14 ms·

Ask HN: If I get locked out of everything, please try to help me

• bluehorseray 4y ago
  Try to find a 3rd party phone repair shop. There's a decent chance they can get your old phone charging pretty quickly and cheaply if it's just your charging port being dirty / faulty.
• brundolf 4y ago
  Beside the main point (because I don't work at Google), but can we do anything else to help? I've seen you on here quite a bit, and if you had a PayPal or something I'd happily chip in
• deleted 4y ago
  [deleted]
• pasttense01 4y ago
  Read this thread: "Ask HN: How to Recover Gmail Account" https://news.ycombinator.com/item?id=33850676 https://news.ycombinator.com/item?id=33850676
• Wowfunhappy 4y ago
  This is my nightmare. This is why I refuse to use 2FA. (Except on services that require it, and I wish they didn't require it.) Am I worried about getting hacked? Absolutely! But when I weigh the likelihood of (1) someone else getting into my account without 2FA and (2) locking myself out of my own account with 2FA, the latter seems much more likely! I understand how backup codes work. I promise you I will loose them.
  • DoreenMichele 4y ago
    I'm seriously medically handicapped and have terrible eyesight issues. I typed the wrong password at first. I still had 1 percent power on my phone earlier and was previously able to get a code on it and I hoped I could get one last code before it outright died, so I said "Yeah, sure, send it to my phone" since they don't really want to do it another way. So then I had to ask another way when I couldn't get to it because that is when the phone gave up the ghost for good. And then they said "We shall send you a link in 24 hours." So I moved the sim card and got text messages saying "Was this you?" and I said "Yeah, it was." and cancelled my "account recovery process" and tried to continue setting up my new phone because the old one is dead. And this is when Google decided I must be a for serious criminal and told me "We shall send you an email in 72 hours." So I'm quite upset at this point.
    • shyn3 4y ago
      I think you should take your phone to a store which can fix your phone. Googles code doesn't come as an SMS it comes as a notification from the Google app. Almost lost an account to this last week. Turned off 2fa.
      • DoreenMichele 4y ago
        I'm in a small town. I have no car. I no longer drive. I don't see well enough. I work from home due to my medical situation. I have no friends locally who can drive me someplace. Etc etc etc. This is a non-starter for me. I need Google to fix this. I can't do anything about the busted phone at this point.
        • actionfromafar 4y ago
          On HN you might get access to someone at Google, or someone from here might drive TO you. Any takers? I’m on the wrong continent.
          • deleted 4y ago
            [deleted]
• deleted 4y ago
  [deleted]
• crooked-v 4y ago
  There was a post a while back around poor and homeless people encountering exactly this problem on a regular basis. Lots of people in the comments were incredibly dismissive and sometimes actively malign about it. Edit: One suggestion from me would be to try and start the dead phone connected to power but with the battery physically removed (assuming it's removable). That might bypass whatever issue it's having and let it start up.
  • Gigachad 4y ago
    Problem is that support people mistakenly resetting account auth when the attacker calls up and social engineers them is a bigger and more common issue than people’s only device dying. Not to say that’s not a thing that happens, but it’s a smaller of the two problems.
    • DoreenMichele 4y ago
      It's a smaller of the two problems for the company. If you are really poor, losing access to your online life because you couldn't pay your phone bill or something can be a huge, huge problem. I have been homeless. I'm not currently. But this is an extremely stressful situation that could do all kinds of damage to my life if I can't get it sorted.
      • fncivivue7 4y ago
        We're talking about hackers getting access to users accounts, that's not a Google problem, that's an everyone problem.
        • Gigachad 4y ago
          Back at the start of 2FA rolling out it used to be an absolutely massive issue where the attackers would call up support and tell a sob story and have the account reset and in the control of the attackers. As a user it doesn't matter how well you manage your own security when that can happen.
        • 4y ago
• deleted 4y ago
  [deleted]
• alexpetralia 4y ago
  Hi Doreen, I am sure many people recognize you as a long-time HN user! I hope someone from Google can reach out to their accounts team on your behalf.
  • h4t 4y ago
    Yeah as soon as she said Mz I was like oh I've seen them around.
• treme 4y ago
  hn-support best support in tech
  • reaperducer 4y ago
    best support in tech Only support in tech.
    • PaulHoule 4y ago
      At least for "big" tech.
      • quickthrower2 4y ago
        Shibbol33t as a service
• password4321 4y ago
  I have to use wireless charging because the connector on my old phone is toast. It was a lifesaver for ~$15.
  • djbusby 4y ago
    Same. On a Pixel no less.
  • mindslight 4y ago
    For the technical solution, I would focus on getting that old phone some power. Wireless charging, gently pushing the charging connector in the magic direction, swapping the battery, taking it to a repair shop that could reflow the power connector or use some kind of battery emulator. Google just paternalistically chooses which device they think should be your most trusted one, and then insists that you produce it. No consent, no concern for your actual security model, just pure snake oil that tech-rubes eat up as "2fA sEcUrItY". Any damn time I want to use a Google account from a desktop browser, I get the same rigamarole of having to unearth some discharged tablet and wait for it to charge, just to jump through their nonsense. I shudder to think what would happen if I took the obvious remedy and just removed those devices from my account.
