9 ms·

Google removed my Yubikeys from a Google account 'just to be safe'

403 points by nalllar 4y ago

nalllar 4y ago
Hi HN. I posted this here because it seems to be the best way to get someone at google to look at something. To preempt some comments along the lines of "why are you relying on google in 20xx", I try my best not to these days but I still rely on them to forward emails from my old accounts, or for services like youtube where you must have a google account for full features.
- yetanotherloser 4y ago
  It's undeniably shitty behaviour from the Goo but I'm increasingly getting the message that the only sane attitude is detachment from anything I posted in some past , more naive age. Scribe on vellum or linen rag that which is for the ages, and ignore the rest. If it's on a server I don't even mourn it, I killed it already by putting it there.
  - ziml77 4y ago
    That’s how I think about it. What’s the big deal really to lose things from the past? I still have way more of my personal history solidified in in recorded form than people of ages past. They managed just fine, I will too.
    - gpanders 4y ago
      >What’s the big deal really to lose things from the past? Losing pictures of my kids when they were young would be devastating. For some things, it’s a very big deal.
      - tasuki 4y ago
        Sad, sure, but devastating?
        ergonaught 4y ago
        Yes. Why would it even occur to you to police how someone feels about losing things of immense personal significance?
        CoastalCoder 4y ago
        Not the GP, but it's not necessarily policing. Sometimes readers want to know if you're using hyperbole vs. speaking plainly. Also: HN is a place for discussion and debate. You shouldn't expect any of your claims to be immune from scrutiny.
  - hotpotamus 4y ago
    I tend to agree, but you can also run your own servers.
- deleted 4y ago
  [deleted]
xrayarx 4y ago
Sad story, it is the same with all the newfangled companies: you are a product, not a customer
- moloch-hai 4y ago
  The joke is on the customers, then, who are treated as badly as users.
nothasan 4y ago
I think Google needs to add a better way to secure old / previously inactive accounts. My guess is because your account was old, and your current device, IP and overall fingerprint was different it decided you were an intruder.
- marcinzm 4y ago
  Removing pre-existing security measures due to suspicious activity seems an odd strategy.
- carbocation 4y ago
  This seems inadequate to explain the removal of security keys. Unless Google inferred that OP was not just a garden variety intruder, but some sort of advanced persistent threat that had added such keys long ago?
  - nothasan 4y ago
    Yep I don’t know what’s going on here. OP posted another reply with the time they added their keys and they aren't recent.
- nalllar 4y ago
  I don't know, while this account is old and fairly infrequently used I normally have it in the google account switcher dropdown logged in rather than completely logged out.
pwdisswordfish9 4y ago
Reading stories like these, I’m glad I don’t even have a Google account.
- PaulKeeble 4y ago
  I remember how promising early Google was, how great Gmail appeared to be. Now the search is barely usable, your account gets nuked because you logged in a minute later than usual and they still don't have any support. Strangely businesses haven't completely abandoned everything to do with them, they clearly don't care about their paying customers let alone the free tier ones.
wkat4242 4y ago
> Removing physical U2F keys from an account without request seems to be the worst possible reaction to suspicious activity. Exactly, unless they were added during the suspicious activity. But this seems to be not the case. I work in cybersecurity and I've seen hackers setting up PINs etc on hijacked Whatsapp accounts just to make it harder for the legit owner to recover it. So if it was a really recent addition it might make sense. If the Yubikey was there for ages it's a really stupid move because it's the one way the real owner can prove themselves.
- nalllar 4y ago
  The account has had some security keys set up since ~2020, with additional keys added last year.
  - nabakin 4y ago
    It could be accounting for the scenario where old keys are stolen. 1. You login with your key 2. Google flags you as suspicious 3. Google removes the keys from the account because the suspicious actor used them to login and could have been stolen
    - nalllar 4y ago
      Makes rather little sense if so, given it's a hardware key. The most likely casees where the key is used to do something that trips this afaict are: * genuine key, user does something fine that trips a heuristic * genuine key, user's device is compromised In either of these cases removing the key is making the account less secure. Google also removed all the keys associated with the account instead of just the key that was used. Having a yubikey physically stolen and also knowing the details to log in with seems like it should be very rare. If they're going to have a process that removes the keys they need to be so confident that they lock the account and go through some sort of IDV process to turn it back on. Removing the keys and leaving you with just a password that you just set up on the device that just logged in using the key is obviously not the right approach if you think the key's compromised because the password's just as compromised.
    - 4y ago
deleted 4y ago
[deleted]
jamest 4y ago
Related, but different, & if there's someone at Google looking at this: There was a Titan Bluetooth Key (for 2FA) Vulnerability, you've said you'll replace the affected keys[1], but you're no longer doing so. Which is frustrating. [1] https://security.googleblog.com/2019/05/titan-keys-update.html https://security.googleblog.com/2019/05/titan-keys-update.ht...
- mcint 4y ago
  You'll have better luck with a separate post, even if it doesn't hit the front page. I would over-describe the problem, state it in 3 different ways, so some kind soul searching is more likely to find it.
twawaaay 4y ago
Google's implementation does not seem to be doing much good anyway. To be fair, it is not just Google -- most companies feel the same pressure of having to implement MFA but then also make it convenient for clueless users to recover their access. The right way to implement hardware keys is to allow registering multiple of them (so that you can put at least one or two off-site -- in a secure storage) and then not let you recover the access under any circumstances without showing you still own at least one of those keys. If you can recover access without the keys then what is the point of keys in the first place?
- carbocation 4y ago
  > The right way to implement hardware keys is to allow registering multiple of them Google allows this.
