4 ms·
You lose your entire Google account if you lose your 2FA device or number (assuming it's a phone number), for any reason. Even if your Google account is set up
by arbuge 4y ago
You lose your entire Google account if you lose your 2FA device or number (assuming it's a phone number), for any reason. Even if your Google account is set up with a non-Google email address which you still have access to, and you still know the correct password. And there's nobody you can reach at Google about it, no appeals process, nothing.
https://news.ycombinator.com/item?id=33098261 https://news.ycombinator.com/item?id=33098261
- anotherman554 4y agoThat link involves someone with no backup email address connected to their google account for recovery purposes, for what it's worth.
- arbuge 4y agoYou can set a backup email address for Google accounts if they're using Google email addresses, but you can't do this if they're using non-Google email addresses as the primary address, such as the one in that link. I'm logged in to such an account right now and there's no way to do this. The account primary email is also set as the recovery email address and there's no way to add another. It's actually deceptive to the user to even call it a recovery email address in this case, since Google will never offer to alternatively send a verification code there if the 2FA device is unavailable.
- ChrisGranger 4y agoI lost access to a Gmail account for which I had the correct password and a recovery email with a different email service. I was still unable to convince the Google machine that the account was mine. My suspicion is that because I'd changed operating systems on my desktop, I appeared to be 'someone else' as far as Gmail was concerned.
- mihaaly 4y agoI took three steps against this happening: 1) Not providing phone number for 2FA. Never. 2) Using multiple (3 pcs.) physical keys for 2FA (like Yubikey and similar). Authentication app is an alternative for one choice of 2FA (but not the sole one!) 3) Only using a limited set of Google functionality. Use for secondary purposes mostly. Well, the last one is mainly to mitigate the consequences if happens anyway, for other reasons too (like with that poor guy who made picture of his own naked baby for a remote diagnostics with his doctor and the Google locked him out for months - and still counting at the time of the article - for child pornography)
- aliqot 4y agoI took one step: 1) Don't use anything Google.
- alpentmil 4y agoPlease tell this to all homeless people.
- deleted 4y ago[deleted]
- ugjka 4y agoI get funny looks when people ask for my email. I have @protonmail.com email
- aliqot 4y agoMy sympathies go out to you, I get similar looks for not having a phone.
- ChrisGranger 4y agoLikewise, I've never had a cellphone and I have no intention of ever getting one. Interacting with a website should never require a portable device.
- mihaaly 4y agoI have that too! : ) That is dedicated for the important things.
- indrora 4y agoYou took a step that requires a lot of skill, wealth, and privilege.
- KirillPanov 4y ago
- edgecasestdio 4y agoI verify that this is true at the time of posting. In previous volunteer work at a non-profit run by university students, the organization assigned a free Gmail account to each executive. Each year, we ran into a problem where the executives would change, and we needed to transfer the Gmail account to the new person. Problems would happen when the new person tried to log in to the account. Since the login was from an unrecognized device and an unrecognized IP address, security was tightened. Even after inputting the correct password and entering the right backup email, it was mandatory to enter an SMS message from the phone number tied to the account, even after various troubleshooting and attempted workarounds. That meant getting ahold of the previous executive, who may be busy or changed their number. You could argue that Gmails weren't meant to be used this way, which is fair; the goal of this comment is just to provide additional evidence that the description provided by the parent comment is true. (In the end, we went for a low-cost, reliable email service to fix the issue in the long-term. We also found that registered non-profits are eligible for free Google Workspace or Microsoft Outlook email plans subject to certain eligibility conditions, though we did not have a need of becoming an officially registered non-profit at the time.)
- pfooti 4y agoFWIW, if you're the administrator of the organization, you can disable 2FA from the admin console for that user's next login. I've done this a few times for similar reasons.
- edgecasestdio 4y agoThanks for the tip, though this just works for a paid Google Workspace email plan (or a free Google Workspace for Nonprofits plan) [1]. We couldn't do this because we were using free personal Gmail accounts at the time (by transferring the credentials from retired executives to new executives) as we lacked budget and formal non-profit registration (to be eligible for the Nonprofits plan) since the group was fairly small and undergraduate student-run. The difficulties were to be expected as personal Gmails weren't meant to be used like this (the goal was just to share an anecdote about the difficulties of phone numbers used for two-factor authentication with the free service even once a year). The long-term solution we used was to pay for a reliable but low-cost (in comparison to Outlook and Google) email host initially recommended on HN and a few sysadmin forums, to gain access to organization-wide admin features. [1] https://support.google.com/a/answer/2537800?hl=en#zippy=%2Ccheck--step-verification-settings https://support.google.com/a/answer/2537800?hl=en#zippy=%2Cc...
- whoooooo123 4y agoOne of the many reasons why I switched from GMail to Fastmail.
- arbuge 4y agoGoogle accounts are required for many other Google services besides Gmail. Replacing Gmail is the easy part.
- GraphenePants 4y agoAgreed. It's irresponsible that the homeless don't have $50 a year for Fastmail. It's worth going hungry to be the customer and not the product.
- arubania2 4y agoThis is what one-time backup codes are for. Alternatively you can purchase a hardware key and store it in a trusted place, but admittedly they are expensive, so OTBC is the usual route.
- zmmmmm 4y agoyes I am confused why people aren't discussing OTBC ... is it an assumption that if you lose all your possessions then you lost these as well? Doesn't seem valid as you can certainly give them to a trusted person for safe keeping as well. Or bury them in the ground if you want somewhere.
- ineedasername 4y agoIt’s this sort of thing that has prevented me from activating 2FA on my gmail account. I pay for Google Drive (as a tertiary backup) and would be willing to pay more for service that include actual customer service. At this point though I feel locked in. I could switch (any suggestions on paid email with *real* support available?) but it’s a pretty big burden to go through every site & service that uses my email as either a login or password reset vector and change things over. Heck, here’s an idea for a startup: a digital “moving” service. IRL I could pay a company to take everything I own, pack it up, ship it somewhere else, and even unpack it too. I’d like to see a digital equivalent.