6 ms·

You can't recover your Google account if you lose your 2FA device

50 points by arbuge 4y ago

I have a Google account which used a phone number I no longer have for 2FA. I have the correct password to it, but can't login to it without 2FA. Google sends me to an account recovery sequence when I try to regain control over the account, but there's actually no way to complete this either without the phone. Of course there's no human support available. The only "suggestion" they provide is to create a new Google account, which certainly isn't helpful... Screenshot attached. (Email address in that screenshot has been blanked out). https://imgur.com/a/OT1pqy9 To be clear, I still have access to the email address in question and could certainly retrieve any recovery code they send there. They don't offer that option though. Phone or nothing.

MrWiffles 4y ago
Yep. Just another example of why we should never trust google.
- remus 4y ago
  > Yep. Just another example of why we should never trust google. The other alternative is that you have some support person on the end of the phone who can grant access to accounts. Historically this has been a ripe for social engineering attacks leading to stolen accounts. It is not hard to setup mfa on your google account so that there are no single points of failure.
- cersa8 4y ago
  Not a Google fan but I don't want any other means than my 2fa to unlock my account.
smt88 4y ago
It's infuriating. I've dealt with this before. It should be illegal. Your two options are: 1. Tweet at Google to get human support (sometimes works, sometimes doesn't) 2. Talk to a Google employeee, because they have access to an internal support ticketing system that you don't
- arbuge 4y ago
  #2 doesn't seem possible. I don't see any way to reach any such Google employee.
  - smt88 4y ago
    Yes, unfortunately you have to already be friends with one.
    - arbuge 4y ago
      This may work for a small subset of the population with the right friends at Google I guess, but certainly isn't an acceptable solution in general.
      - smt88 4y ago
        I agree. It's not a solution. It's a workaround that's necessary because Google explicitly does not want to provide a solution.
- proactivesvcs 4y ago
  If I cannot present any of our agreed methods of identification (login + 2FA, login + 2FA recovery code or login + recovery email) then I do not want a human to be able to unlock my account. That's how we get compromised. This is exactly what 2FA is designed to protect against.
  - smt88 4y ago
    I had this issue despite having full access to multiple other factors. I was stuck in an automated fraud detection loop.
  - derbOac 4y ago
    Although I more or less agree with you, I think the intuition is that some "common sense" method of identification should work. E.g., you should be able to identify yourself with government-issued ID somewhere or something. I think the frustration is that at some level, e.g., the 2FA device is being privileged over something like a notarized government verification of identity by a living human. So although I agree that you shouldn't be able to just e.g., call on the phone and ask nicely, it seems like for important accounts there should be some protocol for doing it involving some real-world chain. When everyone has 2FA, 2FA backup keys become kind of impractical in the same way it becomes impractical to remember all your passwords.
WallyFunk 4y ago
This happened to me, and I had a hard lockout. Luckily the account was not that important, as I only used it for the Play store. It was a learning experience. I setup another Google account after this, but made sure I had a copy of the recovery codes which will allow me get me back in if I lost my 2FA device (in this case a Yubikey). I prefer a Yubikey over basic SMS since it's easier to get a SIM lost than a Yubikey. I have the Yubikey on my keychain.
proactivesvcs 4y ago
Are they not offering you the chance to enter one of your 2FA Recovery Codes?
- arbuge 4y ago
  As stated, I no longer have the phone number used for 2FA on this account, so I can't get the recovery code that way. I don't have any other recovery codes for this account.
  - aareet 4y ago
    Perhaps call your old number and see if that person is willing to share the code with you?
    - arbuge 4y ago
      It's not active any more. Calling it goes to an "out of service" message.
      - ovao 4y ago
        Could you sign up for a plan with the carrier it was on and request that number?
        arbuge 4y ago
        It wasn't a cellphone number. It was a free fax/voicemail number with jConnect. Inexplicably they changed the number I was assigned last year, and I haven't been able to reach anyone there about this, despite several attempts.
  - proactivesvcs 4y ago
    Recovery codes are meant to be recorded when enabling 2FA. They can then be used (once per code) in place of a 2FA code, in case of your predicament. Have you perhaps noted these down somewhere? This circumstance is how 2FA is meant to work, otherwise an unauthorised someone could access your account, especially if they had comprised your primary email account. More often than not, people do not secure their email accounts. On one hand I'm glad there is no way to access an account without any of the agreed methods, and on the other empathise that this is scant consolation for losing an account :-(
codegeek 4y ago
If you use Google accounts with 2FA, please do the following: 1. Setup a backup email for recovery 2. Copy paste and save Backup Codes somewhere remote 3. If you are using an app like "Google Authenticator", they have an easy way to Export the settings on another phone. Do it on your wife's/gf's/family/sibling etc phone and that way you have another backup of 2FA codes. 4. Do not use the "Google Prompt" option because that only works on primary device.
- jqpabc123 4y ago
  Simple solution --- don't use Google Authenticator. Google didn't invent any of this, it is fully standardized (see RFC6238). There are lots of fully compatible alternatives with better options for security and backup and restore. Personally, I use FreeOTP+ with a password lock and secret keys backed up off device. Secondary opinion, why is the Google app lacking? Because they really don't want people to use it. They much prefer you reveal your phone number and use SMS instead. This way they can easily identify you personally. Remember, everything Google does is subtly designed to help violate your privacy in some way. The quickest way to convince me not to use an app is to put a "Google" label on it.
