3 ms·

The account has had some security keys set up since ~2020, with additional keys added last year.

• nabakin 4y ago
  It could be accounting for the scenario where old keys are stolen. 1. You login with your key 2. Google flags you as suspicious 3. Google removes the keys from the account because the suspicious actor used them to login and could have been stolen
  • nalllar 4y ago
    Makes rather little sense if so, given it's a hardware key. The most likely casees where the key is used to do something that trips this afaict are: * genuine key, user does something fine that trips a heuristic * genuine key, user's device is compromised In either of these cases removing the key is making the account less secure. Google also removed all the keys associated with the account instead of just the key that was used. Having a yubikey physically stolen and also knowing the details to log in with seems like it should be very rare. If they're going to have a process that removes the keys they need to be so confident that they lock the account and go through some sort of IDV process to turn it back on. Removing the keys and leaving you with just a password that you just set up on the device that just logged in using the key is obviously not the right approach if you think the key's compromised because the password's just as compromised.
  • yencabulator 4y ago
    If the attacker has password+security key(+its PIN), what help is dropping the security level to just password -- the attacker has that too.
    • nabakin 4y ago
      The password is reset so they wouldn't have it