  • derekp7 4y ago
    I've needed to scrape the USB connector in the phone with a needle (digging around the outside and scraping the tab in the middle) in order to get the cord to stay in place. It gets filled up with pocket lint gunk, and needs cleaning every once in a while. Also since the phone is water proof I've taken to letting water run into the USB connector to really clean it.
    • quickthrower2 4y ago
      For Apple phones: genius bar told me they’ll clean it for free no appointment. ymmv.
• sacrosancty 4y ago
  Is that SMS codes or an app? How can you know they're being sent to the dead phone when it's dead? Maybe they were never being sent to that number at all? Obviously there must be a process to gain access when your phone with an authenticator app is lost or destroyed. Why is that process not working?
  • DoreenMichele 4y ago
    I know because the messages on my NEW phone that I am trying to set up state "We sent this to (your old phone -- identified by type of phone, which is different from the model I am setting up).
    • sacrosancty 4y ago
    • r3muxd 4y ago
      This is because Google has a disaster of a 2FA process where even if you have 2FA disabled, they will "send a prompt to the Google app on %s device" to verify it's you. What happens if that device doesn't have the Google app installed? You're screwed. The only fix for this is to, paradoxically, ENABLE 2FA, which then you can force to go ovet text.
      • sacrosancty 4y ago
    • viraptor 4y ago
      I think there's some confusion about messaging. If Google knows the model/name, then it's likely not SMS being sent, but rather one of the "review this login" system pop-ups. See if you can revert to SMS verification through some option at login. I can't verify it now, but the choice could be accessible though something non-obvious like "I'm having problems verifying". Make sure it's trying to use a text message instead of some other method... and let's hope you have it configured.
• hypertele-Xii 4y ago
  This is why you get backup codes and physically write them down. I know it's of no consolation for you OP at this point though.
• fotta 4y ago
  Google is extremely frustrating in this regard. I keep my TOTP in 1Password so that I can have it on multiple devices. When I tried to login in on a new device, I used the TOTP code. Google then wanted me to click approve in the YouTube app on an old device that was no longer functioning. Eventually I was able to get it to work by re-logging in a few times (I guess it gave up) but why the fuck do I even have 2FA if Google isn’t going to fucking respect it? Infuriating.
• josephcsible 4y ago
  I'd expect that you'd move your number to your new phone's SIM, and that Google would then let you verify with SMS. Do they not let you do this?
• savingsPossible 4y ago
  It 2fa needed to connect your google account to a new phone? If not, then 2fa just pisses people of with no security gain But I surely hope it is not!
• brongondwana 4y ago
  This is highly frustrating and it sucks. Also Google is totally doing the right thing here. The slow down and wait is precisely the thing that protects you from identity theft if somebody waits until your phone is turned off, clones your SIM, and pretends to be in precisely this situation. Hopefully in THAT case, you notice the "somebody is trying to get into your account" and say "no, this is a hack attempt". Good luck.
• savingsPossible 4y ago
  If anyone got afraid and wants to disable 2fa, go to https://myaccount.google.com/security https://myaccount.google.com/security
  • discardedrefuse 4y ago
    The trick isn't to disable 2FA. It's to add a bunch of 2FA methods that don't rely on your cell phone: authenticator app, yubi keys, backup codes.
    • havo 4y ago
      This is terrible advice. Please don't ever rely on authenticator apps. Try changing your phone, resetting your phone or losing your phone and watch yourself get locked out of your accounts with absolutely no recourse.
      • Rebelgecko 4y ago
        Isn't that the point of enabling multiple methods? So that the others can be used as backups? Or does enabling multiple 2fa methods potentially out you in a situation where if just 1 method is unusable you won't be able to log in?
      • Eleison23 4y ago
      • opan 4y ago
        TOTP can also be used from a PC with something like KeePassXC, and you can have the DB sync to other devices with SyncThing (including your phone where you can access them with KeePassDX). Much better than SMS which really is tied to your phone (or SIM, rather).
      • quickthrower2 4y ago
        I chuck all my totps on my wifes phone as a backup. Google Authenticator lets you export the lot as a single QR
• jrmg 4y ago
  I have long wondered if two factor authentication actually causes more economic harm than it solves - it just doesn’t cause that harm to be noticeably all in one place (the harm is spread to millions of users who will lose access at some point during their lives rather than concentrated on the company that implements TFA dealing with fraud). It feels like it might. This isn’t counting the productivity that’s lost to actually using the TFA system successfully, which is probably measurable on a population level.
  • djbusby 4y ago
    This is the way of capitalism. Move costs outside your organization and call it profit. It's why companies don't offer phone support. Or ones that do (like mine) get premium pricing.
    • the_third_wave 4y ago
      Of course many if not most of the services would not be offered in the first place had it not been for the financial incentive offered by the market economy (i.e. 'capitalism' painted with broad strokes) so you can pick your evil: have a market economy with many players, some good and some bad... or have some alternative economical organisation with far fewer services, usually still good or bad. At least the market economy and 'capitalism' offers the choice of foregoing on those 'premium' services by enabling me to run my own services on my own hardware connected to the 'net through my own fibre connection. Since 'capitalism' leads to more choice it puts the onus on the individual to choose wisely. For some that choice comes down to paying more for those 'premium' services, for others - like me - it means I do a little more work to be able to run my own things. If I loose access I can get it back, the hardware is right here on the farm after all. I have 2FA enabled on a number of services to protect against leaked passwords but since everything is run in-house I can always get back access if I for some reason lost (access to) my devices and backup codes. This is a win for 'capitalism' as far as I'm concerned no matter which way you turn it - those who want to be served can get served, those who want to serve themselves can do so. You do need to make a conscious decision on what side of the divide - pay and be served or do the work to serve yourself - you want to be on since the space in between can be treacherous to navigate. You also do need to react if a supplier does not keep to its end of the bargain if the system is to work. For the likes of Google/Microsoft/Facemetabook/Apple/etc. this means you should avoid them if possible in any way and if not, make sure you have a way out if they start acting up.
