally had to ask her friend, who asked me, I asked one of my friends to ask one of his friends who works at Google to put in an internal ticket. It was thankfully resolved quickly (she lost access to all her work materials), but the process is insane. Use your own domain with Fastmail. Yesterday.
  - rovr138 5y ago
    > It was thankfully resolved quickly (she lost access to all her work materials), More than your own domain, BACKUPS.

alisonatwork 5y ago

This is exactly my experience too. My Google accounts just randomly decide to stop working from time to time, and if I no longer have the same phone number that I did before (or if I'm traveling overseas and cannot get a "confirmation call"), there is no way at all to get in. Usually after a mysterious and unexplained period of time, my account gets un-flagged again and I can log in as per normal. The first time this happened I completely lost all access to my Google account. I transferred all of my important email correspondence over to a Microsoft account and I have never looked back. Unfortunately I still need to maintain another Google account for my phone (Android) to work properly, so there are times I still get bitten by it. It's absolutely infuriating when you get a new phone and specifically need to log in with your Google account to be able to do anything, that's exactly the time Google blocks you from being able to get into your account, because it's apparently detected the new phone and decided you're a hacker. This also happens to me regularly with PayPal, almost always when I am traveling overseas, at exactly the moments that I really need PayPal to work so I can pay for something related to my travel. It's so annoying. Tech support never, ever solve the problem. All you can do is wait and try again later until magically it works. Sometimes weeks later. The only thing I can say for certain is to never try log into your account over open wifi or over a VPN connection, because somehow Google (and PayPal) seem to flag that as a hack attempt no matter how many times you correctly confirm your identity. And once you've been flagged once, your account gets caught in some kind of loop where even after you get back onto an apparently blessed IP address, you're still locked out for some unspecified period.

markdown 5y ago
I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you". They won't let me reset my password.
markdown 5y ago
I just ran into this yesterday. Tried to log into Paypal and forgot my pwd. I tried to reset it using the "Forgot password?" link. I entered my email address, and the response was "Sorry, we couldn’t confirm it’s you". They won't let me reset my password.

dheera 5y ago

Yeah this sounds like utter bullshit to me. What if you're travelling, all your devices get stolen, and you're logging in from a public computer or friend's computer to contact your family? This is mindblowingly idiotic. Do they have such a bad vacation policy for their employees that not a single ONE of their engineering managers has experienced the above? Do they just sit in front of their desks for 365 days a year and never leave their country borders?

Spooky23 5y ago
My guess is they get defrauded more often. The scenario you present is a really obvious risk as phone thieves often compromise those devices.
- dheera 5y ago
  No, I think it's a huge risk to be stuck somewhere these days without any means of contacting your family or getting emergency money sent to you. Especially if you're in a place that's politically unstable or where helping strangers isn't the norm. One of these days someone will not be able to get their heart medications or a flight home because of this damn Gmail policy.
KarlKemp 5y ago
It's definitely more complicated than that. I travel a lot, sometimes to places where borders are dotted lines, cities use a script I can't read, but every hill is "charlie-5" or somesutch... VPNs, public terminals, government networks on .mil.<country> domains, etc. I have been quite impressed with the improvement they've made in the last year or so regarding these locks. It's probably a sudden change when you've been more predictable before that gets flagged. Only trouble I sometimes run into is Google Search (or Books?) locking me out with increasingly difficult captchas if you keep running searches for 18 hours straight.

hansvm 5y ago

Not just Google, I'm regularly locked out of banks, state resources, and all kinds of other shit because of various combinations of bad decisions producing toxic login flows. One of my personal favorites -- a bank automatically associated phone numbers you called them from to the account, and later they forced SMS 2FA onto the account regardless of any other security you had in place (and of course made the common mistake of allowing account takeovers with JUST that 2FA and a username). Those automatically registered numbers weren't exempted.

GoblinSlayer 5y ago
If they need only SMS for a takeover, it's 1fa, not 2fa.

croutonwagon 5y ago

I make a habit of 1. Forwarding everything to my free tier google apps for business on my domain 2. Annually logging into my throwaways. it seems if i login to them once a year from home, they dont pull this. 3. do NOT attempt to login to my throwaways from a proxies connection (SSH/SOCKS on a VPS or something like that, which i frequently use at work)

chias 5y ago
> my free tier google apps for business on my domain your habits are going to have to change soon...
- croutonwagon 5y ago
  Yeah....its unfortunate. Currently I may just pay the cost. Or move to a more privacy focused service like ProtonMail and at least give my money to a place I support.