  - tgma 4y ago
    > Secondary opinion, why is the Google app lacking? Because they really don't want people to use it. They much prefer you reveal your phone number and use SMS instead. This way they can easily identify you personally. Sure, companies may do some evil things intentionally, but an app UI sucking is usually the default state of things and not some malice necessarily. In this case, I think part of the neglect of Google Authenticator is them trying for years to pivot to other forms of two-factor authentication that are more phishing-resistant than an OTP (Yubikey-like and smartphone based systems).
    - sand500 4y ago
      SMS 2FA is not secure. Lots of HN posts about it: https://hn.algolia.com/?q=sms+2fa https://hn.algolia.com/?q=sms+2fa
izacus 4y ago
Aren't you very clearly and explicitly warned to print out the recovery codes for this exact emergency? All 2FA sites do that?
- arbuge 4y ago
  I never got any message from Google advising me to do this. I did get a message today to login into my account to check my security settings and see if they were all up to date, which is what prompted this. Maybe there would have been some messages in there to this effect. But I didn't manage to login...
  - deleted 4y ago
    [deleted]
- filoleg 4y ago
  Yeah, i get it every time when setting up a new 2FA service anywhere + some remind me once in a while (on login) to download backup codes (for services where I haven't done so yet).
- deleted 4y ago
  [deleted]
suprjami 4y ago
Heading is misleading. "You can't recover lost 2FA if you don't save the recovery codes like the setup tells you to do."
- arbuge 4y ago
  Maybe setup tells you to do that now, but this is an old account and it probably didn't say anything like that when I set it up many years ago. No recovery codes were ever generated for this account. I don't think it's reasonable to lock out a user who has the correct password and access to the primary email on the account. I understand there are situations in which both of those could be compromised but locking out all users with no human customer support, review, or recourse is unacceptable in my opinion.
  - sowbug 4y ago
    Recovery codes have been part of Google's 2FA setup process since the 2FA feature was publicly released in February 2011. (Actually since September 2010 for Google Apps users, a.k.a. GSuite/Workspace users.)
    - arbuge 4y ago
      Perhaps. And if I had known that I'd be locked out of my account in this way, even though I still have the correct password and access to the primary email, with no way to reach a human about it, of course I'd have generated those codes.
Mikeb85 4y ago
And this is why you should avoid using SMS for 2FA at all costs... Backup email, authenticator app, actually save the recovery codes, etc...
runjake 4y ago
Proposal to change the post title to: "You can't recover your Google account if you lose your 2FA device, don't set a backup email account, don't save backup codes, or anything else Google recommends you do to avoid losing access to your Google account." Heck, Google even pesters me occasionally upon login to confirm all the above info is still good. There's a lot of things to criticize Google about, but I don't think this is one of them.
- tmnvix 4y ago
  > To be clear, I still have access to the email address in question and could certainly retrieve any recovery code they send there. They don't offer that option though. Phone or nothing. My interpretation was that they do have a backup email address registered.
  - arbuge 4y ago
    No, I don't have a secondary email on this account.
- arbuge 4y ago
  You cannot follow any of those recommendations if you can't login to your account to do that, which is what I was trying to do. The email I received today was one of the "pestering" emails you refer to. Cannot be implemented since I'm not signed in anywhere currently and unable to login.
- arbuge 4y ago
  Regarding the backup email account suggestion specifically, see my other comment in this thread. That's not actually possible apparently for Google accounts set up with non-Google email addresses as the primary email address, for some reason best known only to Google. For those accounts, Google also sets your primary email as the backup email, which doesn't really make sense if you think about it. To cap it all, there is no option to use that email for actually recovering the account, so even calling it a recovery email is deceptive.
MomoXenosaga 4y ago
"Don't let yourself get attached to anything you are not willing to walk out on in 30 seconds flat if you feel the heat around the corner". I can confidently say this about every account I have barring my primary email (outlook).
stoplying1 4y ago
I have to admit I came here to wag a finger but it does kinda appear that Google will let you enroll a phone and then ... Offers... But doesn't really encourage or force the user to download backup codes. Tbh, if I were Google, I'd force the user to prove they have a second second-factor added before enabling. Force them to enter the first half of one recovery code or something. Of course, if anyone really asked me, I've been screaming about SMS 2FA for forever, but its just one of those things most people just can't be bothered to care about until...
valrama 4y ago
When you say "I still have access to the email address in question" - are you signed in to the account somewhere? If yes, you could turn off 2FA in myaccount.google.com as long as you remember the password (which you say you do)
- arbuge 4y ago
  Unfortunately not signed in anywhere currently.
  - valrama 4y ago
    Ah. Can you clarify what you meant by that, then? You have mail set up to be forwarded somewhere or something?
    - arbuge 4y ago
      You can set up Google accounts with non-Google email addresses as the email on the account. So I can receive email, no problem.
      - valrama 4y ago
        Ah, I see. The only thing that comes to mind is to check if you followed one of the tips from this page: https://support.google.com/accounts/answer/7299973 https://support.google.com/accounts/answer/7299973, which is to use a computer (or phone), or same location from where you have successfully accessed your account before ("like at home or at work"). Of course that is not a guarantee of anything, but worth a shot to attempt account recovery again if you have an option to try one of those things.

