4 ms·
This is because most people use Gmail for basically all their online accounts: if you don't directly login to the site via Gmail, you can use your account to ch
by armchairhacker 5y ago
This is because most people use Gmail for basically all their online accounts: if you don't directly login to the site via Gmail, you can use your account to change your password. Imagine the damage which can be done if a malicious user breaks into someone's Gmail, if not your own, then the average person who uses the same password everywhere and trusts Gmail with everything.
Not defending the practice at all. It shows we as a society and Google in particular need better security if they are flat-out locking people out of their Gmail accounts and others are still being compromised (I know they are). I honestly support Google forcing people to use recovery addresses and 2-factor authentication but I don't support them making the recovery authentication not work and providing literally no options for a legitimate user.
I think the best you can do right now is complain on HN and Twitter and you'll probably get your account back. In the future, maybe if you have a YubiKey or stronger form of 2FA Google won't lock you out, because obviously if someone can authenticate with a YubiKey they are practically guaranteed to be the real person.
- tpoacher 5y agothis only works if your post gets upvoted. which in the grand scheme of things is rare. have you been to the "new" page lately?
- ttty 5y ago
- Groxx 5y ago>obviously if someone can authenticate with a YubiKey they are practically guaranteed to be the real person. Or someone grabbed your backpack. I understand why Google wants 2FA - it gives them a stronger claim to not provide support. Personally I don't want 2FA - I use strong passwords, and I don't trust them to provide support if my device is lost. Imagine a house fire, for instance, and losing not only your possessions but also basically all your online accounts. I have password backups, nobody has device backups.
- Gigachad 5y agoThe chance of someone stealing your physical token, and knowing your email + password are almost impossibly low.
- Silhouette 5y agoBut if you lose your 2FA device then you lose access to everything if there is no alternative recovery mechanism. I recently started working with a client that uses cloud-hosted everything and mandates 2FA for all accounts. They asked me to install Google's authenticator app for that purpose. So far, so reasonable. However of those different services, only one provides recovery codes as a standard part of its 2FA registration process. For everything else, if my work phone gets stolen or broken, that's it, game over for those accounts. I would need to contact the administrator for each service on my client's team and get them to restore access somehow.
- blfr 5y agoAnother scenario where yubikeys shine: you can have multiple. Keep one in your main computer, one on you, and one at your parents's place, or even a safety deposit box if you're feeling fancy.
- Silhouette 5y agoDefinitely an advantage. Of course like any other back-up it's only worth anything if you test each copy regularly!