15 ms·

Ask HN: Help – Locked out of 10 years Gmail account

329 points by schiffern 4y ago

Due to the recent LastPass debacle, I decided to cycle my Gmail passwords. Boy that was a mistake!! Gmail has decided that I can't log in with "just" my password. The new password is correct. It then asks me for my old password, which I put in correctly. Then it tells me I can't log in anyway. :( Occasionally it will give me a QR code to scan. But I can't scan it on my phone, since my phone is logged out. I can't log in to my recovery account, because (like a fool) I changed the passwords simultaneously. Now both are locked. Somebody help! My account name is [redacted]@gmail.com (the recovery email should match my HN username). I'm locked out of a decade+ of correspondence, recovery, and historical data.

meindnoch 4y ago
I’ll forward this to my friends at Google if you promise that you stop using Google products.
- schiffern 4y ago
  Anything! Please let them know my recovery account (another gmail, FirstnameLastname) is also locked. Edit: I'm back in to my recovery account!! Just enabled 2FA to avoid getting locked out again. My main account is still locked, but it let me verify via my old password, new password, and recovery email code. The message says that they still need to verify more, but I should look for an email to login within 48 hours. Fingers crossed!
  - schiffern 4y ago
    Thanks for everyone's help. Backup email works now. Looks like (fingers still crossed) I'll be getting back into my main account in 48 hours. Obviously I'm re-working my email solution as we speak... starting with backing up my Google data! Lots of good recommendations in this thread. Learn from my mistakes. It can happen to you!!
    - joenot443 4y ago
      I was about to take out my work (G) laptop and send this down the appropriate channels. Very glad to see someone else stepped in already. This is definitely I (personally) wish we could do better, I feel embarrassed and very slightly partially responsible whenever I see our support failures making the front page of HN.
      - johnsea 4y ago
        Thank you!
      - romanhn 4y ago
        Hi there! I hate to pile on, but I have a very similar issue and was wondering if you'd be willing to help. About a year and a half I lost access to a Gmail account with emails going back all the way to the beginning. Lots of sentimental messages, stuff like that. Logged into it after a long while, started looking at picture attachments out of nostalgia and somehow tripped an algorithm that locked me out. I stupidly did not have 2FA set up as this was not my primary account, so had no other way to offer proof that I was the rightful owner, despite having the correct password. I tried all the usual things - waiting a long time, trying old devices (phone, laptop), going back to the old location I used to live... nothing worked. Would love to regain access to years of memories.
    - Jabbles 4y ago
      What did you do? What worked?
      - deleted 4y ago
        [deleted]
- lucidguppy 4y ago
  What email service do you use?
Jabbles 4y ago
Did you follow the steps at https://support.google.com/accounts/troubleshooter/2402620 https://support.google.com/accounts/troubleshooter/2402620 ?
- bmitc 4y ago
  Interesting how all those frame it as the user’s fault.
- schiffern 4y ago
  Trying this now. Edit: the closest solution is to try account recovery, which is what I was doing. :( I don't want to "spam" the recovery form, since I suspect that will only make it worse. Edit2: trying Gmail app and Google Authenticator now, to see if that makes a difference. Will update with progress. Edit3: no dice. Gmail app just loops me to a message saying "Google couldn't verify that this account belongs to you." Clicking on Verify account just loops me back to the login. It doesn't even ask for my old password like before. I feel sick to my stomach...
  - BaudouinVH 4y ago
    - I had similar trouble accessing my facebook account - the FB recovery process involved me holding some valid ID in front of my webcam. Could Google have something similar ? (Access was restored swiftly) - Have you, by any chance, stored some google recovery codes somewhere ? - Isn't there a "call me and read me a one-time six-figure code" option available in all the login/authenticate option Google provides ? hope it helps
  - vertis 4y ago
    Be calm. You may be locked out, but sometimes it just takes time to get back in.
  - jeffbee 4y ago
    Are you or can you try to make sure that your behavior is s close to normal as possible? If you normally access your account from Chrome, use Chrome. If you normally use macOS use it. If you normally have a static address at home, use it. Trying to recover your account from your friend’s house in another country, or whatever, could be making it worse.
lrei 4y ago
Yikes! good luck, hope it works out. This is scary. Gmail is still, by far, the best email app. Something like this could happen to me and, I suspect, a lot of other people.
- 9991 4y ago
  The best email app wouldn't ban you for an emoticon in Youtube chat or sending a medical photo to your doctor.
  - lrei 4y ago
    These ToS, CSAM, moderation, etc are very orthogonal to the app itself. Why conflate them? Most non-hackernews people are completely unaware of them, so it won't be a factor in their choice of platform. Are we even sure other apps aren't doing similar things? Or have equally dangerous practices around password changes?
    - 9991 4y ago
      Because the user experience is that it doesn't work.
  - cromka 4y ago
    This is just crass. There's plenty of very good software with shitty T&C, this isn't anything new.
    - 9991 4y ago
      I dare you to find those examples in the Terms and Conditions.
- nix23 4y ago
  >Gmail is still, by far, the best email app True, no mails no problems, it's a feature not a bug.
- sshine 4y ago
  > Gmail is still, by far, the best email app. I used to think so when I used Gmail. But switching to Fastmail, I no longer agree that it is "by far" the best. Now I think Gmail is only better by a slight margin, and this margin is so small that it does not justify the drawbacks: Potentially getting locked out with no recourse, certainly getting everything you receive scanned to deliver you the best possible ads, contribute to the email monopoly where the big players decide the protocols.
nikanj 4y ago
I love how the HN front page is the only way to reach a human at Google. No amount of money can get you a support ticket opened with an actual person in a situation like this
- trollied 4y ago
  Google One might have helped. https://one.google.com/about/support https://one.google.com/about/support
  - theCrowing 4y ago
    It doesn't anymore the trick with buying from the store also doesn't work anymore you get in the same q as everyone else after the hardware and one teams told you they can't help.
  - pentium10 4y ago
    Google One support only works if you can login.
yucky 4y ago
I've been locked out of 17 year old gmail account for awhile now because I refuse to sync my phone to it. I only want to login to delete the contents and deactivate the account. It still forwards to my Thunderbird which is how I noticed Google stops dedicating spam protection to un-synced accounts (or something). So, they want me to go away, and I want to go away, but they won't let me go away.
- danuker 4y ago
  > to delete the contents and deactivate the account Are you in the EU? Google's DPO or your country's data protection authority might want to hear about it.
  - jesprenj 4y ago
    Maybe he doesn't want to send them a copy of his national ID for the sake of privacy. Are privacy guidelines in EU countries so well defined that they take terms such as "password for an online service" into their vocabulary?
    - ashwoods 4y ago
      They might not explicitly, but you have the right to take any data you have or they might have on you of any service, no matter if you have an account or not: aka right of access. I don’t know if it has been used this way, but it might be a possibility.
  - yucky 4y ago
    Nope, I'm in the US and here in the US Google acts as an extension of our intelligence agencies so we have no recourse. They're effectively part of the surveillance state, thus untouchable.
- jesprenj 4y ago
  In ~2014 when I didn't have a phone yet (being a child) they deleted my account on account of not having a phone number associated for some weeks. Even though postfix brings me headaches sometimes, seeing issues people have with google seems as setting it up was a step in the right direction.
manholio 4y ago
You don't matter for Google and creating HN spam threads won't change that. At worst, it will solve your particular problem and invite similar spam threads from other victims of faceless corporations.
- fsflover 4y ago
  Such topics help more people realize that Google should not be trusted with managing their emails (or anything really). More threads like this: https://news.ycombinator.com/item?id=31782952 https://news.ycombinator.com/item?id=31782952
  - maxpro 4y ago
    This! I wanted to switch from Google few times (always postponed it to a "next time"), but reading this today I realized how devastating it would be to get locked out. So in the next few days I will move away from Gmail.
323 4y ago
My strategy is to only use GMail and no other Google service at all (cloud, ads, ...) This way there is little possibility of somehow being labeled as fraudulent.
- kevin_thibedeau 4y ago
  This. I also deny them data collection by not being logged in on my primary browser since I don't use any other service. I originally started doing that when they began to break Gmail performance in Firefox and had to access via Chrome but now it's out of spite.
Alex3917 4y ago
The longer it's been since anyone has logged in, the more confidence Google will have that it's really you trying to log in. In all likelihood you'll be able to get back in within a couple weeks.
- schiffern 4y ago
  I hope you're right! If that doesn't work, it's all gone. It's not like I can "just" get to the front page again.
- anter 4y ago
  Not necessarily. I've two accounts that I couldn't access for multiple years now, google simply refuses to let me in despite having all of the correct credentials. For anyone reading this, do not rely on google services, you'll move cities, change your number, or as OP change your password and _you will get locked out_ with no recourse.