50 points by arbuge 4y ago

MrWiffles 4y ago

Yep. Just another example of why we should never trust google.

remus 4y ago
> Yep. Just another example of why we should never trust google. The other alternative is that you have some support person on the end of the phone who can grant access to accounts. Historically this has been a ripe for social engineering attacks leading to stolen accounts. It is not hard to setup mfa on your google account so that there are no single points of failure.
cersa8 4y ago
Not a Google fan but I don't want any other means than my 2fa to unlock my account.

smt88 4y ago

It's infuriating. I've dealt with this before. It should be illegal. Your two options are: 1. Tweet at Google to get human support (sometimes works, sometimes doesn't) 2. Talk to a Google employeee, because they have access to an internal support ticketing system that you don't

arbuge 4y ago
#2 doesn't seem possible. I don't see any way to reach any such Google employee.
- smt88 4y ago
  Yes, unfortunately you have to already be friends with one.
  - arbuge 4y ago
    This may work for a small subset of the population with the right friends at Google I guess, but certainly isn't an acceptable solution in general.
    - smt88 4y ago
      I agree. It's not a solution. It's a workaround that's necessary because Google explicitly does not want to provide a solution.
proactivesvcs 4y ago
If I cannot present any of our agreed methods of identification (login + 2FA, login + 2FA recovery code or login + recovery email) then I do not want a human to be able to unlock my account. That's how we get compromised. This is exactly what 2FA is designed to protect against.
- smt88 4y ago
  I had this issue despite having full access to multiple other factors. I was stuck in an automated fraud detection loop.
- derbOac 4y ago
  Although I more or less agree with you, I think the intuition is that some "common sense" method of identification should work. E.g., you should be able to identify yourself with government-issued ID somewhere or something. I think the frustration is that at some level, e.g., the 2FA device is being privileged over something like a notarized government verification of identity by a living human. So although I agree that you shouldn't be able to just e.g., call on the phone and ask nicely, it seems like for important accounts there should be some protocol for doing it involving some real-world chain. When everyone has 2FA, 2FA backup keys become kind of impractical in the same way it becomes impractical to remember all your passwords.

