3 ms·

I understand the situation as follows: - OP has an old Google account and he remembers the correct username and password. - OP had added a recovery email addr

I understand the situation as follows: - OP has an old Google account and he remembers the correct username and password. - OP had added a recovery email address to that account. A recovery email is used if you forget the username and password. Google was not using the recovery email for 2FA (and he was OK with that). - At some point Google decided that they'll do 2FA whenever they felt like it even if you knew the correct username and password. Google decided to use the recovery email address for 2FA (even though this wasn't the original purpose of the recovery email). - At some point OP's recovery email address stopped working. - Now OP can't login even though he knows the correct username and password. So OP is not complaining that he forgot his username and password and can't use his recovery email. His complaint is that he knows the correct username and password, and shouldn't need the recovery email at all, but Google changed the rules on him and now requires the recovery email to do 2FA to let him in. An analogy would be if you created a Google account with the name Toaster Oven (I assume Google allows fictitious names, right?). Then at some point in the future they change the rules and require everyone's ID on file and demand you send a scan of your passport or driver's license in the name of Toaster Oven before you can login.

unethical_ban 4y ago
I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: banking apps on mobile that log you out after some number of days. They don't tell you at ligingow many days your session is still valid. Just one day, "oh, give me your password". Fortunately I'm savvy enough to have my password safe with my at all times. A less techy user might be on vacation and suddenly get kicked out of critical tools.
survirtual 4y ago
This is correct.
xyzzy123 4y ago
There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account credentials which work to access email accounts (by stuffing u/p from breached site into email provider). Knowing u/p of an account is a weaker signal of ownership than it used to be. Particularly if the account is old and has a weak password. Although OP didn't do it, buying up defunct domains used for recovery emails and taking them over also removes any "proof of ownership" value that the recovery email is supposed to provide. Anyone can do that and it's an exploit of an imperfect process. The OP is secure in the knowledge that they own the account, but from a process point of view the provider does not believe they have strong evidence that is the case. The security landscape, technology and defense measures change over time, and I agree it sucks that the OP can't access their account due to factors outside their control. P.S: Were the credentials on your gmail account ever disclosed in a breach? (e.g is the password on haveibeenpwned).

unethical_ban 4y ago

I loathe organizations that do this, Google being most prominent. Do not force any new steps into a login process without first informing the user! Related: banking apps on mobile that log you out after some number of days. They don't tell you at ligingow many days your session is still valid. Just one day, "oh, give me your password". Fortunately I'm savvy enough to have my password safe with my at all times. A less techy user might be on vacation and suddenly get kicked out of critical tools.

survirtual 4y ago

This is correct.

xyzzy123 4y ago

There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account credentials which work to access email accounts (by stuffing u/p from breached site into email provider). Knowing u/p of an account is a weaker signal of ownership than it used to be. Particularly if the account is old and has a weak password. Although OP didn't do it, buying up defunct domains used for recovery emails and taking them over also removes any "proof of ownership" value that the recovery email is supposed to provide. Anyone can do that and it's an exploit of an imperfect process. The OP is secure in the knowledge that they own the account, but from a process point of view the provider does not believe they have strong evidence that is the case. The security landscape, technology and defense measures change over time, and I agree it sucks that the OP can't access their account due to factors outside their control. P.S: Were the credentials on your gmail account ever disclosed in a breach? (e.g is the password on haveibeenpwned).