• cyral 4y ago
  I had this happen with a cheapo android phone ages years ago, where the battery drained beyond 0% and the charging circuity wouldn't recognize it. Sent it for repairs and it conveniently came back with a dead battery again due to the long shipping time. I ended up stripping the wires out of the charger (the USB end, not 120v), and connecting it directly to the battery for 30 seconds or so. This bypasses the charging circuitry in the phone and got it up to a few % so that it would turn on. Surely this can go very wrong but it was my last idea.
  • dmitrygr 4y ago
    in the future, at least put a high value resistor in series. Chargers are usually 5v, lithium batteries get VERY unhappy with anything past 4.2 (4.3 with newer ones) and can blow up. with no current limiting, the "blow up" stage could arrive quite fast. Also phone's various regulators that power FROM the battery might not be rated to handle 5V inputs
    • jacquesm 4y ago
      That's generally good advice but then it would have taken much longer to get to the point where the phone's charging circuitry could take over and the battery being near empty likely served to peg the voltage at something really low. Finally, those chargers are usually not capable of more than a few amps and given the internal resistance of the batteries at that point the bigger risk would be to fry the charger if it can't handle something suspiciously close to a short circuit. If you're going to use a resistor use something like 100 Ohm, that way you will still be able to see some effect of your action before Christmas and if you have access to a volt meter connect it parallel to the battery to see what's going on. As for the 4.2V, that's a single cell, some phones/tablets will have a couple of those in series so you can't assume that you'll find anything up to 4.2V at the battery terminals, checking that should be your first stop before attempting any of this.
• breck 4y ago
  • wereallterrrist 4y ago
    I never flag content but this was an easy one. Ignoring the utter stupidity of not being able to sanely transfer money in the US, there are countless better ways of sending someone money in a scenario like this. In fact, it's hard to think of a worse way than using crypto, and I'm far from a crypto hater. Linking to a long form YT video with some gd floating talking head screencasting a Mac, with no text description really just seals the deal. I don't think money is going to fix the problem at hand, but I suppose I'll extend a similar offer - I'd Western Union cash to you Doreen, if it would help, or help you purchase a good meal so you can regroup/recharge.
    • breck 4y ago
      > Linking to a long form YT video with some gd floating talking head screencasting a Mac, with no text description really just seals the deal. Fair enough! > I'd Western Union cash to you Doreen, if it would help, or help you purchase a good meal so you can regroup/recharge. Very generous of you and you're right, probably more user friendly to the OP. But I can't remember I haven't used WU in a long time.
• zavertnik 4y ago
  If you're in LA and need a computer to use or an environment with wifi and power and what not to trouble shoot this, you're welcome to use my apartment. I have a spare ATT phone if you need something to act as a intermediate device (if your son wants their phone back :p). If I worked in tech I'd offer you access to a solution but this is all I've got. I hope this problem doesn't last long for you.
  • alpentmil 4y ago
    > If I worked in tech I'd offer you access to a solution but this is all I've got. I hope this problem doesn't last long for you. Sadly, even many google employees's spouses lost account with no recourse. Lets say you are employed in US embassy in Kabul - you just think you could issue visas out of your sympathy. (i.e) FAANG has become as large as govt.
• umvi 4y ago
  This is why you enable multiple backup ways of getting in. I have a yubikey as my main 2FA. If I lose it or it breaks I can still get in with: - my spare yubikey - my phone - backup codes
• fsociety 4y ago
  Feels. I had to get VISA to block charges from Google because I moved and changed phone numbers without remembering to change one of my emails on a custom domain.
• modeless 4y ago
  A lot of people treat printable recovery codes as something that should be protected, locked in a safe, etc. As a result they don't bother to use them as it seems like too much effort to secure them. Please do not treat them this way. They do not grant access to your account. Print many copies of your recovery codes and spread them around. Wallet, home, car, parents' house, etc. It doesn't matter if they get stolen or whatever, again they don't grant access to your account, and they can be revoked at any time. I know that educating people about this is not a scalable solution to the problem of people getting locked out of their accounts. But maybe it could help you, reader of this comment, if you someday need recovery codes.
  • fregante 4y ago
    > Please do not treat them this way. They do not grant access to your account. Can you expand on that? Once I have such code, what’s stopping me from “stealing” the account?
    • modeless 4y ago
      You need the password too. That's what makes it two factor.
      • Eleison23 4y ago
        They are, however, secret codes, and should be regarded as confidential. Just because you can divulge them without direct harm does not mean you should publish them on billboards and Facebook for safekeeping.
        • modeless 4y ago
          This is true but isn't relevant to my advice. If you can't see the difference between keeping a nondescript piece of paper at the bottom of a drawer at your parents' house and posting it on Facebook then you should not be making any decisions relevant to security. And using the word "secret" causes people to treat the codes as more precious than they really are, and make bad decisions like not printing them at all.