- sho 4y ago
  This saved me during my big scare about a year ago when I suddenly found myself locked out of an important account with no way to get back in (phone number was old and inaccessible). The password was fine, they just didn't believe it was me for some reason. A few months later it suddenly worked again, and I seized that opportunity to move permanently away from gmail. I was lucky. I do not want my access to my online identity to be governed by luck, however, so really advise anyone who will listen to make the move before this kind of sob story happens to them. "It won't happen to me" - I thought that too, and no doubt so did the OP. Won't it? How much will it cost you if you're wrong? It now costs me $50/yr to know it won't happen to me and I'm more than happy to pay a fair price for a good product, like I do for everything else.
  - morsch 4y ago
    How does paying 50 bucks a year give you that peace of mind? What kind of recovery procedures do providers like fastmail have?
    - 4y ago
user3939382 4y ago
I made the jump to Fastmail and I'm very happy with it. Web interface is at least as good as Gmail's. Thunderbird keeps a local copy of my emails, I control the email domain. I can create backups. The second you get back in you gotta get off this platform.
- Daniel_sk 4y ago
  The Apple Mail app on iOS and MacOS is pretty decent. No need to use the official Fastmail client (if you are on Apple and prefer the simple Apple alternative).
  - dontlaugh 4y ago
    Also, iCloud+ allows the use of a custom domain. It may be an easier option for some.
    - danillonunes 4y ago
      I believe the major problem is having your email attached to a big tech general account. If your son decides to download a pirated game to your iphone, out whatever other unrelated minor offense, and Apple determine it's worth nuking your entire account, your email is gone. Granted, Google is worse at this matters, and when you own the domain at least you can point it to somewhere else, but it's still a hassle.
      - hacym 4y ago
        Does Apple have a history of doing that? This is the first time I’ve heard of that.
        shepherdjerred 4y ago
        No
      - yumraj 4y ago
        Even if that happens, it’s not a problem. Why? You go to your register and point your domain to another email provider, and you’re back in business.
nonrandomstring 4y ago
> because (like a fool) You are no fool. No doubt you are way above average intelligence. This so-called "security" ecosystem of Big-Tech is a dumpster fire of rotting clinical waste. Hope it doesn't spoil your holiday break - and for goodness sake make a New Year Resolution - to quit this madness forever.
- makach 4y ago
  I started working with security to help avoid these kind of scenarios to happen. No doubt gmail is adding controls to their service without fully considering the implications. When security locks you out of your content it is a non-conformity that should be resolved asap zulu.
- stanleydrew 4y ago
  This is an unfortunate situation, but calling it a "dumpster fire of rotting clinical waste" is frankly absurd. Google in particular has done more than anyone to acclimate consumers to the usage-patterns of better auth (two-factor in particular). Is everything perfect? Of course not, but things are a lot better than they could be.
  - tester457 4y ago
    I thought it was actually 2 step. The difference always confused me.
  - joxel 4y ago
    Nah, this is a complete farce. You’d think by this point google could offer a simple checkbox in the settings of your gmail account: “Do you want this account to be extra secure and for us to lock someone out of it with any activity deemed suspicious?” And then when you don’t click that box they don’t arbitrarily lock your account. But they don’t. Because they’re a dumpster fire company.
    - deleted 4y ago
      [deleted]
    - 4y ago
lawgimenez 4y ago
Lesson learned, don't do unnecessary stuffs while everyone is on holiday.
- danuker 4y ago
  Which is precisely when you finally have time to do them.
- onionisafruit 4y ago
  It’s not like Google customer service is going to help on a non-holiday
  - maxpro 4y ago
    Is there a customer service at Google? Had no luck with them... once I got an email after they charged me twice for Play Music, but this was canned response. It took them almost 7 months to figure this out and pay my money back.
    - onionisafruit 4y ago
      That’s the point I was trying to make. As a user, getting help from Google customer service for something like this seems to be nigh impossible. I assume Google has customer service for their actual valued customers — the ones who spend money placing ads, not the ones who spend attention viewing ads.
marvindanig 4y ago
Google's strategy of locking out people from "everything" is just insane! Someone needs to lawyer up and make them pay through the nose for stealing access to individual’s personal data that doesn't even belong to them.
- CrendKing 4y ago
  Even this "someone" wins, if it's not a class action, I doubt any amount of money out of the lawsuit would change anything for a big company like Google. And I doubt case of these could result in class action anyways.
  - deleted 4y ago
    [deleted]
- hoffs 4y ago
  How is it everything? You get locked out of your account.
  - Double_a_92 4y ago
    Which in the case of Google is for quite a lot of services...
sva_ 4y ago
Do you not have any of your recovery codes left?
hsbauauvhabzb 4y ago
I ran into a bug where the recovery account token wasn’t working. I found no way to contact google about it. Until there is regulation, you’re probably going to be out of luck.
- Double_a_92 4y ago
  As the world gets more and more digital, there really needs to be such regulation. Certain accounts are too deeply ingrained in your digital identity, that they should be able to be taken away from you. At least not without a way to start a proper legal recourse, where real person need to solve your case and at least send you your data. EU do something!
krono 4y ago
Whilst it might not be of help to OP, I suggest everyone else to do a data export for all your important services every once in a while and save it with your other backups. https://takeout.google.com https://takeout.google.com https://account.microsoft.com/privacy/download-data https://account.microsoft.com/privacy/download-data
- hu3 4y ago
  Is there something like this for Apple?
  - theCrowing 4y ago
    https://privacy.apple.com/ https://privacy.apple.com/
- hanklazard 4y ago
  For sure. I believe I have this set to create an export and notify me the backup every quarter or so. Not the perfect solution, but until I do the right thing and switch over to fastmail, this at least ensures I can only lose a few months (gulp) worth of email.
  - grepfru_it 4y ago
    Having lost a few months of email when my mail server crashed, it’s something you whine about for a day or two but then it’s business as usual. As with all insurance you pay for what you want to risk. It didn’t hurt me much but I still went to daily offsite backups for my mailserver. The biggest gripe was standing up a new mailserver, make sure you keep your software up to date yall
  - sneak 4y ago
    You can move your old emails off of your current email provider at any time even without changing any email settings or where new mails go. It always seemed silly to me to have the server where your new mails get delivered be the same server as where your email archive lives.
  - 4y ago
trollied 4y ago
[flagged]
jbotdev 4y ago
Hope you get your account back. I’ve been on the fence about migrating off Gmail, but after reading threads like this, I put a contingency plan in place. Backups of my Google account are done hourly, and I have a custom domain/workspace account so I can move the domain elsewhere if needed.
- dpacmittal 4y ago
  How do you do hourly backups?
  - jbotdev 4y ago
    There are a few open source options out there (e.g. run IMAP backup script via cron). I personally use CubeBackup [1] on a local NAS, which covers mail/drive/photos. I then have a job that backs up that directory off-site using rclone. [1] https://www.cubebackup.com/ https://www.cubebackup.com/
BaudouinVH 4y ago
Is there someone else around you trust and that could read the QR code on his/her smartphone ?
corv 4y ago
Welcome to the club, I've given up on Google altogether.
jjcon 4y ago
This happened to me - I even had access to my recovery mail but google just decided I wasn’t trusted back in my account after I moved to a new country. I contacted every support line I could but alas. About 3 years later I was magically let back in, no idea why but I would try every few months and it just worked one day. Hope it doesn’t take that long for you.
survirtual 4y ago
There is nothing google will do for you. I had a similar issue here: https://news.ycombinator.com/item?id=31681221 https://news.ycombinator.com/item?id=31681221 I’m still locked out of my account. December 22nd was the expiration of the domain name I needed in order to unlock it, and it is now gobbled up by another squatting service (Bodi), so I will have to try again next year. They don’t even entertain my offers to buy it. Let our losses be a lesson to people: get off of gmail asap. They do not care about you. They do not care about the harm they are doing, the memories they are sealing away. All they care about is making money off of your data. Get off google now. As fast as you can.
- ryandrake 4y ago
  It's now been 0 days since the last "Help! I've been locked out of my account!" story on HN. These have been going on for years and years[1]. The solution is for individual people to stop relying on services that don't have customer support to host critical things. This is now a well-known failure case for free cloud services. It should not be a surprise. 1: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=%22locked%20out%22%20account&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
vinckr 4y ago
Sorry to hear that, this really sucks. Shows once again how authentication is still not a solved problem. I switched to posteo.net recently and have not looked back since, can only recommend a paid email provider. Different level of support and assurance when you are a paying customer.
