3 ms·

Ensuring the recovery email provider being used for your account remains active is your (the users) responsibility. You call the recovery email “invalid” but in

Ensuring the recovery email provider being used for your account remains active is your (the users) responsibility. You call the recovery email “invalid” but in this case it’s a perfectly valid email address because somebody owns that domain. There’s no way you can expect Google to make a special arrangement for you to change the email at the behest of social engineering. What you’re trying to do is get a google employee to removing/changing that recovery email against standard protocol and I hope it doesn’t happen for (everybody else’s) security’s sake.

survirtual 4y ago
This is entirely ignoring the point of what I am saying. I have my username and password. The recovery email is bound to a defunct email provider. It is non-standard. I am able to recall both the name of the email and and defunct email provider. I am entering a correct password. I am not trying to recover an account. I am logging in with a correct username and password then being prompted for recovery autonomously. To say there is a fixed process without exception handling is not being secure. It is being lazy. There is no security concern with looking into a case like this, having a process for exceptional circumstances, and providing an avenue to move forward. This avenue can be programmatic. Give I have a username and password along with the recovery email address, that is enough evidence for some kind of autonomous privileged escalation with an AI that has access to my emails. We already know that gmail is scanned and indexed, and used for advertising. Why can’t that be used for identification? More to the point: when I set up a recovery email, I thought it was for recovery. I still thought that to this day, up until this point. I had no idea they were used as 2fa. This is not something that was told to me. If I was aware of that, I would have made a greater effort to keep that up to date on emails. Unfortunately, life and bad mental health have a way of making time pass. The passage of time is not a reason to lock someone out when they accurately recall their authentication method. At a minimum after such a duration, it should allow login and then prompt to review recovery options. After reviewing the options, a new consent should be issued informing this information should be kept up to date, or you may be locked out of the account. This consent was never provided to me on initialization of the account. Terms were changed and access autonomously denied. What if terms change again and they add an esoteric security key for all accounts automatically? Your password and recovery email is invalid for security reasons and unless you use a security key, you will be locked out. And you have a month to do it. That is how this is, but the timescale is just longer. I don’t think it’s defensible.
cantrevealname 4y ago
I understand the situation as follows: - OP has an old Google account and he remembers the correct username and password. - OP had added a recovery email address to that account. A recovery email is used if you forget the username and password. Google was not using the recovery email for 2FA (and he was OK with that). - At some point Google decided that they'll do 2FA whenever they felt like it even if you knew the correct username and password. Google decided to use the recovery email address for 2FA (even though this wasn't the original purpose of the recovery email). - At some point OP's recovery email address stopped working. - Now OP can't login even though he knows the correct username and password. So OP is not complaining that he forgot his username and password and can't use his recovery email. His complaint is that he knows the correct username and password, and shouldn't need the recovery email at all, but Google changed the rules on him and now requires the recovery email to do 2FA to let him in. An analogy would be if you created a Google account with the name Toaster Oven (I assume Google allows fictitious names, right?). Then at some point in the future they change the rules and require everyone's ID on file and demand you send a scan of your passport or driver's license in the name of Toaster Oven before you can login.
- unethical_ban 4y ago
  I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: banking apps on mobile that log you out after some number of days. They don't tell you at ligingow many days your session is still valid. Just one day, "oh, give me your password". Fortunately I'm savvy enough to have my password safe with my at all times. A less techy user might be on vacation and suddenly get kicked out of critical tools.
- survirtual 4y ago
  This is correct.
- xyzzy123 4y ago
  There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account credentials which work to access email accounts (by stuffing u/p from breached site into email provider). Knowing u/p of an account is a weaker signal of ownership than it used to be. Particularly if the account is old and has a weak password. Although OP didn't do it, buying up defunct domains used for recovery emails and taking them over also removes any "proof of ownership" value that the recovery email is supposed to provide. Anyone can do that and it's an exploit of an imperfect process. The OP is secure in the knowledge that they own the account, but from a process point of view the provider does not believe they have strong evidence that is the case. The security landscape, technology and defense measures change over time, and I agree it sucks that the OP can't access their account due to factors outside their control. P.S: Were the credentials on your gmail account ever disclosed in a breach? (e.g is the password on haveibeenpwned).
deleted 4y ago
[deleted]