  - twawaaay 4y ago
    You missed the second part.
    - carbocation 4y ago
      I see, so you're saying that it's good that Google does the first part, but needs to add the second part. Awareness that Google does the first part wasn't clear from the comment.
      - twawaaay 4y ago
        Any security mechanism is pretty much worthless if it can be trivially circumvented. So yes, the second part is pretty important Actually both parts are important, either is worth little without the other. Having well implemented hardware key is useless if you can't configure more than one -- too much risk having a single piece of hardware that if it fails or you loose it will lock you irrevocably from the account.
      - joshuamorton 4y ago
        It's also possible to do this via advanced protection, it just makes account recovery ~impossible, so you have to explicitly opt in.
tmpburning 4y ago
They probably asked you for your phone number at the same time....
- nalllar 4y ago
  I did not get asked for a phone number or use SMS 2FA during this process.
fosefx 4y ago
Tangent: Instagram managed to lock me out of their service for a week or so a couple of days ago. My browser was signed in into my account, but I have not used it for like a month. Got logged out. I log back in (using 2FA btw). "Please give us your phone number so we can verify it's you" I enter my phone number. I don't really get the point of this because they did not have my number before, so what are they actually verifying here? Anyway, I trust Facebook with my phone number lol. I get a code, I enter it. "Your account activity is suspicious and we will limit your account for a bit" That was it. No redirect, no link to click, nothing. So I go back to instagram[.]com and have to do the same thing again? Well maybe my browser is on a block list now or sth. So I go to my phone (where I was signed in). And the App is broken completely, looks like the session was invalidated. I log out, log back in, do 2FA, enter the code again. Same result. I checked back in a couple of days ago and it seems like I have access again. It is unfathomable how this can happen. How can the front gate to your multi billion service just not work to the point where you DOS yourself? Also this account has 0 images, and just a couple of followers, so there is literally nothing to protect. In moments like these you really start to notice the missing communication channels to the big tech companies. Is there any other industry that has zero customer support?
- unqueued 4y ago
  This makes me worried, because I am pretty sure Google is going to start removing keys based on attestation certificates. I believe that this is much more about rate limiting than about security for the end users.
- bmitc 4y ago
  It seems like most industries are moving towards no support because "we need to scale at all costs and to the detriment of customers" seems to be the capitalism drumbeat. Customers these days, to many companies, are just statistical artifacts in their system. I had a case the other day where I called my insurance company. The automated system couldn't understand my answers (I was actually trying to answer the given prompts rather than just repeating "representative" over and over). It replied "it looks like we're having a problem" and proceeded to just say goodbye and hang up on me. More than infuriating, and that's an understatement.
into_infinity 4y ago
Google generally does stuff like that when they believe somebody else had access to your account and made changes. This sometimes involves the attacker enrolling for (their own) 2FA or changing recovery methods to lock you out. So, the action of removing 2FA is in itself not unreasonable. It's possible that their logic has some sort of a bug, especially if it only happens when you visit a specific service - and in that case, getting on HN might be the best way to get it looked at by a human... but also make sure you don't have any other issues going on.
- nalllar 4y ago
  Removing security keys that have been registered for years is very unlikely to be the right move even if my device has been compromised, as they are one of the most reliable ways I could prove I am the original account owner at some later point. If the message had stated "We have removed recently added security keys" I would be a lot more understanding!
  - lamontcg 4y ago
    If you had your recovery keys stored in a note on lastpass you might have wanted to rotate those as well recently. Yeah, in theory those recovery keys should still be secure, but you know for certain that a hostile attacker has the encrypted secure note, and without any confidence in lastpass it makes sense to change them as well. Unfortunately this means you look exactly like someone doing an account takeover and changing the password and recovery keys on the account.
    - nalllar 4y ago
      Thanks for the heads up. I don't use lastpass, but if I did I wouldn't have to because this "Just to be safe" process also reset/removed the recovery keys.
  - ehsankia 4y ago
    > registered for years Right, that's likely the "bug" part. On HN of all places, people shouldn't be surprised that bugs happen.
Shank 4y ago
Were you using a VPN or something? I’m curious if this was tripped by setting off impossible-travel flags or something. It seems plausible that this is just anti-account takeover logic working as-expected, but with a false positive alert.
- nalllar 4y ago
  Anti-ATO should not clear out security keys that have been registered for a long time. If suspicious new keys were added, it should clear those. From the audit log in my email no new keys were added before this was tripped. I am not using a VPN and as far as I know I am not doing anything unusual. I might be committing the crime of having a Linux Firefox user agent but I somewhat doubt that was the problem, that's not that unusual.
- unqueued 4y ago
  I was hoping that using hardware keys would eliminate some of the security hoops that we have to jump through. And it does seem to help. But the whole reason that I have a key is so I do not have to supply my phone number, and I have a more trusted way of proving my identity, even if I am connecting from an unusual location.
nonfamous 4y ago
I had a similar experience recently when setting up a new TCF TV for my mother. I didn’t see a “was this you?” email to her Gmail account after logging her in to Android TV, and within hours her password had been invalidated by Google. The message when trying to log in at gmail.com was “Your password has been changed in the last week”, which caused me great concern and an hour or so changing passwords, etc. If the message had said “Google invalidated your password” I’d still have been pissed, but at least not panicked.
tmpburning 4y ago