ck2 4y ago
If you have it tied to an android phone, even without two-factor, there is a hidden way to generate a code it will take under security Not all accounts seem to have this but I did. I do NOT have two-factor and eventually the "try another way" method offered to take me through the android code generation and it let me back in. > *"Sign in With Backup Codes"* https://support.google.com/accounts/answer/1187538?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/1187538?hl=en&co=...
noisy_boy 4y ago
This prompted me to download Thunderbird - was very easy to get started (it basically provided a wizard with some basic inputs and started fetching messages immediately using POP).
- moffkalast 4y ago
  Thunderbird? Marty, I'll need to fix the time circuits, we've travelled back to 2006! But seriously, what's next? Switching to IE from Chrome? Back to MS Office from Docs? The more things change the more they stay the same...
  - noisy_boy 4y ago
    One of those isn't the same as others... IE and MS Office are MS products, Thunderbird is still under the Mozilla umbrella. I guess for certain things we backup to cloud and for others, we backup from cloud :D
  - BenjiWiebe 4y ago
    What's wrong with Thunderbird? My workplace uses it, my family's small business uses it, I use it. Has lots of features, doesn't require a fast stable Internet connection, and there's no risk of losing your emails because $provider locked you out. Plus if you have multiple email accounts, it's super convenient to get them all in one place.
    - moffkalast 4y ago
      Idk, Thunderbird, Outlook, and desktop email checkers in general seem absolutely antediluvian to me. Like CRT screens, trackball mice, and space cadet pinball. Do you still have to fetch mail manually like a caveman or did they make it automatic yet? Does your mail sync between all your devices? I still think it's less likely to get banned from gmail than my local hdds to fail.
      - spopejoy 4y ago
        > I still think it's less likely to get banned from gmail than my local hdds to fail Uhh the whole discussion is about exactly this problem which you've decided won't happen to you because ... ? Thunderbird rules and isn't going away, and makes things like blocking remote images easy (as opposed to gmail where you lose basic UX if you turn it off so most people don't). What's more, gmail's basic features have really suffered in the last 10+ years. I search 20 years of email in Thunderbird faster and more efficiently than the bloatware POS gmail is now. But best of all, I don't use gmail! I never have to worry about the nightmare scenarios presented here and nobody spies on my email (other than the NSA :) ) Oh -- physical backups rule too. From rotating through various drives my email is backed up at least 16 times over.
ddevault 4y ago
I'm getting pretty tired of these threads. We've seen them for years and years and years. At this point, anyone still using gmail is a PEBKAC error. Move!
Havoc 4y ago
Is it my turn next month to post the google's AI security/support fkd me thread? Anyway, hopefully the google support outsourced to hn channel can help...
evouga 4y ago
Can someone explain how it’s anything but completely insane for an online service to deny access to someone with a *correct* password?? This isn’t someone getting locked out because they forgot their password (where I can at least understand why the user is at fault).
- martincmartin 4y ago
  2FA exists because sometimes ne'er do wells get your password. Phishing, guessing weak passwords, password reuse from sites that are hacked, the list goes on.
  - evouga 4y ago
    Of course I understand enforcing 2FA when the user has signed up for/opted in to 2FA. But that doesn’t seem to be what’s happening here: Google unilaterally decided to enforce 2FA on a 1FA account.
    - cuteboy19 4y ago
      "Old password+new password" is not 2fa
      - awinter-py 4y ago
        yes exactly. if G were following best practices from the consumer banking industry, 2fa would be more like 'old password + random row from your equifax profile'
        cuteboy19 4y ago
        And of course, the last 4 digits of your ssn
        awinter-py 4y ago
        'any digit from your ssn'
jondoe 4y ago
[dead]
kmbfjr 4y ago
Google gave away the Google Voice number I had since the GrandCentral days, a number obviously used daily with purchased credits in the account and religiously confirmed linked number. Zero customer support, no way to get the number returned and no refund on existing credits for toll services. And to add to the pain, they won’t give me a new GV number because it sees my linked number as a spam source and never sends the confirmation code. I am done with this outfit.
- huh88267 4y ago
  What do you mean they gave it away? I don't have a linked number to my GV anymore I just use it for 2fa codes... Is that not safe? Edit: MAKE YOUR NUMBER PERMANENT if you don't want to lose it due to 6 months inactivity. It's 20$. Also ported numbers are never recycled. I am happy with GV and will always use it.
  - kmbfjr 4y ago
    They gave it to another GV user without warning, within 24 hours of its last use. You can not imagine the pain of having to recover the three accounts using that number for 2FA.
- mindslight 4y ago
  Are there any good VOIP alternatives to Google Voice that don't get tripped up as invalid phone numbers by other companies' snake oil authentication? From what I've found, GVoice is uniquely large and has enough "normie" Google Fi customers that companies can't discriminate the way they do against say Voip.ms and Flowroute [0]. My tentative plan is to get (another) cheap paygo SIM, stick it in a cell modem attached to a server, and set it up to forward all texts to email/xmpp/etc. Use that for all these longstanding snake oil auths. Then move my main personal number (used to be a mobile number, now at GVoice) to a VOIP service. At which point if someone can't call/text my personal number because they're using some crappy service (eg Comcast mobile), then too bad, they can figure it out. [0] I figure Twilio is in this same boat, although I don't have much experience with them?
  - 4y ago
0xbadcafebee 4y ago
I'm sorry this happened to you. I feel lucky that I moved to FastMail + a custom domain before this happened to me! :<
idiocrat 4y ago
Please consider waiting for one day, before re-trying with your valid password. Your account will be auto-unlocked after a cool-off period. It helped me in the past.
blacklight 4y ago
This is probably the #500 post on HN that reads "help I've been locked out of my Google account for Kafkaesque/inexplicable reasons and I have nobody to reach out to". If you're still using Google products as your primary drivers, then it's entirely your fault. Do yourself a favour in 2023: drop Google and all the filthy excrement that they produce. There's plenty of much better alternatives, and from a purely market-based perspective Google deserves to rot in hell for all of its sins and shitty products.
- coffeeblack 4y ago
  This, plus if you have no Google Takeout backup.
  - gatonegro 4y ago
    A few days ago I was going through an old Gmail account, and decided to get my data through Takeout. Told me it'd take a few hours, and the next day I had a link ready. Click the link, enter the password, it tells me I need a verification code that it wants to send to an address that stopped existing 15 years ago. As it turns out, Google is not sufficiently convinced that I am in fact the owner of the account, so it refuses to let me download the data. I don't feel inclined to spend time trying to figure out this nonsense, but thankfully none of the information in that account is particularly important. I'll take it as a sign that I should just move away from Google, because next time the information on an account could be actually important, and I'd be screwed.
    - blacklight 4y ago
      Takeout is a feature that Google was kind of forced to implement because of GDPR compliance. But they still try their best to make it so bad that people won't think of using it. First, getting to a point where you can actually schedule the creation of a zip takes a lot of clicking around - just to make sure that people won't bump into it unless they're explicitly searching for it. Second, the process is painfully slow (on purpose). Last time I used it was to download my YouTube subscriptions and playlists to import them into my Piped instance. Even though I only have about 100 subscriptions, and only two playlists with about 20 items each, the process took almost two days to complete. By then I had already made a script that scraped the content from their HTML (and it only took me 5 minutes), and another one that did the same but using the YouTube API. If it takes less than a second to get the playlists and subscriptions of a user, I don't see a single reason why generating a Takeout CSV with the same information should take 2 days. I was determined (and tech-savvy) enough to script my way out of it, but many users just get discouraged and give up the idea of exporting their Google data entirely.
wintermutestwin 4y ago
The fundamental problem here is that there is no way to get support from google that is a human being. I dream of a day when the US government retakes the mantle of consumer protection. Proposed regulation #2 (after eviscerating privacy violation) is that all services must meet certain customer service standards, including having a way to get to a human being. I know I am dreaming hard here, but there once was a time when consumer protection was on the rise...
- jeffbee 4y ago
  > The fundamental problem here is that there is no way to get support from google that is a human being. No way other than paying a trivial $1.67/month for Google One.
  - josephcsible 4y ago
    There have been past stories here about people who were paying for that but found themselves in situations like OP's anyway, and it didn't help them to resolve it.
  - wintermutestwin 4y ago
    Using google, you are already "paying" by giving them your data (which is worth way more than the value of their service)
Doubtme 4y ago