WallyFunk 4y ago

This happened to me, and I had a hard lockout. Luckily the account was not that important, as I only used it for the Play store. It was a learning experience. I setup another Google account after this, but made sure I had a copy of the recovery codes which will allow me get me back in if I lost my 2FA device (in this case a Yubikey). I prefer a Yubikey over basic SMS since it's easier to get a SIM lost than a Yubikey. I have the Yubikey on my keychain.

proactivesvcs 4y ago

Are they not offering you the chance to enter one of your 2FA Recovery Codes?

arbuge 4y ago
As stated, I no longer have the phone number used for 2FA on this account, so I can't get the recovery code that way. I don't have any other recovery codes for this account.
- aareet 4y ago
  Perhaps call your old number and see if that person is willing to share the code with you?
  - arbuge 4y ago
    It's not active any more. Calling it goes to an "out of service" message.
    - ovao 4y ago
      Could you sign up for a plan with the carrier it was on and request that number?
      - arbuge 4y ago
        It wasn't a cellphone number. It was a free fax/voicemail number with jConnect. Inexplicably they changed the number I was assigned last year, and I haven't been able to reach anyone there about this, despite several attempts.
- proactivesvcs 4y ago
  Recovery codes are meant to be recorded when enabling 2FA. They can then be used (once per code) in place of a 2FA code, in case of your predicament. Have you perhaps noted these down somewhere? This circumstance is how 2FA is meant to work, otherwise an unauthorised someone could access your account, especially if they had comprised your primary email account. More often than not, people do not secure their email accounts. On one hand I'm glad there is no way to access an account without any of the agreed methods, and on the other empathise that this is scant consolation for losing an account :-(

codegeek 4y ago

If you use Google accounts with 2FA, please do the following: 1. Setup a backup email for recovery 2. Copy paste and save Backup Codes somewhere remote 3. If you are using an app like "Google Authenticator", they have an easy way to Export the settings on another phone. Do it on your wife's/gf's/family/sibling etc phone and that way you have another backup of 2FA codes. 4. Do not use the "Google Prompt" option because that only works on primary device.

jqpabc123 4y ago
Simple solution --- don't use Google Authenticator. Google didn't invent any of this, it is fully standardized (see RFC6238). There are lots of fully compatible alternatives with better options for security and backup and restore. Personally, I use FreeOTP+ with a password lock and secret keys backed up off device. Secondary opinion, why is the Google app lacking? Because they really don't want people to use it. They much prefer you reveal your phone number and use SMS instead. This way they can easily identify you personally. Remember, everything Google does is subtly designed to help violate your privacy in some way. The quickest way to convince me not to use an app is to put a "Google" label on it.
- tgma 4y ago
  > Secondary opinion, why is the Google app lacking? Because they really don't want people to use it. They much prefer you reveal your phone number and use SMS instead. This way they can easily identify you personally. Sure, companies may do some evil things intentionally, but an app UI sucking is usually the default state of things and not some malice necessarily. In this case, I think part of the neglect of Google Authenticator is them trying for years to pivot to other forms of two-factor authentication that are more phishing-resistant than an OTP (Yubikey-like and smartphone based systems).
  - sand500 4y ago
    SMS 2FA is not secure. Lots of HN posts about it: https://hn.algolia.com/?q=sms+2fa https://hn.algolia.com/?q=sms+2fa

izacus 4y ago

Aren't you very clearly and explicitly warned to print out the recovery codes for this exact emergency? All 2FA sites do that?

