3 ms·

At its core - from Google's PoV - they've decided to protect your account with two factor authentication. Their system couldn't verify your machines actually be

by olliej 4y ago

At its core - from Google's PoV - they've decided to protect your account with two factor authentication. Their system couldn't verify your machines actually belonged to you, and so attempted to verify via the 2nd factor. The whole point of 2FA is that it isn't bypassable, otherwise what would be the point? Complaining at them over any medium (including a complaint on a forum like HN) is indistinguishable from any other social engineering/hacking attempt. Someone attempting to social engineer their way into an account by definition wants to look as much like legitimate customer. The core issue from your point of view is that they appear to have chosen to arbitrarily use your recovery email as a second factor without first telling you and/or getting consent. At the more extreme end Apple's iCloud encrypts the increasing majority of data with keys that they fundamentally have no access to - the recovery devices (and you can make a non-device recovery key that I assume is tied to their iCloud key vault or whatever it's called). In the event you lose your recovery devices + account recovery key your data is gone - no one has the decryption keys, and Apple's only available option for you is an account reset. I know much less about the state of Google's cloud account encryption, but they always seemed more interested in having the ability to analyze account data.

survirtual 4y ago
The Apple comparison is invalid because if you losing a key is equivalent to losing a password. I haven’t lost my password here. A more apt comparison would be that there are 2 security keys, one you have and one you are expected to store for recovery purposes, in event the main key is lost. You lose your recovery key but still have your primary key. At some point without your consent, however, it becomes Apple policy to intermittently require your recovery key in addition to your security key. This is a new policy and no consent process was established. They also make it so you cannot validate your recovery key and replace it if necessary, including no communication of the new practice for user review (which establishes a higher precedence for securing the recovery key).
- olliej 4y ago
  Oh, I recognize the apple "you lost your identity" isn't a great match here, just that there do exist cases where its possible that it's literally impossible to recover data. I recognize that is not the case for you, it sounds like google decided without either informing you or gaining consent that they were going to use your recovery password as a second factor (unless that's stated in initial sign up, which could be plausible given the world of tech small text). The problem from Google's point of view now, is that given the existence - rightly or wrongly - of a 2nd factor, everything you do is fundamentally indistinguishable from a hacking/social engineering attempt. That is what I was trying to communicate. I want to be clear, I am not agreeing with google's behaviour w.r.t unilaterally applying 2nd factor, just that given that in their database your account has two factor, by definition your username+password cannot be considered sufficient. The alternative would defeat the purpose of 2nd factor.
  - survirtual 4y ago
    Right, and I think that fact that I, as the valid account holder, have been placed in a category of indistinguishable from someone social engineering access to my account, simply for not updating a recovery email, makes it all the more irritating. It is trivially easy for google to validate if the email in use is still valid. I haven’t cared to look into the inner workings of email but surely there is also a host signing key for emails too, or some kind if protocol level handshake. Anyway, my only hope is being okay spending more money to buy the domain. When / if that happens, I will make it possible for anyone else to recover their old email with it.
    - olliej 4y ago
      Oh, no part of the problem with email is that there is no authentication of mail servers, etc. It hails to a bygone age of hopeless optimism :D To repeat though, I wholly agree it is wholly unreasonable for Google to repurpose anything on your account for 2FA, without consent and explicit clear notification. I'm sorry this has happen, it really does suck, and I hope maybe you can coax the domain owner into adding just a forwarding address rather than having to buy it :-/
pid-1 4y ago
Without a time machine, there is no way OP could have predicted their recovery email would eventually be used as MFA.
- olliej 4y ago
  Yes, as I said it's not reasonable from the end users perspective, but having done so, allowing username+password to bypass the 2fa isn't possible. It is dumb, what they should have done is notified the user that they needed to set up some form of 2/MFA, not choose random value from profile to become one.

by olliej 4y ago

survirtual 4y ago

The Apple comparison is invalid because if you losing a key is equivalent to losing a password. I haven’t lost my password here. A more apt comparison would be that there are 2 security keys, one you have and one you are expected to store for recovery purposes, in event the main key is lost. You lose your recovery key but still have your primary key. At some point without your consent, however, it becomes Apple policy to intermittently require your recovery key in addition to your security key. This is a new policy and no consent process was established. They also make it so you cannot validate your recovery key and replace it if necessary, including no communication of the new practice for user review (which establishes a higher precedence for securing the recovery key).

olliej 4y ago
Oh, I recognize the apple "you lost your identity" isn't a great match here, just that there do exist cases where its possible that it's literally impossible to recover data. I recognize that is not the case for you, it sounds like google decided without either informing you or gaining consent that they were going to use your recovery password as a second factor (unless that's stated in initial sign up, which could be plausible given the world of tech small text). The problem from Google's point of view now, is that given the existence - rightly or wrongly - of a 2nd factor, everything you do is fundamentally indistinguishable from a hacking/social engineering attempt. That is what I was trying to communicate. I want to be clear, I am not agreeing with google's behaviour w.r.t unilaterally applying 2nd factor, just that given that in their database your account has two factor, by definition your username+password cannot be considered sufficient. The alternative would defeat the purpose of 2nd factor.
- survirtual 4y ago
  Right, and I think that fact that I, as the valid account holder, have been placed in a category of indistinguishable from someone social engineering access to my account, simply for not updating a recovery email, makes it all the more irritating. It is trivially easy for google to validate if the email in use is still valid. I haven’t cared to look into the inner workings of email but surely there is also a host signing key for emails too, or some kind if protocol level handshake. Anyway, my only hope is being okay spending more money to buy the domain. When / if that happens, I will make it possible for anyone else to recover their old email with it.
  - olliej 4y ago
    Oh, no part of the problem with email is that there is no authentication of mail servers, etc. It hails to a bygone age of hopeless optimism :D To repeat though, I wholly agree it is wholly unreasonable for Google to repurpose anything on your account for 2FA, without consent and explicit clear notification. I'm sorry this has happen, it really does suck, and I hope maybe you can coax the domain owner into adding just a forwarding address rather than having to buy it :-/

pid-1 4y ago

Without a time machine, there is no way OP could have predicted their recovery email would eventually be used as MFA.

olliej 4y ago
Yes, as I said it's not reasonable from the end users perspective, but having done so, allowing username+password to bypass the 2fa isn't possible. It is dumb, what they should have done is notified the user that they needed to set up some form of 2/MFA, not choose random value from profile to become one.