If you don't backup your data in 2022+ it's entirely your fault. After losing my own 10 year old Gmail and running around the internet hunting down employees for 5+ months only to get a canned automatic response. I learned to not trust any service. Ever. I've even been hacked by rouge employees of fortune 500 companies. Only because of my experience I was able to get my account back after being hacked for 5 - 10 minutes. Backup yo shit fam. - IT guy who has been backing up to 3+ different hard drives since 2008.
- Herbstluft 4y ago
  Losing access to your mail account causes significant and critical damage without ever considering the existence of backups. Backups don't help with the painful (and sometimes barely possible) migration of your accounts to a new address, updating contacts, loss of mails that arrived after you were locked out, et cetera
  - Doubtme 4y ago
    Welp that's the product you signed up for. Much like PayPal stealing from millions of Americans for a full decade+ Can't backup money either. That doesn't stop these policies of zero human support and only infinity robot responses from remaining until today. Writing a law and getting it passed to curtail this behavior absolute nonsense. Complaining about the next 1000000 people to lose access without doing 1 single thing about it. Sign me right up!
    - Herbstluft 4y ago
      Oh I agree. Gmail is basically a daily lottery for account lockout. Still important to raise awareness, these posts certainly help and make it harder for google apologists to deny it (a few years ago there was a lot more victim blaming in the comments of these threads). I felt the need to point it out because backups were brought several times here as a defense against OPs scenario which they aren't.
Brajeshwar 4y ago
This is something I'm not certain but worth a try. I have also advised something very similar to someone who lost their parent's gmail ID access. If you already have another Google ID or your partner/spouse/relative, upgrade to one of Google's paid service such as the Google One. Now, talk to a human customer care for Google One and seek help. I was able to talk a real person with an issue with Google One and the person on the other end knows a whole lot of details (which I was not expecting to be a regular information). Yes, that might cost you one month's of Google One but worth a try. Btw, I have never figure out how to talk to a person even when I have 3+ Google Workspace for Business accounts.
GoOnThenDoTell 4y ago
Its not reasonable to have your primary email be gmail anymore
prlambert 4y ago
The anti-Google frothing here has gotten so extreme it's crossed into comedy. Maybe instead of assuming incompetence and malevolence you should consider how hard it is to do this perfectly. You don't have to like them, but the fact is the there are many many smart and competent people working on these systems trying to do the best for all users of Gmail and Google Accounts. Every day there are hundreds of very bad people around the world trying to gain access to Gmail accounts to do very bad things using that access. All the worst parts of humanity have found their way to leverage it. Balancing security and user-friendliness is one of the hardest problems in tech and it's impossible to do perfectly. It seems from this thread that the OP did regain access and it didn't take that long. Edit: I worked at Google for a few years, including on Gmail, and know that the people there really do care about all these things. But I left in the summer, no longer their employee.
- ausbah 4y ago
  if this happened to you I'm sure you wouldn't be thinking "gee they really are just trying their hardest let me cut them some slack". you maybe be right but that doesn't solve anyone's problems like this one
jnky 4y ago
I had a similar problem a while back where Google demanded a second authentication factor for an account that didn't have 2FA set. It asked for a previous password that the account must have had >10 years ago and I think the answer to a security question that I couldn't answer, because I always use cryptic responses to those and apparently didn't save this one way back when. My rationale was that I wouldn't need any of that, because I knew the account password so there would never be a need to go through account recovery. Either way, I found a solution to that on one of those Google user support forums: I had to not try and log in to the account for approximately 40 days. After that, it'd let me log in with just the password again. This is apparently because Google keeps flagging the account of getting attacked and requiring a second authentication factor for some reason and the timer for that keeps getting reset after a failed challenge for one of the account recovery factors. After something between 30 and 40 days, I could log in to the account with just the password again.
- kings12 4y ago
  [flagged]
spicymaki 4y ago
I am sorry to hear about that. The state of customer support is really sad these days. If you figure out how to get back into your account, you should make sure you generate physical recovery codes. That should prevent you from being permanently locked out of you account.
usr1106 4y ago
A long time ago I created a separate Google account for every of their services. I have the passwords of all of them, but as soon as I try to log in they ask me add my phone number "to make my account more secure". There is no way to click it away or say later. So de facto I am locked out. I won't give my phone number to Google and I don't have a dozen of other numbers. Google is like forced prostitution. You must sell your privacy to their advertising business. Edit: Have not tried again for quite while. Maybe they change it some day? Well I have given up all hope and try to avoid them as much as I possibly can.
el_nahual 4y ago
Whenever I think about migrating my "primary" email to be at a domain I own, I come up with the following risk calculus: What's more likely: A) That i get locked out of Gmail for some byzantine reason I can't get out of B) That for whatever reason (new card, I'm in the hospital, whatever) I forget/am unable to renew my domain and it gets sniped.
- mindslight 4y ago
  You can generally have many years prepaid for domain registrations. So if you make it a point to have between 3-4 years preregistered, and put it on your yearly calendar to check/update that, you will be fine. The real issue is that whatever registrar you choose can also arbitrarily lock you out of your account. But one would think being a bit smaller company, having less surveillance tentacles into things like phones, and having a less homogeneous userbase would keep them in line.
Fire-Dragon-DoL 4y ago
I'm confused, how could Google ask for the OLD password? Is this even a thing? I have no idea what my old password is.
- halilim 4y ago
  Yes. Google (and probably many other companies at this point) ask for your previous passwords as part of the account recovery flow. It's an additional factor to help establish that it's you and not a scammer trying to "recover" it. So it's a good practice to save old passwords. Some password managers make it easier by having a password history feature, usually on the account's detail page.
lazyeye 4y ago
Google has no interest in you or your problems. I recommend watching the "Talks at Google" channel on youtube to see the kinds of things that interest the people at Google.
themadturk 4y ago
I only use Google as a secondary account now, though most of my family continues to use it (under a vanity domain, grandfathered in after lo these many years). I still keep my Google 2FA active, though. I use pobox.com to forward my primary domain. Right now I have mail forwarded to their "mailstore," which is essentially a lite version of Fastmail.com (Fastmail owns POBox, or the other way around, don't remember), but I can forward to multiple mailboxes. It costs $50 a year, just like Fastmail, but I think it's a little more flexible, at least for my needs.
- ylee 4y ago
  >I only use Google as a secondary account now I've never had Google as a primary email account. I do have a few Gmail accounts, but that was to reserve them with my name, as opposed to ever giving the addresses out. >I use pobox.com to forward my primary domain Customer since 1996 and primary email address since 1999 because my college address closed at graduation. Since then my email has been hosted at ISPs, at various other providers, and at a Google Apps site, but it doesn't matter because the pobox address never changes. My college address works again, but I've long since used the pobox address in too many places to mass migrate away. Years ago, before it got "corporatized", Pobox's FAQs had one entry that went something like: Q: How do I know you'll be around in the future? A: How do we know you'll be? Ha, didn't think of that, did you?
Wicher 4y ago
Incidentally, another Ask HN today was about running your own mailserver: https://news.ycombinator.com/item?id=34117386 https://news.ycombinator.com/item?id=34117386
villgax 4y ago
I'm guessing you didn't pay for it so there is no hope in this case
powerapple 4y ago
I feel sorry for you. Someone at Google PLEASE, PLEASE, make it enough for a registered phone number to reset the password. I got my phone number with my passport, it is the last thing that don't need any verification. Why is it not necessary? AND stop sending verification email to the email address I am recovering. It is a sick joke.
- spopejoy 4y ago
  Guess you've never been simjacked
  - powerapple 4y ago
    no, and it is not something I worry about to be honest.
IYasha 4y ago
You're not alone in this sh*. I'm here too. And there are dozens of threads here with the same problem. May the Universe help us.
P5fRxh5kUvp2th 4y ago
I have two gmail accounts and one of them did that to me several years back. But both accounts do nothing but forward to my fastmail account where I have rules setup for them. So it was a giant nothingburger for me. If they're so secure even I can't log into them, whatever. I don't trust google with anything of mine. I used to use their online spreadsheet app to track house bills, but moved it to my local share where I use libre office instead, solely because I'm aware of how likely it is I get locked out of everything at some point. Everyone should treat google like they treat their laptops: With the assumption that it can die at any given time and so backups are critical.