arbuge 4y ago
I never got any message from Google advising me to do this. I did get a message today to login into my account to check my security settings and see if they were all up to date, which is what prompted this. Maybe there would have been some messages in there to this effect. But I didn't manage to login...
- deleted 4y ago
  [deleted]
filoleg 4y ago
Yeah, i get it every time when setting up a new 2FA service anywhere + some remind me once in a while (on login) to download backup codes (for services where I haven't done so yet).
deleted 4y ago
[deleted]

suprjami 4y ago

Heading is misleading. "You can't recover lost 2FA if you don't save the recovery codes like the setup tells you to do."

arbuge 4y ago
Maybe setup tells you to do that now, but this is an old account and it probably didn't say anything like that when I set it up many years ago. No recovery codes were ever generated for this account. I don't think it's reasonable to lock out a user who has the correct password and access to the primary email on the account. I understand there are situations in which both of those could be compromised but locking out all users with no human customer support, review, or recourse is unacceptable in my opinion.
- sowbug 4y ago
  Recovery codes have been part of Google's 2FA setup process since the 2FA feature was publicly released in February 2011. (Actually since September 2010 for Google Apps users, a.k.a. GSuite/Workspace users.)
  - arbuge 4y ago
    Perhaps. And if I had known that I'd be locked out of my account in this way, even though I still have the correct password and access to the primary email, with no way to reach a human about it, of course I'd have generated those codes.

Mikeb85 4y ago

And this is why you should avoid using SMS for 2FA at all costs... Backup email, authenticator app, actually save the recovery codes, etc...

runjake 4y ago

Proposal to change the post title to: "You can't recover your Google account if you lose your 2FA device, don't set a backup email account, don't save backup codes, or anything else Google recommends you do to avoid losing access to your Google account." Heck, Google even pesters me occasionally upon login to confirm all the above info is still good. There's a lot of things to criticize Google about, but I don't think this is one of them.

tmnvix 4y ago
> To be clear, I still have access to the email address in question and could certainly retrieve any recovery code they send there. They don't offer that option though. Phone or nothing. My interpretation was that they do have a backup email address registered.
- arbuge 4y ago
  No, I don't have a secondary email on this account.
arbuge 4y ago
You cannot follow any of those recommendations if you can't login to your account to do that, which is what I was trying to do. The email I received today was one of the "pestering" emails you refer to. Cannot be implemented since I'm not signed in anywhere currently and unable to login.
arbuge 4y ago
Regarding the backup email account suggestion specifically, see my other comment in this thread. That's not actually possible apparently for Google accounts set up with non-Google email addresses as the primary email address, for some reason best known only to Google. For those accounts, Google also sets your primary email as the backup email, which doesn't really make sense if you think about it. To cap it all, there is no option to use that email for actually recovering the account, so even calling it a recovery email is deceptive.

MomoXenosaga 4y ago

"Don't let yourself get attached to anything you are not willing to walk out on in 30 seconds flat if you feel the heat around the corner". I can confidently say this about every account I have barring my primary email (outlook).

stoplying1 4y ago

I have to admit I came here to wag a finger but it does kinda appear that Google will let you enroll a phone and then ... Offers... But doesn't really encourage or force the user to download backup codes. Tbh, if I were Google, I'd force the user to prove they have a second second-factor added before enabling. Force them to enter the first half of one recovery code or something. Of course, if anyone really asked me, I've been screaming about SMS 2FA for forever, but its just one of those things most people just can't be bothered to care about until...

valrama 4y ago

When you say "I still have access to the email address in question" - are you signed in to the account somewhere? If yes, you could turn off 2FA in myaccount.google.com as long as you remember the password (which you say you do)

arbuge 4y ago
Unfortunately not signed in anywhere currently.
- valrama 4y ago
  Ah. Can you clarify what you meant by that, then? You have mail set up to be forwarded somewhere or something?
  - arbuge 4y ago
    You can set up Google accounts with non-Google email addresses as the email on the account. So I can receive email, no problem.
    - valrama 4y ago
      Ah, I see. The only thing that comes to mind is to check if you followed one of the tips from this page: https://support.google.com/accounts/answer/7299973 https://support.google.com/accounts/answer/7299973, which is to use a computer (or phone), or same location from where you have successfully accessed your account before ("like at home or at work"). Of course that is not a guarantee of anything, but worth a shot to attempt account recovery again if you have an option to try one of those things.