• ericpauley 4y ago
  Have you tried unenrolling from RCS? https://messages.google.com/disable-chat https://messages.google.com/disable-chat
• powerapple 4y ago
  Feel sorry for you. I have been locked out of my gmail account for a few weeks. I can receive verification code with my registered mobile, but it is not enough for Google to confirm my identity. It happened twice when I switched to a new phone, I have planned to move away from Google but I didn't. It is painful. Everyday I would realize there is a service I cannot access because I don't have access to my gmail account any more. I am moving to iCloud, the setup is better than gmail in my opinion. I am not sure if I can get my digital game library back, and many other accounts. I will try to recover my gmail account once a week, and hopefully something can happen. But as far as what I read from internet, people have been locked out their email account for years, and no one cares.
• im3w1l 4y ago
  I'd argue that the most logical long term solution is that Google figures something out with the government. E.g. go to the DMV to recover your account. The government is the fundamental root of trust and authority on who is who, so it just makes sense that your "official" online life should tie in with that like say your google account and online banking (for more casual stuff like say a reddit account, the drawbacks outweigh the benefits).
  • dikei 4y ago
    I know some people that will absolutely reject the idea of linking their online presence with their physical being. Hell, some Americans even refused to get an ID for voting purpose, and now you expect them to link their ID with a Google account.
    • im3w1l 4y ago
      I'm not saying that it should be mandatory just that it would be very beneficial for 95% of people.
  • wereallterrrist 4y ago
    I swear to God I'm taking crazy pills in this thread. The second that the government can arbitrate access to my Google account is the day I nuke my Google account from freaking orbit. I've been using a yubikey on my Google account for 5+ years and this thread makes me want to scream.
• lettergram 4y ago
  Depending on the phone, try a different mechanism to charge it. I used a charging pad when a family members iPhone wouldn’t charge (ie charging mechanism broke; not the battery).
• narrator 4y ago
  I'd try and get your old phone that doesn't charge fixed at a phone repair place. Tell them you are poor and your circumstances.
• deleted 4y ago
  [deleted]
• Proven 4y ago
• millzlane 4y ago
  You have to click forget password. Then keep pressing "Try another way" until you see "Choose how you want to sign in:" Then select "Get a verification code" It should text the code to telephone number linked on the new cell phone. After signing in on the new phone with the new password, you will have to do the same thing. Press try another way until you see send a verification code to your phone number. Then it will text a code to the new phone. You're also welcome to call me and I will try to help you over the phone.
  • sfmike 4y ago
    the try another way sometimes just goes to sorry we can't help you right away and is a dead end. even with correct password and 2fa.
    • newscracker 4y ago
      This loop and a lockout was a nightmare for me. No suspicious IP address or browser changes, but Google would still not let me in. Worse, it asked me to verify with a phone number and after I verified, it still wouldn’t even send any codes to the phone and stopped me from recovering or logging in to the account. The people who created this useless and draconian account “protection” system seem to have no clue about the real world.
      • 8n4vidtmkvmk 4y ago
        not disagreeing with anything but do you have printed backup codes? might be a good idea to print some now. I've only done it twice while traveling years ago, but they worked well then
• smeagull 4y ago
  Between this and Voter ID, we're all screwed.
• imtyler 4y ago
  Is there any service that presents an elegant solution to managing actual identities on the Internet? If not, it seems like a real problem that needs solving. I understand people value the ability to express themselves anonymously, but I've also been locked out of legitimate accounts-- If everyone is anonymous nobody can be verified. If everyone's identity is tied to their handle there's no anonymous expression. If somebody could provide a way to both have and eat the proverbial cake, that seems like real winning proposition in my eyes, something worth paying for...
  • fregante 4y ago
    Italy has SPID. It’s a federated login system based on your fiscal code (every Italian has one). You can use it to log into any government service and potentially banks and such. If you do lose access to your 2FA (required, it’s your phone), you can: - re-verify yourself with the provider, with a real ID - get a new ID with another provider, which still points to the same fiscal code As a global solution, it would be great to have a “real identity provider” that offers this but also allows me to log into services without giving them too much information. Apple ID seems relatively good for this given that it lets me hide the address and change my name during registration.
  • derekp7 4y ago
    There is the Notary Public service for physical documents. I did a quick search a while ago out of curiosity, and there appears to be an eNotary service that uses X509 certs to notarize a digital document. I've never seen this used "in the wild", but if it is rooted in the traditional Notarization services, and is based on open standards, why wouldn't tech companies utilize this as a last resort identity service? Something else I thought about is if someone could come up with a CA service that specializes in personal / client side certs. They could then indicate what fields they have verified (name, address, etc). Also an option to indicate if they have that information on file but not disclosed. And if someone wants a truly anonymous cert, have variable pricing for those. The cert would tell how much someone paid for it. That way services such as message boards could allow anonymous users but set a nominal threshold for certificate cost that they would accept -- high enough that it would limit duplicate spam accounts, but low enough that it would not be much of a burden for a typical user.
• NaturalPhallacy 4y ago
  If this was a malicious actor trying to break into Doreen Michele Traylor's phone, it would be a 10/10 effort.