329 points by schiffern 4y ago

meindnoch 4y ago

I’ll forward this to my friends at Google if you promise that you stop using Google products.

schiffern 4y ago
Anything! Please let them know my recovery account (another gmail, FirstnameLastname) is also locked. Edit: I'm back in to my recovery account!! Just enabled 2FA to avoid getting locked out again. My main account is still locked, but it let me verify via my old password, new password, and recovery email code. The message says that they still need to verify more, but I should look for an email to login within 48 hours. Fingers crossed!
- schiffern 4y ago
  Thanks for everyone's help. Backup email works now. Looks like (fingers still crossed) I'll be getting back into my main account in 48 hours. Obviously I'm re-working my email solution as we speak... starting with backing up my Google data! Lots of good recommendations in this thread. Learn from my mistakes. It can happen to you!!
  - joenot443 4y ago
    I was about to take out my work (G) laptop and send this down the appropriate channels. Very glad to see someone else stepped in already. This is definitely I (personally) wish we could do better, I feel embarrassed and very slightly partially responsible whenever I see our support failures making the front page of HN.
    - johnsea 4y ago
      Thank you!
    - romanhn 4y ago
      Hi there! I hate to pile on, but I have a very similar issue and was wondering if you'd be willing to help. About a year and a half I lost access to a Gmail account with emails going back all the way to the beginning. Lots of sentimental messages, stuff like that. Logged into it after a long while, started looking at picture attachments out of nostalgia and somehow tripped an algorithm that locked me out. I stupidly did not have 2FA set up as this was not my primary account, so had no other way to offer proof that I was the rightful owner, despite having the correct password. I tried all the usual things - waiting a long time, trying old devices (phone, laptop), going back to the old location I used to live... nothing worked. Would love to regain access to years of memories.
  - Jabbles 4y ago
    What did you do? What worked?
    - deleted 4y ago
      [deleted]
lucidguppy 4y ago
What email service do you use?

Jabbles 4y ago

Did you follow the steps at https://support.google.com/accounts/troubleshooter/2402620 https://support.google.com/accounts/troubleshooter/2402620 ?

bmitc 4y ago
Interesting how all those frame it as the user’s fault.
schiffern 4y ago
Trying this now. Edit: the closest solution is to try account recovery, which is what I was doing. :( I don't want to "spam" the recovery form, since I suspect that will only make it worse. Edit2: trying Gmail app and Google Authenticator now, to see if that makes a difference. Will update with progress. Edit3: no dice. Gmail app just loops me to a message saying "Google couldn't verify that this account belongs to you." Clicking on Verify account just loops me back to the login. It doesn't even ask for my old password like before. I feel sick to my stomach...
- BaudouinVH 4y ago
  - I had similar trouble accessing my facebook account - the FB recovery process involved me holding some valid ID in front of my webcam. Could Google have something similar ? (Access was restored swiftly) - Have you, by any chance, stored some google recovery codes somewhere ? - Isn't there a "call me and read me a one-time six-figure code" option available in all the login/authenticate option Google provides ? hope it helps
- vertis 4y ago
  Be calm. You may be locked out, but sometimes it just takes time to get back in.
- jeffbee 4y ago
  Are you or can you try to make sure that your behavior is s close to normal as possible? If you normally access your account from Chrome, use Chrome. If you normally use macOS use it. If you normally have a static address at home, use it. Trying to recover your account from your friend’s house in another country, or whatever, could be making it worse.

lrei 4y ago

Yikes! good luck, hope it works out. This is scary. Gmail is still, by far, the best email app. Something like this could happen to me and, I suspect, a lot of other people.

9991 4y ago
The best email app wouldn't ban you for an emoticon in Youtube chat or sending a medical photo to your doctor.
- lrei 4y ago
  These ToS, CSAM, moderation, etc are very orthogonal to the app itself. Why conflate them? Most non-hackernews people are completely unaware of them, so it won't be a factor in their choice of platform. Are we even sure other apps aren't doing similar things? Or have equally dangerous practices around password changes?
  - 9991 4y ago
    Because the user experience is that it doesn't work.
- cromka 4y ago
  This is just crass. There's plenty of very good software with shitty T&C, this isn't anything new.
  - 9991 4y ago
    I dare you to find those examples in the Terms and Conditions.
nix23 4y ago
>Gmail is still, by far, the best email app True, no mails no problems, it's a feature not a bug.
sshine 4y ago
> Gmail is still, by far, the best email app. I used to think so when I used Gmail. But switching to Fastmail, I no longer agree that it is "by far" the best. Now I think Gmail is only better by a slight margin, and this margin is so small that it does not justify the drawbacks: Potentially getting locked out with no recourse, certainly getting everything you receive scanned to deliver you the best possible ads, contribute to the email monopoly where the big players decide the protocols.

nikanj 4y ago

I love how the HN front page is the only way to reach a human at Google. No amount of money can get you a support ticket opened with an actual person in a situation like this

trollied 4y ago
Google One might have helped. https://one.google.com/about/support https://one.google.com/about/support
- theCrowing 4y ago
  It doesn't anymore the trick with buying from the store also doesn't work anymore you get in the same q as everyone else after the hardware and one teams told you they can't help.
- pentium10 4y ago
  Google One support only works if you can login.

yucky 4y ago

I've been locked out of 17 year old gmail account for awhile now because I refuse to sync my phone to it. I only want to login to delete the contents and deactivate the account. It still forwards to my Thunderbird which is how I noticed Google stops dedicating spam protection to un-synced accounts (or something). So, they want me to go away, and I want to go away, but they won't let me go away.

danuker 4y ago
> to delete the contents and deactivate the account Are you in the EU? Google's DPO or your country's data protection authority might want to hear about it.
- jesprenj 4y ago
  Maybe he doesn't want to send them a copy of his national ID for the sake of privacy. Are privacy guidelines in EU countries so well defined that they take terms such as "password for an online service" into their vocabulary?
  - ashwoods 4y ago
    They might not explicitly, but you have the right to take any data you have or they might have on you of any service, no matter if you have an account or not: aka right of access. I don’t know if it has been used this way, but it might be a possibility.
- yucky 4y ago
  Nope, I'm in the US and here in the US Google acts as an extension of our intelligence agencies so we have no recourse. They're effectively part of the surveillance state, thus untouchable.
jesprenj 4y ago
In ~2014 when I didn't have a phone yet (being a child) they deleted my account on account of not having a phone number associated for some weeks. Even though postfix brings me headaches sometimes, seeing issues people have with google seems as setting it up was a step in the right direction.

manholio 4y ago

You don't matter for Google and creating HN spam threads won't change that. At worst, it will solve your particular problem and invite similar spam threads from other victims of faceless corporations.

fsflover 4y ago
Such topics help more people realize that Google should not be trusted with managing their emails (or anything really). More threads like this: https://news.ycombinator.com/item?id=31782952 https://news.ycombinator.com/item?id=31782952
- maxpro 4y ago
  This! I wanted to switch from Google few times (always postponed it to a "next time"), but reading this today I realized how devastating it would be to get locked out. So in the next few days I will move away from Gmail.

323 4y ago

My strategy is to only use GMail and no other Google service at all (cloud, ads, ...) This way there is little possibility of somehow being labeled as fraudulent.

kevin_thibedeau 4y ago
This. I also deny them data collection by not being logged in on my primary browser since I don't use any other service. I originally started doing that when they began to break Gmail performance in Firefox and had to access via Chrome but now it's out of spite.