Google twice removed my password from my Google account... i.e.: I could not login even with the correct password.
kkfx 4y ago
Personally, just to be safe I have ceased to use many "big name" services, preferring for instance to have my mails locally, paying a service (not that much) with a hotline... My personal policy is: if I can't phone them, if I have no local registered office to contact in case of need, if I do not have my data locally in usable forms, that's means is not safe for me going with them.
- walton_simons 4y ago
  One of my personal rules for life is that wherever possible I avoid businesses which are big enough to have call centres, especially if those call centres are in another country. Obviously that's impossible for a lot of things, but I try. The small local ISP I use, for example, is totally worth the additional cost. I can call them, and there's no "press 6 for support, your call is important to us" nonsense. A couple of rings, and I'm stright through to an expert who has the knowledge and authority to fix my problem right away.
ffhhj 4y ago
》As google has no support channels I can use, my only recourse is to write this blog post and hope someone sees it. By 2030 we will need to build a social network with at least 10k users to get some attention from the Gooverlords.
blacklight 4y ago
Articles like these (which can generally be grouped under the "what the hell is Google doing with my account and my data, and why can't I reach out to a human to get out of this Kafkaesque nightmare?") are popping on HN on a daily basis. I've previously been reported for commenting on a previous article that Google is a faceless company that produces shitty products and it doesn't actually doesn't give a shit of user experience, negative feedback nor deleting/locking accounts (and, often, years of work) for no clear reasons. Somebody responded "on HN we often hear only one side of the story (people getting a negative experience with Google) and not Google's side". So, since many Google employees are also here on HN, I ask you folks: do you have any words to say in defense of these crappy policies? If yes, then I'm happy to change my mind about Google, and eat back all the countless offenses I've thrown at the company over the years if convinced by enough plausible arguments. If no Google employees can come here (or, even better, directly reach out to those impacted by their bad decisions) and defend their policies, then I abide to my words: Google is a shitty company that produces shitty products, it is proud of being a faceless company that doesn't care about supporting users (even though it makes a lot of money out of their data), it makes horrible business decisions, and it leaves people in the dark when locked out of their accounts. Such companies, in a healthy market with enough competition, deserve to rot and fail and be mourned by nobody.
- anonuser123456 4y ago
  I think your commentary is unfair; they make great business decisions. They realize that the benefit of fucking over a few users here and there is outweighed by the cost of helping them. And people that matter have a back channel via employees or account reps to clear things up.
  - blacklight 4y ago
    So in order to get a chance to be heard either you need a backdoor to a Google employee, or you need to be on a business account. Therefore, unless you fall into one of these categories, you probably shouldn't use Google products - or, even worse, rely on it for sensitive things such as your emails, your photos or your work documents.
alphabet9000 4y ago
found a similar error message happening to someone else a year ago with few recourse options: https://support.google.com/accounts/thread/103488375/google-could-not-verify-your-gmail-account?hl=en https://support.google.com/accounts/thread/103488375/google-...
srwx 4y ago
Great so when something like the recent LastPass leak happens and I go in and cycle my password, 2fa and backup codes out of simple precaution Google is going to perhaps mark that all as suspicious and undo it for anyone who might come along and pretend to have lost access to my account?
- PaulKeeble 4y ago
  Its a surprisingly risky to update your login credentials. Users do it so rarely its perceived as suspicious even when it comes from known IPs and everything else looks healthy. Given its Google if it goes wrong you loose the account completely. Its insane you have to weigh up the potential consequences of doing the right thing for security but that is how Google has set the system up.
  - shortcake27 4y ago
    This happened to me on Instagram. I changed my password then logged out to test it. When I tried to log in, I received a generic error. I Googled the message and it appeared to be a “temporary” IP block and people claimed it should work in 24 hours. So I tried the next day, same error. I left it a bit more and came back 3 days later - same error. I then turned on my VPN and was immediately able to log in. So the IP I’ve been using for 2+ years, the one that changed the password, on a known browser, is blocked. But a random IP Instagram has never seen before? No worries!
Animats 4y ago
We need a general solution to reestablishing authentication. The hard-line solution would be that you go to a post office, airport, police station, motor vehicle office, passport office, or bank, they take your fingerprints, picture, and a retinal scan, you get a new ID card and token, and your old ones are invalidated. The US just pushed the date for REAL ID enforcement further out, again. This time from spring 2023 to 2025.[1] REAL ID terrifies illegal aliens. Once everyone legal in the US has one, getting a job or traveling will be much harder. [1] https://www.cnn.com/travel/article/dhs-real-id-deadline-extended/index.html https://www.cnn.com/travel/article/dhs-real-id-deadline-exte...
- SoftTalker 4y ago
  It's already illegal to hire illegal aliens. Why will REAL ID change anything in that regard? Employers who disregard the law now will continue to disregard the law.
  - lmm 4y ago
    > It's already illegal to hire illegal aliens. Why will REAL ID change anything in that regard? It's hard to enforce that when there's no easy way to prove someone isn't in the country legally.
    - sokoloff 4y ago
      How does Real ID help prove that someone who doesn’t have one isn’t here legally? I am here legally and renewed my license since my state offered Real ID. I still got the old “Not for Federal ID” license. If I show that to someone, does that somehow prove I’m not here legally?
      - lmm 4y ago
        If you represent an expired or otherwise invalidated license as legitimate proof of ID then that's fraud. I'm sure a sufficiently dedicated citizen can find a way to pretend to be here illegally, but as long as you're not going to mix up a reasonable law-abiding citizen with an illegal immigrant you can arrest them and sort it out afterwards.