• EVa5I7bHFq9mnYK 4y ago
  I recently lost my Android phone, and in order to use Find my Phone service, I needed to login into my google account. But I couldn't log in from my notebook, because it required me to approve the login using ... my lost phone! Is this what Google programmers are paid $250k salaries for?
  • newscracker 4y ago
    Sounds exactly like a deep bureaucracy at work! How do they even sit and design such systems and who signs off on such designs? It’s as if the company that prides itself for tech has mostly incompetent people with no real world experience or real world information gathering skills.
    • jsnell 4y ago
      The explanation is that the story has been made up. You don't need to pass a second factor for "Find my Device". You can confirm that by visiting https://www.google.com/android/find https://www.google.com/android/find in an incognito window.
      • EVa5I7bHFq9mnYK 4y ago
        Sir, you have accused me of lying. Here's the screenshot proving my point https://ibb.co/k0N33hf https://ibb.co/k0N33hf. Now kindly apologize.
• jsnell 4y ago
  > Google says it will send me a link in 72 hours. Right, so why don't you believe that? A lot of people have lost their only second factor in the past. That's what the recovery flow is there for. Why not at least wait that amount of time first before escalating to using HN as a support forum? > Google is convinced I'm trying to break into my own accounts That's like saying that the front door is convinced you're trying to break into your house, if you try the wrong key. First, it's not useful to anthropomorphize companies and systems like that. Second, "convinced" implies certainty. Of course there is no certainty that these attempts are coming from an attacker. They're even unlikely to. But for 2FA to be a useful security product, it needs to be predictable. It cannot be that there's a button that says "I've lost my phone and need access to this account right now", even if such a button would be very useful to legit users, because obviously attackers could click on that as well. And that's why the 72 hour wait. If it's an attacker, the legit user will be notified and can reject the recovery attempt. If it's the legit user who really doesn't have access to the account any more, then the passage of time acts as additional proof of this.
  • bakugo 4y ago
    > That's like saying that the front door is convinced you're trying to break into your house, if you try the wrong key. How is that in any way comparable, your house is not a digital "thing" that exists on some megacorporation's servers and is completely inaccessible to anyone by any means except via being allowed in by the corporation in question.
  • jve 4y ago
    > Google says it will send me a link in 72 hours. Wanted to say exactly that - just wait for that amount of time. Had to help recover from successful phishing attack and deal with 24h recovery process and they DID send the link.
• TheBrokenRail 4y ago
  This is the issue with companies forcing 2FA on people. I don't see why it's so controversial that people should be able to make their own security decisions on their own accounts. Yes, I know 2FA is more secure, but sometimes, I just don't care that much.
  • soheil 4y ago
    This is a cancer that is spreading through tech. I believe SOC2 compliance requires 2FA and the people who set those standards are probably closer to politicians than to software engineers. We don't need stupid banners asking if it's ok to give the site our cookies and we don't need mind numbingly stupid security measures to protect us from ourselves. The paternalism is getting more real on the web everyday.
  • doodlebugging 4y ago
    I agree. For my own Google accounts they have been trying for months to get me to give a phone number. Neither account is under my real name though so there is no way that I will be giving them a phone number. I get around their phone number prompts by hitting the back button and trying the login again. Sometimes I get an option to add it later so I click that. So far, I have had no problems accessing my google accounts with nothing more than a fake.name_@_gmail.com identity. The names really are pretty close to that. LOL I always login in a new window with no other tabs open and delete cookies as I close the window (Firefox). It's like a brand new world every time.
• leros 4y ago
  For anyone else worried about this, print off your backup codes and put them in multiple places. A friend's house, a fire safe, a safety deposit box, etc. I nearly had the same issue. My phone died and I couldn't get my new phone on Google Fi without receiving a text message but I couldn't get text messages until I was on Google Fi. My backup codes saved me.
• ta988 4y ago
  I wish google would have a store you could bring an ID to get your official account unlocked (I have no idea if Apple offers that). A lot of people are getting locked out of their lifes. So many administrations you can only connect to if you have an email or a phone number associated. There is really a need for users to recover by another mean. And sure things are written when you setup your account and the cynicals here will say "caveat emptor", but when you don't know how those things work the amount of information is overwhelming. And often you end up having someone else do the setup for you. Or whatever other reason people designing those systems don't think about.
• CyberRabbi 4y ago
  Things must be pretty bad if HN is your support system
• djha-skin 4y ago
  I wanted to point out a very serious problem related to this post: Google will no longer simply accept totp as a verification but insists on sending you a notification to one of your devices. Now I can't just use KeepassXC to get into Google anymore, I have to use my phone. The problem that the OP points out provides very real and poignant evidence that this is not only annoying but dangerous. What is it that companies have against totp? It's starting to get obnoxious. I want to use it everywhere but some companies have stopped honoring it.
  • opan 4y ago
    Unless something changed, you can enable SMS MFA, add TOTP as a secondary MFA option, then remove SMS to only have TOTP. I did this a couple years ago after someone explained it to me. It is stupid, tedious, and still requires giving up your phone number to Google, but it may help you as it did me. I also use KeePassXC and have had phone issues in the past, so I hate relying on my phone for anything important (it's also just not as convenient as copy/pasting from KeePassXC).
    • djha-skin 4y ago
      That's just my point: it has changed.