Alex3917 4y ago

The longer it's been since anyone has logged in, the more confidence Google will have that it's really you trying to log in. In all likelihood you'll be able to get back in within a couple weeks.

schiffern 4y ago
I hope you're right! If that doesn't work, it's all gone. It's not like I can "just" get to the front page again.
anter 4y ago
Not necessarily. I've two accounts that I couldn't access for multiple years now, google simply refuses to let me in despite having all of the correct credentials. For anyone reading this, do not rely on google services, you'll move cities, change your number, or as OP change your password and _you will get locked out_ with no recourse.
sho 4y ago
This saved me during my big scare about a year ago when I suddenly found myself locked out of an important account with no way to get back in (phone number was old and inaccessible). The password was fine, they just didn't believe it was me for some reason. A few months later it suddenly worked again, and I seized that opportunity to move permanently away from gmail. I was lucky. I do not want my access to my online identity to be governed by luck, however, so really advise anyone who will listen to make the move before this kind of sob story happens to them. "It won't happen to me" - I thought that too, and no doubt so did the OP. Won't it? How much will it cost you if you're wrong? It now costs me $50/yr to know it won't happen to me and I'm more than happy to pay a fair price for a good product, like I do for everything else.
- morsch 4y ago
  How does paying 50 bucks a year give you that peace of mind? What kind of recovery procedures do providers like fastmail have?
  - 4y ago

user3939382 4y ago

I made the jump to Fastmail and I'm very happy with it. Web interface is at least as good as Gmail's. Thunderbird keeps a local copy of my emails, I control the email domain. I can create backups. The second you get back in you gotta get off this platform.

Daniel_sk 4y ago
The Apple Mail app on iOS and MacOS is pretty decent. No need to use the official Fastmail client (if you are on Apple and prefer the simple Apple alternative).
- dontlaugh 4y ago
  Also, iCloud+ allows the use of a custom domain. It may be an easier option for some.
  - danillonunes 4y ago
    I believe the major problem is having your email attached to a big tech general account. If your son decides to download a pirated game to your iphone, out whatever other unrelated minor offense, and Apple determine it's worth nuking your entire account, your email is gone. Granted, Google is worse at this matters, and when you own the domain at least you can point it to somewhere else, but it's still a hassle.
    - hacym 4y ago
      Does Apple have a history of doing that? This is the first time I’ve heard of that.
      - shepherdjerred 4y ago
        No
    - yumraj 4y ago
      Even if that happens, it’s not a problem. Why? You go to your register and point your domain to another email provider, and you’re back in business.

nonrandomstring 4y ago

> because (like a fool) You are no fool. No doubt you are way above average intelligence. This so-called "security" ecosystem of Big-Tech is a dumpster fire of rotting clinical waste. Hope it doesn't spoil your holiday break - and for goodness sake make a New Year Resolution - to quit this madness forever.

makach 4y ago
I started working with security to help avoid these kind of scenarios to happen. No doubt gmail is adding controls to their service without fully considering the implications. When security locks you out of your content it is a non-conformity that should be resolved asap zulu.
stanleydrew 4y ago
This is an unfortunate situation, but calling it a "dumpster fire of rotting clinical waste" is frankly absurd. Google in particular has done more than anyone to acclimate consumers to the usage-patterns of better auth (two-factor in particular). Is everything perfect? Of course not, but things are a lot better than they could be.
- tester457 4y ago
  I thought it was actually 2 step. The difference always confused me.
- joxel 4y ago
  Nah, this is a complete farce. You’d think by this point google could offer a simple checkbox in the settings of your gmail account: “Do you want this account to be extra secure and for us to lock someone out of it with any activity deemed suspicious?” And then when you don’t click that box they don’t arbitrarily lock your account. But they don’t. Because they’re a dumpster fire company.
  - deleted 4y ago
    [deleted]
  - 4y ago

lawgimenez 4y ago

Lesson learned, don't do unnecessary stuffs while everyone is on holiday.

danuker 4y ago
Which is precisely when you finally have time to do them.
onionisafruit 4y ago
It’s not like Google customer service is going to help on a non-holiday
- maxpro 4y ago
  Is there a customer service at Google? Had no luck with them... once I got an email after they charged me twice for Play Music, but this was canned response. It took them almost 7 months to figure this out and pay my money back.
  - onionisafruit 4y ago
    That’s the point I was trying to make. As a user, getting help from Google customer service for something like this seems to be nigh impossible. I assume Google has customer service for their actual valued customers — the ones who spend money placing ads, not the ones who spend attention viewing ads.

marvindanig 4y ago

Google's strategy of locking out people from "everything" is just insane! Someone needs to lawyer up and make them pay through the nose for stealing access to individual’s personal data that doesn't even belong to them.

CrendKing 4y ago
Even this "someone" wins, if it's not a class action, I doubt any amount of money out of the lawsuit would change anything for a big company like Google. And I doubt case of these could result in class action anyways.
- deleted 4y ago
  [deleted]
hoffs 4y ago
How is it everything? You get locked out of your account.
- Double_a_92 4y ago
  Which in the case of Google is for quite a lot of services...

sva_ 4y ago

Do you not have any of your recovery codes left?

hsbauauvhabzb 4y ago

I ran into a bug where the recovery account token wasn’t working. I found no way to contact google about it. Until there is regulation, you’re probably going to be out of luck.

Double_a_92 4y ago
As the world gets more and more digital, there really needs to be such regulation. Certain accounts are too deeply ingrained in your digital identity, that they should be able to be taken away from you. At least not without a way to start a proper legal recourse, where real person need to solve your case and at least send you your data. EU do something!

krono 4y ago

Whilst it might not be of help to OP, I suggest everyone else to do a data export for all your important services every once in a while and save it with your other backups. https://takeout.google.com https://takeout.google.com https://account.microsoft.com/privacy/download-data https://account.microsoft.com/privacy/download-data

hu3 4y ago
Is there something like this for Apple?
- theCrowing 4y ago
  https://privacy.apple.com/ https://privacy.apple.com/
hanklazard 4y ago
For sure. I believe I have this set to create an export and notify me the backup every quarter or so. Not the perfect solution, but until I do the right thing and switch over to fastmail, this at least ensures I can only lose a few months (gulp) worth of email.
- grepfru_it 4y ago
  Having lost a few months of email when my mail server crashed, it’s something you whine about for a day or two but then it’s business as usual. As with all insurance you pay for what you want to risk. It didn’t hurt me much but I still went to daily offsite backups for my mailserver. The biggest gripe was standing up a new mailserver, make sure you keep your software up to date yall
- sneak 4y ago
  You can move your old emails off of your current email provider at any time even without changing any email settings or where new mails go. It always seemed silly to me to have the server where your new mails get delivered be the same server as where your email archive lives.
- 4y ago

trollied 4y ago

[flagged]

jbotdev 4y ago

Hope you get your account back. I’ve been on the fence about migrating off Gmail, but after reading threads like this, I put a contingency plan in place. Backups of my Google account are done hourly, and I have a custom domain/workspace account so I can move the domain elsewhere if needed.

dpacmittal 4y ago
How do you do hourly backups?
- jbotdev 4y ago
  There are a few open source options out there (e.g. run IMAP backup script via cron). I personally use CubeBackup [1] on a local NAS, which covers mail/drive/photos. I then have a job that backs up that directory off-site using rclone. [1] https://www.cubebackup.com/ https://www.cubebackup.com/

BaudouinVH 4y ago

Is there someone else around you trust and that could read the QR code on his/her smartphone ?

corv 4y ago

Welcome to the club, I've given up on Google altogether.

jjcon 4y ago

This happened to me - I even had access to my recovery mail but google just decided I wasn’t trusted back in my account after I moved to a new country. I contacted every support line I could but alas. About 3 years later I was magically let back in, no idea why but I would try every few months and it just worked one day. Hope it doesn’t take that long for you.

survirtual 4y ago

There is nothing google will do for you. I had a similar issue here: https://news.ycombinator.com/item?id=31681221 https://news.ycombinator.com/item?id=31681221 I’m still locked out of my account. December 22nd was the expiration of the domain name I needed in order to unlock it, and it is now gobbled up by another squatting service (Bodi), so I will have to try again next year. They don’t even entertain my offers to buy it. Let our losses be a lesson to people: get off of gmail asap. They do not care about you. They do not care about the harm they are doing, the memories they are sealing away. All they care about is making money off of your data. Get off google now. As fast as you can.

ryandrake 4y ago
It's now been 0 days since the last "Help! I've been locked out of my account!" story on HN. These have been going on for years and years[1]. The solution is for individual people to stop relying on services that don't have customer support to host critical things. This is now a well-known failure case for free cloud services. It should not be a surprise. 1: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=%22locked%20out%22%20account&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

vinckr 4y ago

Sorry to hear that, this really sucks. Shows once again how authentication is still not a solved problem. I switched to posteo.net recently and have not looked back since, can only recommend a paid email provider. Different level of support and assurance when you are a paying customer.