yborg 4y ago
Google support bot requires HN Google account nightmare stories to reach 1000 points or be posted by paulg before they are addressed. (FWIW I addes YUbikeys to 2 old long-term Google accounts about 6 months ago and they are still there. I did do this from the home location I usually use Google from, though.)
- nalllar 4y ago
  Unfortunately for my hopes of getting this fixed, this post started getting flagged after it sat at the number 1 spot earlier today, or maybe Dang bumped it down because there are too many google support posts. :P
- deleted 4y ago
  [deleted]
proactivesvcs 4y ago
February this year I migrated my Mojang (Minecraft) account to a Microsoft Account, which I created solely for this use. I played a bit on a local world with just myself. The account had a unique, secure password and was secured with TOTP 2FA when I set it up. I recently tried to play the game again but was told I had to login again. Doing so locked my account because it had been used in ways which violated Microsoft's ToS: hacking, phishing or scamming other users. They demanded my telephone number before they'd allow me to use it again. I basically consider this account and the game lost now. I didn't buy this game when it was owned by Microsoft, but will never buy anything from Microsoft which requires me to have an account with them ever again.
- 63 4y ago
  Iirc that's a common occurrence. For some reason Microsoft really wants phone numbers associated with accounts.
- uallo 4y ago
  They did the same thing to an account I used to access Bing Webmaster Tools. Instead of giving them anything, I now actively move friends and family away from Bing. Not that many of them used it in the first place, but now there are none left as far as I know.
- falsenapkin 4y ago
  Yeah that was a frustrating experience. I caved though, but they also didn't like that I was using a phone number already associated with an account that I use for office... I didn't want them to be the same account. Tangent, after giving in to the phone I became more disillusioned with Minecraft as 1) MS appears to have canceled a 3rd installment of music from C418 over licensing issues (C418 wanted rights) and instead got some new artists whose music is good but doesn't fit the nostalgic vibe and seems played more often as well as with regularity in certain scenarios (previously it was fully random) and 2) classic case of S****horpe censoring and bans, applied to inoffensive words, peoples names, other languages, private servers, peoples pre-existing user name, even within commands, etc...
- deleted 4y ago
  [deleted]
NazakiAid 4y ago
I noticed recently I couldn't use my 2FA key to get in to Google, but I never got a notification about it. Don't know when it was removed or why but was annoying getting back in (especially as text verification was a disabled option for some reason), and then setting it back up again.
pifm_guy 4y ago
This 'just to be safe' procedure happens when Google thinks a bad guy is logged into your account. The bad guy might have changed the password, changed the 2fa, stolen login cookies or other malicious things. What Google ought to do is to display a message saying: * Google suspects someone else, or a virus, has access to your account with malicious intent. * Google will help you secure your account. * It is necessary to prove you are the legitimate account owner before we can allow you access to the account. To do this, we will ask for you to log into the account with as many possible devices and methods as possible. Into each device you should type '7867' after logging in. * We ask this because a malicious actor or virus probably will only have control of a few of your devices, passwords or security keys, so we can identify you as the true account holder because you have more. * We will then lock out the malicious actor, and you can change any passwords or security keys they used. If one of your devices was used by a virus, we'll block it until you have reset it.
cute_boi 4y ago
Google have locked my account after I travelled to US. After that day, I have never used Google. Currently, there is no way to access the account. Thank you Google for making my account "Safe".
- Sparyjerry 4y ago
  Phone was stolen while traveling and I needed to log into my account to get my flight information. Google wouldn't let me log in from a new computer even though I don't have 2 factor setup. I had to use my 'recovery e-mail' to confirm an e-mail just to login, and that other e-mail address also required a 'recovery e-mail' to login. Luckily my 3rd e-mail down the line of recovery e-mails was at a website that didn't require a recovery e-mail, e-mail. The steps it took to just log into my account without 2 factor enabled was insane. It was a miracle I was able to do anything at all after having my phone stolen. Edit: note I luckily had memorized all three passwords to the different e-mail addresses or I would have been up a creek.
pxoe 4y ago
google has some of the most inane 'security' measures. one thing it completely doesn't understand is VPNs (despite offering a vpn service itself), failing your login every time you try to enter from a different "location". (despite the device/browser matching, or whatever else there might be.) and "verification option" that is offered is a phone number code, which is offered anyway, even when there's no phone number saved on the account. how is that supposed to work and 'verify' anything (what, can someone having credentials just enter any random phone number to 'verify' and get in?), is unbeknownst to me. it also uses 'additional email address' as a 'verification method' (you could send a code there, or just enter that address), but then again, i don't see how really 'protective' that is, particularly when somebody could just enter anything there. truly, what is the point in that charade, over a regular password. the other thing is how it will not let you add 2fa without setting a phone prompt or phone number first. that is just idiotic. it will refuse to give you this way of security (while it may not be all that great, at least it's definitely something), and pester you for extra emails and numbers. the way that google will seemingly refuse to trust passwords for what they are is just wild and annoying to me. and it seems like it has 'ramped up' its paranoia recently, cause just in the last week, I got forced to change a password on one account over 'suspicious login' (me logging in through the same browser over vpn, and this is while the account has 2fa on), and got a "critical security alert" over a log in from a new browser. "Suspicious attempt to sign in with your password". Yeah, that's just me, google.