survirtual 4y ago

This is entirely ignoring the point of what I am saying. I have my username and password. The recovery email is bound to a defunct email provider. It is non-standard. I am able to recall both the name of the email and and defunct email provider. I am entering a correct password. I am not trying to recover an account. I am logging in with a correct username and password then being prompted for recovery autonomously. To say there is a fixed process without exception handling is not being secure. It is being lazy. There is no security concern with looking into a case like this, having a process for exceptional circumstances, and providing an avenue to move forward. This avenue can be programmatic. Give I have a username and password along with the recovery email address, that is enough evidence for some kind of autonomous privileged escalation with an AI that has access to my emails. We already know that gmail is scanned and indexed, and used for advertising. Why can’t that be used for identification? More to the point: when I set up a recovery email, I thought it was for recovery. I still thought that to this day, up until this point. I had no idea they were used as 2fa. This is not something that was told to me. If I was aware of that, I would have made a greater effort to keep that up to date on emails. Unfortunately, life and bad mental health have a way of making time pass. The passage of time is not a reason to lock someone out when they accurately recall their authentication method. At a minimum after such a duration, it should allow login and then prompt to review recovery options. After reviewing the options, a new consent should be issued informing this information should be kept up to date, or you may be locked out of the account. This consent was never provided to me on initialization of the account. Terms were changed and access autonomously denied. What if terms change again and they add an esoteric security key for all accounts automatically? Your password and recovery email is invalid for security reasons and unless you use a security key, you will be locked out. And you have a month to do it. That is how this is, but the timescale is just longer. I don’t think it’s defensible.

cantrevealname 4y ago

I understand the situation as follows: - OP has an old Google account and he remembers the correct username and password. - OP had added a recovery email address to that account. A recovery email is used if you forget the username and password. Google was not using the recovery email for 2FA (and he was OK with that). - At some point Google decided that they'll do 2FA whenever they felt like it even if you knew the correct username and password. Google decided to use the recovery email address for 2FA (even though this wasn't the original purpose of the recovery email). - At some point OP's recovery email address stopped working. - Now OP can't login even though he knows the correct username and password. So OP is not complaining that he forgot his username and password and can't use his recovery email. His complaint is that he knows the correct username and password, and shouldn't need the recovery email at all, but Google changed the rules on him and now requires the recovery email to do 2FA to let him in. An analogy would be if you created a Google account with the name Toaster Oven (I assume Google allows fictitious names, right?). Then at some point in the future they change the rules and require everyone's ID on file and demand you send a scan of your passport or driver's license in the name of Toaster Oven before you can login.

unethical_ban 4y ago
I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: banking apps on mobile that log you out after some number of days. They don't tell you at ligingow many days your session is still valid. Just one day, "oh, give me your password". Fortunately I'm savvy enough to have my password safe with my at all times. A less techy user might be on vacation and suddenly get kicked out of critical tools.
survirtual 4y ago
This is correct.
xyzzy123 4y ago
There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account credentials which work to access email accounts (by stuffing u/p from breached site into email provider). Knowing u/p of an account is a weaker signal of ownership than it used to be. Particularly if the account is old and has a weak password. Although OP didn't do it, buying up defunct domains used for recovery emails and taking them over also removes any "proof of ownership" value that the recovery email is supposed to provide. Anyone can do that and it's an exploit of an imperfect process. The OP is secure in the knowledge that they own the account, but from a process point of view the provider does not believe they have strong evidence that is the case. The security landscape, technology and defense measures change over time, and I agree it sucks that the OP can't access their account due to factors outside their control. P.S: Were the credentials on your gmail account ever disclosed in a breach? (e.g is the password on haveibeenpwned).

deleted 4y ago

[deleted]