This is entirely ignoring the point of what I am saying. I have my username and password. The recovery email is bound to a defunct email provider. It is non-

This is entirely ignoring the point of what I am saying. I have my username and password. The recovery email is bound to a defunct email provider. It is non-standard. I am able to recall both the name of the email and and defunct email provider. I am entering a correct password. I am not trying to recover an account. I am logging in with a correct username and password then being prompted for recovery autonomously. To say there is a fixed process without exception handling is not being secure. It is being lazy. There is no security concern with looking into a case like this, having a process for exceptional circumstances, and providing an avenue to move forward. This avenue can be programmatic. Give I have a username and password along with the recovery email address, that is enough evidence for some kind of autonomous privileged escalation with an AI that has access to my emails. We already know that gmail is scanned and indexed, and used for advertising. Why can’t that be used for identification? More to the point: when I set up a recovery email, I thought it was for recovery. I still thought that to this day, up until this point. I had no idea they were used as 2fa. This is not something that was told to me. If I was aware of that, I would have made a greater effort to keep that up to date on emails. Unfortunately, life and bad mental health have a way of making time pass. The passage of time is not a reason to lock someone out when they accurately recall their authentication method. At a minimum after such a duration, it should allow login and then prompt to review recovery options. After reviewing the options, a new consent should be issued informing this information should be kept up to date, or you may be locked out of the account. This consent was never provided to me on initialization of the account. Terms were changed and access autonomously denied. What if terms change again and they add an esoteric security key for all accounts automatically? Your password and recovery email is invalid for security reasons and unless you use a security key, you will be locked out. And you have a month to do it. That is how this is, but the timescale is just longer. I don’t think it’s defensible.