      • wereallterrrist 4y ago
        This came up two months ago and I posted screenshots of a new 2FA setup and it very clearly allowed registering a TOTP or Yubikey without SMS. You just had to actually spend 10 seconds looking at the page and seeing there was a link for it.
  • encryptluks2 4y ago
    I get an annoying message to use my phone, but then there is an option to authenticate using TOTP instead. Do you not see the same thing?
  • shepherdjerred 4y ago
• ck2 4y ago
  adding: they call it "backup codes" built into android phones even with 2FA turned off https://support.google.com/accounts/answer/1187538 https://support.google.com/accounts/answer/1187538 My old android phone had some kind of hidden code generation tool for Google that worked even when it was offline without a working sim. Never seen that before or can figure how it works. Must have been some pre-shared encryption before it went offline. I think it was buried under one of the "try another way" options and they walk you through it with instructions. (I do NOT have 2FA turned on)
• praveen9920 4y ago
  I had a huge scare when I moved to a different country and my sim from my home country stopped receiving SMS for OTP. I got locked out of everything, my financials, emails, work etc. I paid a premium amount for international roaming to get access to incoming SMS and changed the phone number for OTP. That was anxiety full day. Later realised that I need to backup my recovery codes on my system somewhere.
  • gorbypark 4y ago
    I had the same issue and lost access to a few things. Next time I moved overseas I found a provider that offers $99/yr unlimited talk/text (in Canada) but gives free incoming SMSs when roaming. They even support eSIM so I can have it at all times on my iPhone, although I turn it off since it seems to use extra battery being connected to two networks at once.
• pabs3 4y ago
  I can't help with the phone/lockout issue, but I can help (through ArchiveTeam https://archiveteam.org/ https://archiveteam.org/) with saving the content of your sites to archive.org. I started with doreenmichele.blogspot.com (mentioned elsewhere in the thread), if there are any other sites that need saving, you can reply here or join the ArchiveTeam chat and I/we will get them uploaded.
  • DoreenMichele 4y ago
    Thank you but: The published content that you can currently access will still be publicly available if I get locked out. Saving the already published content is not hugely important. Saving access to my ability to keep putting out info via the URLs in question is the thing that concerns me (with regards to my blogs per se -- a much bigger concern is keeping my phone number and email address). Migrating the content elsewhere is a huge pain. I've done it before and it sucks and I have so little traction in terms of traffic and income, I'm not sure it is worth it to me though I think it's important information and would be a shame to just abandon my projects. Maybe this is the universe's way of telling me to stop tilting at windmills and stop believing that someday my work will be recognized as valuable. I don't know where to go from here if it all melts down, but given my inability to get taken seriously or monetize my work, perhaps letting it all die is the better answer. It's gotten me nothing but grief so far. I'm sorry this isn't a more grateful answer. I wish things were not like this and I'm pretty stressed out.
    • pabs3 4y ago
      I see, sorry I can't help more.
• hansvm 4y ago
  My phone is still bricked from the onboarding process at Google years ago, and I had to show up in person to get my W2 after I left. Hopefully somebody here can help, but short of a road trip or fixing the device (can often be <$40 to some kid in your hometown, not necessarily a deal breaker), I'd personally start executing Plan B.
• pempem 4y ago
  This has been a long and varied set of threads. All interesting. Has anyone actually reached out to google yet to help Doreen? If you have, can you just let us know that you have?
• i67vw3 4y ago
  I had two gmail accounts. I created a new account with a pretty popular privacy respecting mail provider. I wanted the first gmail address as a backup (if the privacy respecting one does not work on some sites) while completely deleting the second gmail account. I wanted some emails from both of these accounts to the new mail provider. So I exported from the first gmail account and then mass deleted all other unimportant mail from the first gmail account. Then, I did opposite for the second gmail account. I first mass deleted from the second gmail account but then got locked out from my own gmail due to 'suspicious activity'. So now, I can neither import some mails from my second gmail account and neither can delete the entire account, the way I wanted to do it. Luckily, the second gmail account was the useless one. I tried to unlock it to get my mails, but as usual there is no one to contact at google.
• dusted 4y ago
  Big tech.. You just need to know someone there to get your stuff fixed.. Only really a problem for the other 99.999999% of the people on the planet :)
• TurkishPoptart 4y ago
  Hi Doreen, I hear that. I really loved my last Google Pixel 3, preceded by the Pixel. For some reason it just refused to start up. I couldn't even format it when connected to the PC, it simply died suddenly, without any impact damage. I lost access to Google Authenticator, which I hadn't backed up but actually found the physical paper auth codes I had printed out in case this situation arose, but they didn't work either(!), so I was logged out of Google services for some time, and also lost my 2fa for some accounts to access my paltry spread of crypto junk accounts. I'm sorry and hope you can get decent Google customer service soon.
• temptemptemp111 4y ago
• turnerc 4y ago
  > Google is convinced I'm trying to break into my own accounts Yep, the more you attempt the harder it will get, please wait for the 72 hour account hold and if that fails it's best to wait a full week without any sign in attempt or recovery attempts.