ck2 4y ago

If you have it tied to an android phone, even without two-factor, there is a hidden way to generate a code it will take under security Not all accounts seem to have this but I did. I do NOT have two-factor and eventually the "try another way" method offered to take me through the android code generation and it let me back in. > *"Sign in With Backup Codes"* https://support.google.com/accounts/answer/1187538?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/1187538?hl=en&co=...

noisy_boy 4y ago

This prompted me to download Thunderbird - was very easy to get started (it basically provided a wizard with some basic inputs and started fetching messages immediately using POP).

moffkalast 4y ago
Thunderbird? Marty, I'll need to fix the time circuits, we've travelled back to 2006! But seriously, what's next? Switching to IE from Chrome? Back to MS Office from Docs? The more things change the more they stay the same...
- noisy_boy 4y ago
  One of those isn't the same as others... IE and MS Office are MS products, Thunderbird is still under the Mozilla umbrella. I guess for certain things we backup to cloud and for others, we backup from cloud :D
- BenjiWiebe 4y ago
  What's wrong with Thunderbird? My workplace uses it, my family's small business uses it, I use it. Has lots of features, doesn't require a fast stable Internet connection, and there's no risk of losing your emails because $provider locked you out. Plus if you have multiple email accounts, it's super convenient to get them all in one place.
  - moffkalast 4y ago
    Idk, Thunderbird, Outlook, and desktop email checkers in general seem absolutely antediluvian to me. Like CRT screens, trackball mice, and space cadet pinball. Do you still have to fetch mail manually like a caveman or did they make it automatic yet? Does your mail sync between all your devices? I still think it's less likely to get banned from gmail than my local hdds to fail.
    - spopejoy 4y ago
      > I still think it's less likely to get banned from gmail than my local hdds to fail Uhh the whole discussion is about exactly this problem which you've decided won't happen to you because ... ? Thunderbird rules and isn't going away, and makes things like blocking remote images easy (as opposed to gmail where you lose basic UX if you turn it off so most people don't). What's more, gmail's basic features have really suffered in the last 10+ years. I search 20 years of email in Thunderbird faster and more efficiently than the bloatware POS gmail is now. But best of all, I don't use gmail! I never have to worry about the nightmare scenarios presented here and nobody spies on my email (other than the NSA :) ) Oh -- physical backups rule too. From rotating through various drives my email is backed up at least 16 times over.

ddevault 4y ago

I'm getting pretty tired of these threads. We've seen them for years and years and years. At this point, anyone still using gmail is a PEBKAC error. Move!

Havoc 4y ago

Is it my turn next month to post the google's AI security/support fkd me thread? Anyway, hopefully the google support outsourced to hn channel can help...

evouga 4y ago

Can someone explain how it’s anything but completely insane for an online service to deny access to someone with a *correct* password?? This isn’t someone getting locked out because they forgot their password (where I can at least understand why the user is at fault).

martincmartin 4y ago
2FA exists because sometimes ne'er do wells get your password. Phishing, guessing weak passwords, password reuse from sites that are hacked, the list goes on.
- evouga 4y ago
  Of course I understand enforcing 2FA when the user has signed up for/opted in to 2FA. But that doesn’t seem to be what’s happening here: Google unilaterally decided to enforce 2FA on a 1FA account.
  - cuteboy19 4y ago
    "Old password+new password" is not 2fa
    - awinter-py 4y ago
      yes exactly. if G were following best practices from the consumer banking industry, 2fa would be more like 'old password + random row from your equifax profile'
      - cuteboy19 4y ago
        And of course, the last 4 digits of your ssn
        awinter-py 4y ago
        'any digit from your ssn'

jondoe 4y ago

[dead]

kmbfjr 4y ago

Google gave away the Google Voice number I had since the GrandCentral days, a number obviously used daily with purchased credits in the account and religiously confirmed linked number. Zero customer support, no way to get the number returned and no refund on existing credits for toll services. And to add to the pain, they won’t give me a new GV number because it sees my linked number as a spam source and never sends the confirmation code. I am done with this outfit.

huh88267 4y ago
What do you mean they gave it away? I don't have a linked number to my GV anymore I just use it for 2fa codes... Is that not safe? Edit: MAKE YOUR NUMBER PERMANENT if you don't want to lose it due to 6 months inactivity. It's 20$. Also ported numbers are never recycled. I am happy with GV and will always use it.
- kmbfjr 4y ago
  They gave it to another GV user without warning, within 24 hours of its last use. You can not imagine the pain of having to recover the three accounts using that number for 2FA.
mindslight 4y ago
Are there any good VOIP alternatives to Google Voice that don't get tripped up as invalid phone numbers by other companies' snake oil authentication? From what I've found, GVoice is uniquely large and has enough "normie" Google Fi customers that companies can't discriminate the way they do against say Voip.ms and Flowroute [0]. My tentative plan is to get (another) cheap paygo SIM, stick it in a cell modem attached to a server, and set it up to forward all texts to email/xmpp/etc. Use that for all these longstanding snake oil auths. Then move my main personal number (used to be a mobile number, now at GVoice) to a VOIP service. At which point if someone can't call/text my personal number because they're using some crappy service (eg Comcast mobile), then too bad, they can figure it out. [0] I figure Twilio is in this same boat, although I don't have much experience with them?
- 4y ago

0xbadcafebee 4y ago

I'm sorry this happened to you. I feel lucky that I moved to FastMail + a custom domain before this happened to me! :<

idiocrat 4y ago

Please consider waiting for one day, before re-trying with your valid password. Your account will be auto-unlocked after a cool-off period. It helped me in the past.

blacklight 4y ago

This is probably the #500 post on HN that reads "help I've been locked out of my Google account for Kafkaesque/inexplicable reasons and I have nobody to reach out to". If you're still using Google products as your primary drivers, then it's entirely your fault. Do yourself a favour in 2023: drop Google and all the filthy excrement that they produce. There's plenty of much better alternatives, and from a purely market-based perspective Google deserves to rot in hell for all of its sins and shitty products.

coffeeblack 4y ago
This, plus if you have no Google Takeout backup.
- gatonegro 4y ago
  A few days ago I was going through an old Gmail account, and decided to get my data through Takeout. Told me it'd take a few hours, and the next day I had a link ready. Click the link, enter the password, it tells me I need a verification code that it wants to send to an address that stopped existing 15 years ago. As it turns out, Google is not sufficiently convinced that I am in fact the owner of the account, so it refuses to let me download the data. I don't feel inclined to spend time trying to figure out this nonsense, but thankfully none of the information in that account is particularly important. I'll take it as a sign that I should just move away from Google, because next time the information on an account could be actually important, and I'd be screwed.
  - blacklight 4y ago
    Takeout is a feature that Google was kind of forced to implement because of GDPR compliance. But they still try their best to make it so bad that people won't think of using it. First, getting to a point where you can actually schedule the creation of a zip takes a lot of clicking around - just to make sure that people won't bump into it unless they're explicitly searching for it. Second, the process is painfully slow (on purpose). Last time I used it was to download my YouTube subscriptions and playlists to import them into my Piped instance. Even though I only have about 100 subscriptions, and only two playlists with about 20 items each, the process took almost two days to complete. By then I had already made a script that scraped the content from their HTML (and it only took me 5 minutes), and another one that did the same but using the YouTube API. If it takes less than a second to get the playlists and subscriptions of a user, I don't see a single reason why generating a Takeout CSV with the same information should take 2 days. I was determined (and tech-savvy) enough to script my way out of it, but many users just get discouraged and give up the idea of exporting their Google data entirely.

wintermutestwin 4y ago

The fundamental problem here is that there is no way to get support from google that is a human being. I dream of a day when the US government retakes the mantle of consumer protection. Proposed regulation #2 (after eviscerating privacy violation) is that all services must meet certain customer service standards, including having a way to get to a human being. I know I am dreaming hard here, but there once was a time when consumer protection was on the rise...

jeffbee 4y ago
> The fundamental problem here is that there is no way to get support from google that is a human being. No way other than paying a trivial $1.67/month for Google One.
- josephcsible 4y ago
  There have been past stories here about people who were paying for that but found themselves in situations like OP's anyway, and it didn't help them to resolve it.
- wintermutestwin 4y ago
  Using google, you are already "paying" by giving them your data (which is worth way more than the value of their service)

Doubtme 4y ago

If you don't backup your data in 2022+ it's entirely your fault. After losing my own 10 year old Gmail and running around the internet hunting down employees for 5+ months only to get a canned automatic response. I learned to not trust any service. Ever. I've even been hacked by rouge employees of fortune 500 companies. Only because of my experience I was able to get my account back after being hacked for 5 - 10 minutes. Backup yo shit fam. - IT guy who has been backing up to 3+ different hard drives since 2008.

