4 ms·

I do have the backup codes, though I read an anecdote from someone where Google refused to accept the backup code. Because of course they can do that. Email is

I do have the backup codes, though I read an anecdote from someone where Google refused to accept the backup code. Because of course they can do that. Email is just so sticky, it is really hard to make the switch, but I know that it just takes some butterfly wings to upset the blackbox.

maccard 3y ago
Can you share that anecdote? That seems absolutely wild to me and I've never even heard it suggested before your post
- TheNewsIsHere 3y ago
  I am not the poster you replied to, but I’ve dealt with this in various forms. For a number of close family members Google has variously refused to accept valid recovery emails, valid recovery codes, and valid backup phone numbers in order to regain account access. Despite how ridiculous it is from a consistency and security perspective, your MFA- or backup contact- enrolled phone number with SMS is still essentially Google’s gold standard for determining rightful access to an account. Their auth and password reset processes are constantly changing and they have several steps that are automatically adaptive. The only foolproof ways I’m aware of to always retain access to your Google account is to enroll in Advanced Protection, and/or to use a paid Google Workspace account.
  - throwaway290 3y ago
    Recovery codes saved my ass a few times though. Advanced protection is a good pointer. Seems like losing the hardware token device can be a disaster? On the other hand giving a service money is dangerous. They would be making money from you which means stricter checks. I'm still semi banned on Github because they had my card with Russian billing address (for sponsoring) when Putler attacked Ukraine. Good I didn't pay for anything Google.
    - jefftk 3y ago
      > Seems like losing the hardware token device can be a disaster? If you only have one, yes. But I'd recommend: * Get three tokens * Keep one on you, one at home, and one somewhere else * Maintain a list of every site you've registered your tokens with. * If you lose a token, or one breaks, unenroll it from all those sites, get a new token, and enroll the new token. Do this urgently.
  - karlshea 3y ago
    I have a paid Workspace account and I can’t view my payment information on the non-Workspace accounts site because they can’t “verify it’s me”. This is with 2FA and a passkey, and multiple logged in devices. There’s a lot of idiocy going on there, I wouldn’t trust them with a single thing for any reason whatsoever.
- numpad0 3y ago
  ref: https://news.ycombinator.com/item?id=34441697 https://news.ycombinator.com/item?id=34441697
Timshel 3y ago
For email best process: - buy a domain name to never have the same issue - select a new service - setup forward from gmail to the new service. - start using new mail - wait multiple years and Tadaa ^^ Bonus: if you loose access the forward will continue :).
idontwantthis 3y ago
Google refused all of mine the time I dropped my phone away from home.

maccard 3y ago

Can you share that anecdote? That seems absolutely wild to me and I've never even heard it suggested before your post

TheNewsIsHere 3y ago
I am not the poster you replied to, but I’ve dealt with this in various forms. For a number of close family members Google has variously refused to accept valid recovery emails, valid recovery codes, and valid backup phone numbers in order to regain account access. Despite how ridiculous it is from a consistency and security perspective, your MFA- or backup contact- enrolled phone number with SMS is still essentially Google’s gold standard for determining rightful access to an account. Their auth and password reset processes are constantly changing and they have several steps that are automatically adaptive. The only foolproof ways I’m aware of to always retain access to your Google account is to enroll in Advanced Protection, and/or to use a paid Google Workspace account.
- throwaway290 3y ago
  Recovery codes saved my ass a few times though. Advanced protection is a good pointer. Seems like losing the hardware token device can be a disaster? On the other hand giving a service money is dangerous. They would be making money from you which means stricter checks. I'm still semi banned on Github because they had my card with Russian billing address (for sponsoring) when Putler attacked Ukraine. Good I didn't pay for anything Google.
  - jefftk 3y ago
    > Seems like losing the hardware token device can be a disaster? If you only have one, yes. But I'd recommend: * Get three tokens * Keep one on you, one at home, and one somewhere else * Maintain a list of every site you've registered your tokens with. * If you lose a token, or one breaks, unenroll it from all those sites, get a new token, and enroll the new token. Do this urgently.
- karlshea 3y ago
  I have a paid Workspace account and I can’t view my payment information on the non-Workspace accounts site because they can’t “verify it’s me”. This is with 2FA and a passkey, and multiple logged in devices. There’s a lot of idiocy going on there, I wouldn’t trust them with a single thing for any reason whatsoever.
numpad0 3y ago
ref: https://news.ycombinator.com/item?id=34441697 https://news.ycombinator.com/item?id=34441697

Timshel 3y ago

For email best process: - buy a domain name to never have the same issue - select a new service - setup forward from gmail to the new service. - start using new mail - wait multiple years and Tadaa ^^ Bonus: if you loose access the forward will continue :).

idontwantthis 3y ago

Google refused all of mine the time I dropped my phone away from home.