• tomduncalf 4y ago
  A recent experience with Instagram has made me wonder whether 2FA is worth the hassle. My phone broke and I hadn’t backed up my 2FA app since joining Instagram (I since switched to 1Password for 2FA) so I couldn’t log in. No problem, I have backup codes in a screenshot - but they don’t work! I managed to get in touch with their support and had a bunch of back and forth to prove my ID but am now stuck getting “sorry we only have time to review the most urgent requests” auto responses. I don’t care about my Instagram account but I will probably complain to the ICO here in the UK out of principle as they’re preventing me from accessing my data which is required under GDPR. However, it does make me think what a nightmare it would be if this happened to my Google account. Seems like once you have an issue, you’re stuck as these companies just don’t have human support. What’s people’s thinking on the best way to deal with this risk? I totally understand why 2FA is required but this experience showed me that stuff can go wrong - in this case my backup codes stopped working.
• sirwitti 4y ago
  Here some things that might help you: 1. Most probably you will need help of someone who knows a little about technology. Maybe you can ask someone you know or pay them by helping (time for time). 2. Since you said in a comment that you have poor eyesight, let someone with a magnifying glass check if the usb port on your old phone is simply clogged up. This is quite likely to be part of the issue. 3. Try different usb cables and charging ports, ideally one that you can verify that works by testing on another device (for example the new phone). These things break all the time. 4. Try carefully wiggling the usb jack while the charger is connected and it should be charging if nothing was broken. The goal here is to find a position where the phone gets charged at least for a bit. Also note: If the phone is off it might take several seconds before the phone indicates that it is actually charging. This is fidgety but could resolve your problem quickly and easily. 5. If the phone has wireless charging you can go to star bucks or restaurants, some provide wireless chargers. You might get some charging done and resolve this. 6. [Technical person needed] You can order a battery replacement (also search on craigslist). If your phone is not too new/fancy this should be very cheap. Then the technical person can swap the batteries and try charging the old phone again. If the old phone then works you can sell it and get a little money back :) 7. [Technical person needed] Depending on your exact phone (the old one) you could search craigslist for a broken one where the screen is damaged but the phone otherwise works (these should be very cheap). You can then charge this phone and and let the technical person swap the battery, same as above. 8. Repair shops: Since your problem (the part that the phone is not charging) is quite common, repair shops might have even more possible solutions. I don't know about the US but in europe many of those are very affordable, especially small ones. 9. Can you tell us the manufacturer and model of your old/broken phone? It's not unlikely that someone on HN has the some model or a battery replacement lying around and you can pick it up or pay for shipping or they might even pay for shipping it to you. Come one HN, this is a solvable problem!
• lazyeye 4y ago
  Google has no interest in you or your problems. I recommend watching the "Talks at Google" channel on youtube to see the kinds of things that interest the people at Google.
• vimarsh6739 4y ago
  I really don't have anything to say to the OP, but I wonder(in a similar situation) if with the recent push towards e-sim, will SMS based 2FA become more problematic? If a phone with an e-sim dies, and you need some kind of OTP, I wonder how you'll receive it. You can't exactly 'transplant' the SIM into another phone.
  • sureglymop 4y ago
    SMS 2FA is just a terrible idea. I advise anyone to use something like TOTP but also to store the TOTP seed as well as recovery codes in e.g. a KeePass database. You may use a different database than the one with the rest of your passwords. Sync these databases with something like Syncthing, which is completely controlled by you, can do untrusted encrypted nodes and can not only sync but also take occasional backups for you. Also don't forget to put the master password of your KeePass databases into someone elses database. Someone you trust in person, e.g. a family member. It may be a quite complicated setup, but once its set up, it works and not much effort to maintain it is required. If you get a new device simply add a new syncthing node.
• RalfWausE 4y ago
  This is a bad situation an i really cannot help the OP, but wanted to ask a question to the wider audience: So... perhaps i live in my german "island of the blissfull" but why rely on google in the first place? There are tons of other options around for email (many of them free or dirt cheap [sdf.org as an example]). So... why giving big-tech the opportunity to ruin ones life in the first place?
• rcdwealth 4y ago
• wereallterrrist 4y ago
  1. why don't you have any recovery codes? This topic comes up bi-monthly... (To everyone else reading this, no, you're not immune, go save the backup codes) 2. If it says it's sending a code to a device, that's not SMS, that's Google's own side-channel for trusted, authed devices. In theory, you should have backup codes and/or the ability to text a number you've confirmed. Maybe you're not seeing the link for "Try Another Way/Method" ? > If anyone has contacts at google and can tell them, yea, verily, Doreen Michele Traylor is a real person who is real poor and we all know her and please let her keep her phone number and her (my full name) google account and get me out of this fucking nightmare, that would be coolios. Man, I just don't know what to say here. I really don't want to be mean, but I _really_ don't want someone compromising my HN account and then going "oh yeah, plz remove 2FA from [my Google] account, it's really me for sure". :/ :/
• jcpham2 4y ago
  Let’s talk about the control these big tech companies have over our lives, because last week I was locked out of Amazon and closed my account with them. I understand my issue is entirely different from Op’s from the wealth perspective but the fact remains a third party holds all the keys to the kingdom. I woke up last week to a flurry of Amazon chargeback alerts. Somehow, Amazon (Chase Bank) issued me a new credit card because my old card was expiring and they continued to allow me to buy my entire family’s Christmas on an expired credit card - or this is what appears to have happened. Instead of contacting me or charging the new, correct card Amazon decided to lock my account. That makes ever Amazon device stop working. You can’t access AWS, you can’t login to update your credit card. We have a home full of Amazon bricks suddenly, the kids alarms clocks no longer even function as clocks. The customer service was so poor I am no longer a customer of Amazon. I held firm and let them know if they didn’t unlock my account they could sort it out themselves with the credit card company. Make no mistake these companies are holding us hostage the more we depend on them.