403 points by nalllar 4y ago

Hi HN. I posted this here because it seems to be the best way to get someone at google to look at something. To preempt some comments along the lines of "why are you relying on google in 20xx", I try my best not to these days but I still rely on them to forward emails from my old accounts, or for services like youtube where you must have a google account for full features.

yetanotherloser 4y ago
It's undeniably shitty behaviour from the Goo but I'm increasingly getting the message that the only sane attitude is detachment from anything I posted in some past , more naive age. Scribe on vellum or linen rag that which is for the ages, and ignore the rest. If it's on a server I don't even mourn it, I killed it already by putting it there.
- ziml77 4y ago
  That’s how I think about it. What’s the big deal really to lose things from the past? I still have way more of my personal history solidified in in recorded form than people of ages past. They managed just fine, I will too.
  - gpanders 4y ago
    >What’s the big deal really to lose things from the past? Losing pictures of my kids when they were young would be devastating. For some things, it’s a very big deal.
    - tasuki 4y ago
      Sad, sure, but devastating?
      - ergonaught 4y ago
        Yes. Why would it even occur to you to police how someone feels about losing things of immense personal significance?
        CoastalCoder 4y ago
        Not the GP, but it's not necessarily policing. Sometimes readers want to know if you're using hyperbole vs. speaking plainly. Also: HN is a place for discussion and debate. You shouldn't expect any of your claims to be immune from scrutiny.
- hotpotamus 4y ago
  I tend to agree, but you can also run your own servers.
deleted 4y ago
[deleted]

xrayarx 4y ago

Sad story, it is the same with all the newfangled companies: you are a product, not a customer

moloch-hai 4y ago
The joke is on the customers, then, who are treated as badly as users.

nothasan 4y ago

I think Google needs to add a better way to secure old / previously inactive accounts. My guess is because your account was old, and your current device, IP and overall fingerprint was different it decided you were an intruder.

marcinzm 4y ago
Removing pre-existing security measures due to suspicious activity seems an odd strategy.
carbocation 4y ago
This seems inadequate to explain the removal of security keys. Unless Google inferred that OP was not just a garden variety intruder, but some sort of advanced persistent threat that had added such keys long ago?
- nothasan 4y ago
  Yep I don’t know what’s going on here. OP posted another reply with the time they added their keys and they aren't recent.
nalllar 4y ago
I don't know, while this account is old and fairly infrequently used I normally have it in the google account switcher dropdown logged in rather than completely logged out.

pwdisswordfish9 4y ago

Reading stories like these, I’m glad I don’t even have a Google account.

PaulKeeble 4y ago
I remember how promising early Google was, how great Gmail appeared to be. Now the search is barely usable, your account gets nuked because you logged in a minute later than usual and they still don't have any support. Strangely businesses haven't completely abandoned everything to do with them, they clearly don't care about their paying customers let alone the free tier ones.

wkat4242 4y ago

> Removing physical U2F keys from an account without request seems to be the worst possible reaction to suspicious activity. Exactly, unless they were added during the suspicious activity. But this seems to be not the case. I work in cybersecurity and I've seen hackers setting up PINs etc on hijacked Whatsapp accounts just to make it harder for the legit owner to recover it. So if it was a really recent addition it might make sense. If the Yubikey was there for ages it's a really stupid move because it's the one way the real owner can prove themselves.

nalllar 4y ago
The account has had some security keys set up since ~2020, with additional keys added last year.
- nabakin 4y ago
  It could be accounting for the scenario where old keys are stolen. 1. You login with your key 2. Google flags you as suspicious 3. Google removes the keys from the account because the suspicious actor used them to login and could have been stolen
  - nalllar 4y ago
    Makes rather little sense if so, given it's a hardware key. The most likely casees where the key is used to do something that trips this afaict are: * genuine key, user does something fine that trips a heuristic * genuine key, user's device is compromised In either of these cases removing the key is making the account less secure. Google also removed all the keys associated with the account instead of just the key that was used. Having a yubikey physically stolen and also knowing the details to log in with seems like it should be very rare. If they're going to have a process that removes the keys they need to be so confident that they lock the account and go through some sort of IDV process to turn it back on. Removing the keys and leaving you with just a password that you just set up on the device that just logged in using the key is obviously not the right approach if you think the key's compromised because the password's just as compromised.
  - 4y ago

deleted 4y ago

[deleted]

jamest 4y ago

Related, but different, & if there's someone at Google looking at this: There was a Titan Bluetooth Key (for 2FA) Vulnerability, you've said you'll replace the affected keys[1], but you're no longer doing so. Which is frustrating. [1] https://security.googleblog.com/2019/05/titan-keys-update.html https://security.googleblog.com/2019/05/titan-keys-update.ht...

mcint 4y ago
You'll have better luck with a separate post, even if it doesn't hit the front page. I would over-describe the problem, state it in 3 different ways, so some kind soul searching is more likely to find it.

twawaaay 4y ago

Google's implementation does not seem to be doing much good anyway. To be fair, it is not just Google -- most companies feel the same pressure of having to implement MFA but then also make it convenient for clueless users to recover their access. The right way to implement hardware keys is to allow registering multiple of them (so that you can put at least one or two off-site -- in a secure storage) and then not let you recover the access under any circumstances without showing you still own at least one of those keys. If you can recover access without the keys then what is the point of keys in the first place?