Herbstluft 4y ago
Losing access to your mail account causes significant and critical damage without ever considering the existence of backups. Backups don't help with the painful (and sometimes barely possible) migration of your accounts to a new address, updating contacts, loss of mails that arrived after you were locked out, et cetera
- Doubtme 4y ago
  Welp that's the product you signed up for. Much like PayPal stealing from millions of Americans for a full decade+ Can't backup money either. That doesn't stop these policies of zero human support and only infinity robot responses from remaining until today. Writing a law and getting it passed to curtail this behavior absolute nonsense. Complaining about the next 1000000 people to lose access without doing 1 single thing about it. Sign me right up!
  - Herbstluft 4y ago
    Oh I agree. Gmail is basically a daily lottery for account lockout. Still important to raise awareness, these posts certainly help and make it harder for google apologists to deny it (a few years ago there was a lot more victim blaming in the comments of these threads). I felt the need to point it out because backups were brought several times here as a defense against OPs scenario which they aren't.

Brajeshwar 4y ago

This is something I'm not certain but worth a try. I have also advised something very similar to someone who lost their parent's gmail ID access. If you already have another Google ID or your partner/spouse/relative, upgrade to one of Google's paid service such as the Google One. Now, talk to a human customer care for Google One and seek help. I was able to talk a real person with an issue with Google One and the person on the other end knows a whole lot of details (which I was not expecting to be a regular information). Yes, that might cost you one month's of Google One but worth a try. Btw, I have never figure out how to talk to a person even when I have 3+ Google Workspace for Business accounts.

GoOnThenDoTell 4y ago

Its not reasonable to have your primary email be gmail anymore

prlambert 4y ago

The anti-Google frothing here has gotten so extreme it's crossed into comedy. Maybe instead of assuming incompetence and malevolence you should consider how hard it is to do this perfectly. You don't have to like them, but the fact is the there are many many smart and competent people working on these systems trying to do the best for all users of Gmail and Google Accounts. Every day there are hundreds of very bad people around the world trying to gain access to Gmail accounts to do very bad things using that access. All the worst parts of humanity have found their way to leverage it. Balancing security and user-friendliness is one of the hardest problems in tech and it's impossible to do perfectly. It seems from this thread that the OP did regain access and it didn't take that long. Edit: I worked at Google for a few years, including on Gmail, and know that the people there really do care about all these things. But I left in the summer, no longer their employee.

ausbah 4y ago
if this happened to you I'm sure you wouldn't be thinking "gee they really are just trying their hardest let me cut them some slack". you maybe be right but that doesn't solve anyone's problems like this one

jnky 4y ago

I had a similar problem a while back where Google demanded a second authentication factor for an account that didn't have 2FA set. It asked for a previous password that the account must have had >10 years ago and I think the answer to a security question that I couldn't answer, because I always use cryptic responses to those and apparently didn't save this one way back when. My rationale was that I wouldn't need any of that, because I knew the account password so there would never be a need to go through account recovery. Either way, I found a solution to that on one of those Google user support forums: I had to not try and log in to the account for approximately 40 days. After that, it'd let me log in with just the password again. This is apparently because Google keeps flagging the account of getting attacked and requiring a second authentication factor for some reason and the timer for that keeps getting reset after a failed challenge for one of the account recovery factors. After something between 30 and 40 days, I could log in to the account with just the password again.

kings12 4y ago
[flagged]

spicymaki 4y ago

I am sorry to hear about that. The state of customer support is really sad these days. If you figure out how to get back into your account, you should make sure you generate physical recovery codes. That should prevent you from being permanently locked out of you account.

usr1106 4y ago

A long time ago I created a separate Google account for every of their services. I have the passwords of all of them, but as soon as I try to log in they ask me add my phone number "to make my account more secure". There is no way to click it away or say later. So de facto I am locked out. I won't give my phone number to Google and I don't have a dozen of other numbers. Google is like forced prostitution. You must sell your privacy to their advertising business. Edit: Have not tried again for quite while. Maybe they change it some day? Well I have given up all hope and try to avoid them as much as I possibly can.

el_nahual 4y ago

Whenever I think about migrating my "primary" email to be at a domain I own, I come up with the following risk calculus: What's more likely: A) That i get locked out of Gmail for some byzantine reason I can't get out of B) That for whatever reason (new card, I'm in the hospital, whatever) I forget/am unable to renew my domain and it gets sniped.

mindslight 4y ago
You can generally have many years prepaid for domain registrations. So if you make it a point to have between 3-4 years preregistered, and put it on your yearly calendar to check/update that, you will be fine. The real issue is that whatever registrar you choose can also arbitrarily lock you out of your account. But one would think being a bit smaller company, having less surveillance tentacles into things like phones, and having a less homogeneous userbase would keep them in line.

Fire-Dragon-DoL 4y ago

I'm confused, how could Google ask for the OLD password? Is this even a thing? I have no idea what my old password is.

halilim 4y ago
Yes. Google (and probably many other companies at this point) ask for your previous passwords as part of the account recovery flow. It's an additional factor to help establish that it's you and not a scammer trying to "recover" it. So it's a good practice to save old passwords. Some password managers make it easier by having a password history feature, usually on the account's detail page.

lazyeye 4y ago

Google has no interest in you or your problems. I recommend watching the "Talks at Google" channel on youtube to see the kinds of things that interest the people at Google.

themadturk 4y ago

I only use Google as a secondary account now, though most of my family continues to use it (under a vanity domain, grandfathered in after lo these many years). I still keep my Google 2FA active, though. I use pobox.com to forward my primary domain. Right now I have mail forwarded to their "mailstore," which is essentially a lite version of Fastmail.com (Fastmail owns POBox, or the other way around, don't remember), but I can forward to multiple mailboxes. It costs $50 a year, just like Fastmail, but I think it's a little more flexible, at least for my needs.

ylee 4y ago
>I only use Google as a secondary account now I've never had Google as a primary email account. I do have a few Gmail accounts, but that was to reserve them with my name, as opposed to ever giving the addresses out. >I use pobox.com to forward my primary domain Customer since 1996 and primary email address since 1999 because my college address closed at graduation. Since then my email has been hosted at ISPs, at various other providers, and at a Google Apps site, but it doesn't matter because the pobox address never changes. My college address works again, but I've long since used the pobox address in too many places to mass migrate away. Years ago, before it got "corporatized", Pobox's FAQs had one entry that went something like: Q: How do I know you'll be around in the future? A: How do we know you'll be? Ha, didn't think of that, did you?

Wicher 4y ago

Incidentally, another Ask HN today was about running your own mailserver: https://news.ycombinator.com/item?id=34117386 https://news.ycombinator.com/item?id=34117386

villgax 4y ago

I'm guessing you didn't pay for it so there is no hope in this case

powerapple 4y ago

I feel sorry for you. Someone at Google PLEASE, PLEASE, make it enough for a registered phone number to reset the password. I got my phone number with my passport, it is the last thing that don't need any verification. Why is it not necessary? AND stop sending verification email to the email address I am recovering. It is a sick joke.

spopejoy 4y ago
Guess you've never been simjacked
- powerapple 4y ago
  no, and it is not something I worry about to be honest.

IYasha 4y ago

You're not alone in this sh*. I'm here too. And there are dozens of threads here with the same problem. May the Universe help us.

P5fRxh5kUvp2th 4y ago

I have two gmail accounts and one of them did that to me several years back. But both accounts do nothing but forward to my fastmail account where I have rules setup for them. So it was a giant nothingburger for me. If they're so secure even I can't log into them, whatever. I don't trust google with anything of mine. I used to use their online spreadsheet app to track house bills, but moved it to my local share where I use libre office instead, solely because I'm aware of how likely it is I get locked out of everything at some point. Everyone should treat google like they treat their laptops: With the assumption that it can die at any given time and so backups are critical.