• bubblethink 4y ago
  >the codes are still going to the old physical phone This is something that your cell phone carrier needs to sort out. This should ideally not happen, but if your number is operational on the new phone, but you don't get texts, the carrier will help you. This is the only problem you have, right ? Edit: The above refers to SMS. If by codes, you mean google's notifications in their app, that's a different thing. However, google will offer some alternate recovery mechanism - either SMS or a backup email.
• VoodooJuJu 4y ago
  >I'm dirt poor. Everyone here should know that. Do I know you?
• dredmorbius 4y ago
  If you can get to a public library, these often (though of course not always) can and will go to heroic lengths to help people with device and service issues. They may also be able to help with charging problems. Repair shops should also have some capacity to help as others have noted. I'd also open a consumer-rights issue with your state's consumer-affairs agency, usually the state attorney general or equivalent office. For Washington State: <https://www.atg.wa.gov/consumer-protection https://www.atg.wa.gov/consumer-protection> (This tends to be oriented toward utilities and comms providers though it addresses general concerns as well.) Washington State's AG specifically notes: The division’s Consumer Resource Center provides an informal complaint resolution service. The informal complaint resolution process includes notifying businesses of written complaints and facilitating communication between the consumer and the business to assist in resolving the complaint. Otherwise, this is a major and escalating problem. The present privately-operated, corporate, for-profit systems we have come to rely on address the problem quite poorly. It's bad enough for techbros and the generally affluent. It's literally life-or-death for the poor, indigent, and handicapped. I'd like to see organisations such as the EFF, mental health and social welfare organisations, the AARP, and others, put this issue on their priority lists. Ultimately we're going to need some sort of legislation to address the question. Good luck, Doreen.
• xpil 4y ago
  I have both YubiKey and SMS 2FA active on my Google account. However, for SMS purposes I got an extra phone number that nobody knows (well, nobody but me, Google and my phone provider) and that is inactive except when (A) I need to use it for 2FA purposes or (B) I need to top it up to keep it in service (which is every 6 months, approximately). Is there still a risk of someone cloning my simcard even though I did not, ever, share my phone number with anyone?
  • Double_a_92 4y ago
    Be careful that the provider doesn't disable that number after 1-2 years without any activity.
    • ridgered4 4y ago
      Do they really disable paid-up numbers if nothing connects to them for a year?
      • tim333 4y ago
        With pay as you go they do. Usually six months. Paying more in resets the timer.
        • ridgered4 4y ago
          Oh, sure. I expect that. I was perhaps misinterpreting it to mean if nothing connects for a year the number is released even if it is paid up for 2 years which sounds wrong to me.
• stevenhubertron 4y ago
  Google won't help. Step 1. Try a different charger and cable. Step 2 clean out lint. Step 3 use some rubbing alcohol a tiny bit on a q-tip to clean the contacts. Unless the phone is damaged these should get it powered up.
• amznthrowaway5 4y ago
• deleted 4y ago
  [deleted]
• W4nn4B_h4x0r 4y ago
  Not sure if this is allowed, but @OP I have an extra phone (oneplus 7 pro) that I'd be happy to give you if you need. It has a cracked screen but works well otherwise. If you're in the US I can probably ship it to you?
• ForOldHack 4y ago
  All based upon your email password, and having a recovery account on another service. One email address to rule them all, and one email address per device.
• adultSwim 4y ago
  I'm sorry that is happening.
• karamvir 4y ago
  Was this resolved?
  • DoreenMichele 4y ago
    No, it's not resolved yet. I will update when there is actual news. There isn't any yet.
• simne 4y ago
  You remembered me good old book, written by Sam Walton, founder of Walmart (Made in America). He said very simple thing, which made earthquake of my mind - he started BIG business in small town on periphery, because in large city, all life is constant pursue against time, but in small city, near only weak concurrents. So, for responsible initiative person, small town is great opportunity. Sure, exists exceptions, for example I'm in Ukraine, here war, economy fall more than 50%, I cannot find work in country, near all employers except very few, asked me, if it is possible for me, to move to safe country (or they will not give me job), and government prohibited all males to leave country. And You might already understand, I'm now thinking, to write book, or to make computer(or mobile) game, which will teach people, how to survive, because infinite time is only thing, which have every unemployed. Don't give up! Our good times just postponed, but will return.
• DoreenMichele 4y ago
  For no apparent reason, my phone just mysteriously was no longer stuck this evening and no longer unable to complete setup. I'm guessing someone contacted someone at Google but I don't actually know that. I did buy a wireless charger to try to resolve the issue with the dead phone. After I bought it, we thought to look up the make and model of both phones. Neither of them can be charged that way. So lesson learned: Look up such info first. If you need to help someone, keep that in mind and actually tell them (and make sure they got the memo -- if someone said this here, I didn't notice), especially if money is tight, they live without a car and/or are handicapped such that small errands and small expenses can be a painful burden. I'm still nervous that this may not actually be resolved. One detail is not working and I suspect I know why and I think it will likely be resolved tomorrow (crosses fingers), but I said I would update when I had news, so that's what I'm doing. (Posted from my phone.)