4 ms·

The Apple comparison is invalid because if you losing a key is equivalent to losing a password. I haven’t lost my password here. A more apt comparison would b

The Apple comparison is invalid because if you losing a key is equivalent to losing a password. I haven’t lost my password here. A more apt comparison would be that there are 2 security keys, one you have and one you are expected to store for recovery purposes, in event the main key is lost. You lose your recovery key but still have your primary key. At some point without your consent, however, it becomes Apple policy to intermittently require your recovery key in addition to your security key. This is a new policy and no consent process was established. They also make it so you cannot validate your recovery key and replace it if necessary, including no communication of the new practice for user review (which establishes a higher precedence for securing the recovery key).

olliej 4y ago
Oh, I recognize the apple "you lost your identity" isn't a great match here, just that there do exist cases where its possible that it's literally impossible to recover data. I recognize that is not the case for you, it sounds like google decided without either informing you or gaining consent that they were going to use your recovery password as a second factor (unless that's stated in initial sign up, which could be plausible given the world of tech small text). The problem from Google's point of view now, is that given the existence - rightly or wrongly - of a 2nd factor, everything you do is fundamentally indistinguishable from a hacking/social engineering attempt. That is what I was trying to communicate. I want to be clear, I am not agreeing with google's behaviour w.r.t unilaterally applying 2nd factor, just that given that in their database your account has two factor, by definition your username+password cannot be considered sufficient. The alternative would defeat the purpose of 2nd factor.
- survirtual 4y ago
  Right, and I think that fact that I, as the valid account holder, have been placed in a category of indistinguishable from someone social engineering access to my account, simply for not updating a recovery email, makes it all the more irritating. It is trivially easy for google to validate if the email in use is still valid. I haven’t cared to look into the inner workings of email but surely there is also a host signing key for emails too, or some kind if protocol level handshake. Anyway, my only hope is being okay spending more money to buy the domain. When / if that happens, I will make it possible for anyone else to recover their old email with it.
  - olliej 4y ago
    Oh, no part of the problem with email is that there is no authentication of mail servers, etc. It hails to a bygone age of hopeless optimism :D To repeat though, I wholly agree it is wholly unreasonable for Google to repurpose anything on your account for 2FA, without consent and explicit clear notification. I'm sorry this has happen, it really does suck, and I hope maybe you can coax the domain owner into adding just a forwarding address rather than having to buy it :-/

olliej 4y ago

Oh, I recognize the apple "you lost your identity" isn't a great match here, just that there do exist cases where its possible that it's literally impossible to recover data. I recognize that is not the case for you, it sounds like google decided without either informing you or gaining consent that they were going to use your recovery password as a second factor (unless that's stated in initial sign up, which could be plausible given the world of tech small text). The problem from Google's point of view now, is that given the existence - rightly or wrongly - of a 2nd factor, everything you do is fundamentally indistinguishable from a hacking/social engineering attempt. That is what I was trying to communicate. I want to be clear, I am not agreeing with google's behaviour w.r.t unilaterally applying 2nd factor, just that given that in their database your account has two factor, by definition your username+password cannot be considered sufficient. The alternative would defeat the purpose of 2nd factor.

survirtual 4y ago
Right, and I think that fact that I, as the valid account holder, have been placed in a category of indistinguishable from someone social engineering access to my account, simply for not updating a recovery email, makes it all the more irritating. It is trivially easy for google to validate if the email in use is still valid. I haven’t cared to look into the inner workings of email but surely there is also a host signing key for emails too, or some kind if protocol level handshake. Anyway, my only hope is being okay spending more money to buy the domain. When / if that happens, I will make it possible for anyone else to recover their old email with it.
- olliej 4y ago
  Oh, no part of the problem with email is that there is no authentication of mail servers, etc. It hails to a bygone age of hopeless optimism :D To repeat though, I wholly agree it is wholly unreasonable for Google to repurpose anything on your account for 2FA, without consent and explicit clear notification. I'm sorry this has happen, it really does suck, and I hope maybe you can coax the domain owner into adding just a forwarding address rather than having to buy it :-/