carbocation 4y ago
> The right way to implement hardware keys is to allow registering multiple of them Google allows this.
- twawaaay 4y ago
  You missed the second part.
  - carbocation 4y ago
    I see, so you're saying that it's good that Google does the first part, but needs to add the second part. Awareness that Google does the first part wasn't clear from the comment.
    - twawaaay 4y ago
      Any security mechanism is pretty much worthless if it can be trivially circumvented. So yes, the second part is pretty important Actually both parts are important, either is worth little without the other. Having well implemented hardware key is useless if you can't configure more than one -- too much risk having a single piece of hardware that if it fails or you loose it will lock you irrevocably from the account.
    - joshuamorton 4y ago
      It's also possible to do this via advanced protection, it just makes account recovery ~impossible, so you have to explicitly opt in.

tmpburning 4y ago

They probably asked you for your phone number at the same time....

nalllar 4y ago
I did not get asked for a phone number or use SMS 2FA during this process.

fosefx 4y ago

Tangent: Instagram managed to lock me out of their service for a week or so a couple of days ago. My browser was signed in into my account, but I have not used it for like a month. Got logged out. I log back in (using 2FA btw). "Please give us your phone number so we can verify it's you" I enter my phone number. I don't really get the point of this because they did not have my number before, so what are they actually verifying here? Anyway, I trust Facebook with my phone number lol. I get a code, I enter it. "Your account activity is suspicious and we will limit your account for a bit" That was it. No redirect, no link to click, nothing. So I go back to instagram[.]com and have to do the same thing again? Well maybe my browser is on a block list now or sth. So I go to my phone (where I was signed in). And the App is broken completely, looks like the session was invalidated. I log out, log back in, do 2FA, enter the code again. Same result. I checked back in a couple of days ago and it seems like I have access again. It is unfathomable how this can happen. How can the front gate to your multi billion service just not work to the point where you DOS yourself? Also this account has 0 images, and just a couple of followers, so there is literally nothing to protect. In moments like these you really start to notice the missing communication channels to the big tech companies. Is there any other industry that has zero customer support?

unqueued 4y ago
This makes me worried, because I am pretty sure Google is going to start removing keys based on attestation certificates. I believe that this is much more about rate limiting than about security for the end users.
bmitc 4y ago
It seems like most industries are moving towards no support because "we need to scale at all costs and to the detriment of customers" seems to be the capitalism drumbeat. Customers these days, to many companies, are just statistical artifacts in their system. I had a case the other day where I called my insurance company. The automated system couldn't understand my answers (I was actually trying to answer the given prompts rather than just repeating "representative" over and over). It replied "it looks like we're having a problem" and proceeded to just say goodbye and hang up on me. More than infuriating, and that's an understatement.

into_infinity 4y ago

Google generally does stuff like that when they believe somebody else had access to your account and made changes. This sometimes involves the attacker enrolling for (their own) 2FA or changing recovery methods to lock you out. So, the action of removing 2FA is in itself not unreasonable. It's possible that their logic has some sort of a bug, especially if it only happens when you visit a specific service - and in that case, getting on HN might be the best way to get it looked at by a human... but also make sure you don't have any other issues going on.

nalllar 4y ago
Removing security keys that have been registered for years is very unlikely to be the right move even if my device has been compromised, as they are one of the most reliable ways I could prove I am the original account owner at some later point. If the message had stated "We have removed recently added security keys" I would be a lot more understanding!
- lamontcg 4y ago
  If you had your recovery keys stored in a note on lastpass you might have wanted to rotate those as well recently. Yeah, in theory those recovery keys should still be secure, but you know for certain that a hostile attacker has the encrypted secure note, and without any confidence in lastpass it makes sense to change them as well. Unfortunately this means you look exactly like someone doing an account takeover and changing the password and recovery keys on the account.
  - nalllar 4y ago
    Thanks for the heads up. I don't use lastpass, but if I did I wouldn't have to because this "Just to be safe" process also reset/removed the recovery keys.
- ehsankia 4y ago
  > registered for years Right, that's likely the "bug" part. On HN of all places, people shouldn't be surprised that bugs happen.

Shank 4y ago

Were you using a VPN or something? I’m curious if this was tripped by setting off impossible-travel flags or something. It seems plausible that this is just anti-account takeover logic working as-expected, but with a false positive alert.

nalllar 4y ago
Anti-ATO should not clear out security keys that have been registered for a long time. If suspicious new keys were added, it should clear those. From the audit log in my email no new keys were added before this was tripped. I am not using a VPN and as far as I know I am not doing anything unusual. I might be committing the crime of having a Linux Firefox user agent but I somewhat doubt that was the problem, that's not that unusual.
unqueued 4y ago
I was hoping that using hardware keys would eliminate some of the security hoops that we have to jump through. And it does seem to help. But the whole reason that I have a key is so I do not have to supply my phone number, and I have a more trusted way of proving my identity, even if I am connecting from an unusual location.

nonfamous 4y ago

I had a similar experience recently when setting up a new TCF TV for my mother. I didn’t see a “was this you?” email to her Gmail account after logging her in to Android TV, and within hours her password had been invalidated by Google. The message when trying to log in at gmail.com was “Your password has been changed in the last week”, which caused me great concern and an hour or so changing passwords, etc. If the message had said “Google invalidated your password” I’d still have been pissed, but at least not panicked.

tmpburning 4y ago

Google twice removed my password from my Google account... i.e.: I could not login even with the correct password.

kkfx 4y ago

Personally, just to be safe I have ceased to use many "big name" services, preferring for instance to have my mails locally, paying a service (not that much) with a hotline... My personal policy is: if I can't phone them, if I have no local registered office to contact in case of need, if I do not have my data locally in usable forms, that's means is not safe for me going with them.

walton_simons 4y ago
One of my personal rules for life is that wherever possible I avoid businesses which are big enough to have call centres, especially if those call centres are in another country. Obviously that's impossible for a lot of things, but I try. The small local ISP I use, for example, is totally worth the additional cost. I can call them, and there's no "press 6 for support, your call is important to us" nonsense. A couple of rings, and I'm stright through to an expert who has the knowledge and authority to fix my problem right away.

ffhhj 4y ago

》As google has no support channels I can use, my only recourse is to write this blog post and hope someone sees it. By 2030 we will need to build a social network with at least 10k users to get some attention from the Gooverlords.

blacklight 4y ago

Articles like these (which can generally be grouped under the "what the hell is Google doing with my account and my data, and why can't I reach out to a human to get out of this Kafkaesque nightmare?") are popping on HN on a daily basis. I've previously been reported for commenting on a previous article that Google is a faceless company that produces shitty products and it doesn't actually doesn't give a shit of user experience, negative feedback nor deleting/locking accounts (and, often, years of work) for no clear reasons. Somebody responded "on HN we often hear only one side of the story (people getting a negative experience with Google) and not Google's side". So, since many Google employees are also here on HN, I ask you folks: do you have any words to say in defense of these crappy policies? If yes, then I'm happy to change my mind about Google, and eat back all the countless offenses I've thrown at the company over the years if convinced by enough plausible arguments. If no Google employees can come here (or, even better, directly reach out to those impacted by their bad decisions) and defend their policies, then I abide to my words: Google is a shitty company that produces shitty products, it is proud of being a faceless company that doesn't care about supporting users (even though it makes a lot of money out of their data), it makes horrible business decisions, and it leaves people in the dark when locked out of their accounts. Such companies, in a healthy market with enough competition, deserve to rot and fail and be mourned by nobody.

anonuser123456 4y ago
I think your commentary is unfair; they make great business decisions. They realize that the benefit of fucking over a few users here and there is outweighed by the cost of helping them. And people that matter have a back channel via employees or account reps to clear things up.
- blacklight 4y ago
  So in order to get a chance to be heard either you need a backdoor to a Google employee, or you need to be on a business account. Therefore, unless you fall into one of these categories, you probably shouldn't use Google products - or, even worse, rely on it for sensitive things such as your emails, your photos or your work documents.

alphabet9000 4y ago

found a similar error message happening to someone else a year ago with few recourse options: https://support.google.com/accounts/thread/103488375/google-could-not-verify-your-gmail-account?hl=en https://support.google.com/accounts/thread/103488375/google-...

srwx 4y ago

Great so when something like the recent LastPass leak happens and I go in and cycle my password, 2fa and backup codes out of simple precaution Google is going to perhaps mark that all as suspicious and undo it for anyone who might come along and pretend to have lost access to my account?

PaulKeeble 4y ago
Its a surprisingly risky to update your login credentials. Users do it so rarely its perceived as suspicious even when it comes from known IPs and everything else looks healthy. Given its Google if it goes wrong you loose the account completely. Its insane you have to weigh up the potential consequences of doing the right thing for security but that is how Google has set the system up.
- shortcake27 4y ago
  This happened to me on Instagram. I changed my password then logged out to test it. When I tried to log in, I received a generic error. I Googled the message and it appeared to be a “temporary” IP block and people claimed it should work in 24 hours. So I tried the next day, same error. I left it a bit more and came back 3 days later - same error. I then turned on my VPN and was immediately able to log in. So the IP I’ve been using for 2+ years, the one that changed the password, on a known browser, is blocked. But a random IP Instagram has never seen before? No worries!

Animats 4y ago

We need a general solution to reestablishing authentication. The hard-line solution would be that you go to a post office, airport, police station, motor vehicle office, passport office, or bank, they take your fingerprints, picture, and a retinal scan, you get a new ID card and token, and your old ones are invalidated. The US just pushed the date for REAL ID enforcement further out, again. This time from spring 2023 to 2025.[1] REAL ID terrifies illegal aliens. Once everyone legal in the US has one, getting a job or traveling will be much harder. [1] https://www.cnn.com/travel/article/dhs-real-id-deadline-extended/index.html https://www.cnn.com/travel/article/dhs-real-id-deadline-exte...

SoftTalker 4y ago
It's already illegal to hire illegal aliens. Why will REAL ID change anything in that regard? Employers who disregard the law now will continue to disregard the law.
- lmm 4y ago
  > It's already illegal to hire illegal aliens. Why will REAL ID change anything in that regard? It's hard to enforce that when there's no easy way to prove someone isn't in the country legally.
  - sokoloff 4y ago
    How does Real ID help prove that someone who doesn’t have one isn’t here legally? I am here legally and renewed my license since my state offered Real ID. I still got the old “Not for Federal ID” license. If I show that to someone, does that somehow prove I’m not here legally?
    - lmm 4y ago
      If you represent an expired or otherwise invalidated license as legitimate proof of ID then that's fraud. I'm sure a sufficiently dedicated citizen can find a way to pretend to be here illegally, but as long as you're not going to mix up a reasonable law-abiding citizen with an illegal immigrant you can arrest them and sort it out afterwards.

yborg 4y ago

Google support bot requires HN Google account nightmare stories to reach 1000 points or be posted by paulg before they are addressed. (FWIW I addes YUbikeys to 2 old long-term Google accounts about 6 months ago and they are still there. I did do this from the home location I usually use Google from, though.)

nalllar 4y ago
Unfortunately for my hopes of getting this fixed, this post started getting flagged after it sat at the number 1 spot earlier today, or maybe Dang bumped it down because there are too many google support posts. :P
deleted 4y ago
[deleted]

proactivesvcs 4y ago

February this year I migrated my Mojang (Minecraft) account to a Microsoft Account, which I created solely for this use. I played a bit on a local world with just myself. The account had a unique, secure password and was secured with TOTP 2FA when I set it up. I recently tried to play the game again but was told I had to login again. Doing so locked my account because it had been used in ways which violated Microsoft's ToS: hacking, phishing or scamming other users. They demanded my telephone number before they'd allow me to use it again. I basically consider this account and the game lost now. I didn't buy this game when it was owned by Microsoft, but will never buy anything from Microsoft which requires me to have an account with them ever again.

63 4y ago
Iirc that's a common occurrence. For some reason Microsoft really wants phone numbers associated with accounts.
uallo 4y ago
They did the same thing to an account I used to access Bing Webmaster Tools. Instead of giving them anything, I now actively move friends and family away from Bing. Not that many of them used it in the first place, but now there are none left as far as I know.
falsenapkin 4y ago
Yeah that was a frustrating experience. I caved though, but they also didn't like that I was using a phone number already associated with an account that I use for office... I didn't want them to be the same account. Tangent, after giving in to the phone I became more disillusioned with Minecraft as 1) MS appears to have canceled a 3rd installment of music from C418 over licensing issues (C418 wanted rights) and instead got some new artists whose music is good but doesn't fit the nostalgic vibe and seems played more often as well as with regularity in certain scenarios (previously it was fully random) and 2) classic case of S****horpe censoring and bans, applied to inoffensive words, peoples names, other languages, private servers, peoples pre-existing user name, even within commands, etc...
deleted 4y ago
[deleted]

NazakiAid 4y ago

I noticed recently I couldn't use my 2FA key to get in to Google, but I never got a notification about it. Don't know when it was removed or why but was annoying getting back in (especially as text verification was a disabled option for some reason), and then setting it back up again.

pifm_guy 4y ago

This 'just to be safe' procedure happens when Google thinks a bad guy is logged into your account. The bad guy might have changed the password, changed the 2fa, stolen login cookies or other malicious things. What Google ought to do is to display a message saying: * Google suspects someone else, or a virus, has access to your account with malicious intent. * Google will help you secure your account. * It is necessary to prove you are the legitimate account owner before we can allow you access to the account. To do this, we will ask for you to log into the account with as many possible devices and methods as possible. Into each device you should type '7867' after logging in. * We ask this because a malicious actor or virus probably will only have control of a few of your devices, passwords or security keys, so we can identify you as the true account holder because you have more. * We will then lock out the malicious actor, and you can change any passwords or security keys they used. If one of your devices was used by a virus, we'll block it until you have reset it.

cute_boi 4y ago

Google have locked my account after I travelled to US. After that day, I have never used Google. Currently, there is no way to access the account. Thank you Google for making my account "Safe".

Sparyjerry 4y ago
Phone was stolen while traveling and I needed to log into my account to get my flight information. Google wouldn't let me log in from a new computer even though I don't have 2 factor setup. I had to use my 'recovery e-mail' to confirm an e-mail just to login, and that other e-mail address also required a 'recovery e-mail' to login. Luckily my 3rd e-mail down the line of recovery e-mails was at a website that didn't require a recovery e-mail, e-mail. The steps it took to just log into my account without 2 factor enabled was insane. It was a miracle I was able to do anything at all after having my phone stolen. Edit: note I luckily had memorized all three passwords to the different e-mail addresses or I would have been up a creek.

pxoe 4y ago

google has some of the most inane 'security' measures. one thing it completely doesn't understand is VPNs (despite offering a vpn service itself), failing your login every time you try to enter from a different "location". (despite the device/browser matching, or whatever else there might be.) and "verification option" that is offered is a phone number code, which is offered anyway, even when there's no phone number saved on the account. how is that supposed to work and 'verify' anything (what, can someone having credentials just enter any random phone number to 'verify' and get in?), is unbeknownst to me. it also uses 'additional email address' as a 'verification method' (you could send a code there, or just enter that address), but then again, i don't see how really 'protective' that is, particularly when somebody could just enter anything there. truly, what is the point in that charade, over a regular password. the other thing is how it will not let you add 2fa without setting a phone prompt or phone number first. that is just idiotic. it will refuse to give you this way of security (while it may not be all that great, at least it's definitely something), and pester you for extra emails and numbers. the way that google will seemingly refuse to trust passwords for what they are is just wild and annoying to me. and it seems like it has 'ramped up' its paranoia recently, cause just in the last week, I got forced to change a password on one account over 'suspicious login' (me logging in through the same browser over vpn, and this is while the account has 2fa on), and got a "critical security alert" over a log in from a new browser. "Suspicious attempt to sign in with your password". Yeah, that's just me, google.