3 ms·

I am not the poster you replied to, but I’ve dealt with this in various forms. For a number of close family members Google has variously refused to accept vali

I am not the poster you replied to, but I’ve dealt with this in various forms. For a number of close family members Google has variously refused to accept valid recovery emails, valid recovery codes, and valid backup phone numbers in order to regain account access. Despite how ridiculous it is from a consistency and security perspective, your MFA- or backup contact- enrolled phone number with SMS is still essentially Google’s gold standard for determining rightful access to an account. Their auth and password reset processes are constantly changing and they have several steps that are automatically adaptive. The only foolproof ways I’m aware of to always retain access to your Google account is to enroll in Advanced Protection, and/or to use a paid Google Workspace account.

throwaway290 3y ago
Recovery codes saved my ass a few times though. Advanced protection is a good pointer. Seems like losing the hardware token device can be a disaster? On the other hand giving a service money is dangerous. They would be making money from you which means stricter checks. I'm still semi banned on Github because they had my card with Russian billing address (for sponsoring) when Putler attacked Ukraine. Good I didn't pay for anything Google.
- jefftk 3y ago
  > Seems like losing the hardware token device can be a disaster? If you only have one, yes. But I'd recommend: * Get three tokens * Keep one on you, one at home, and one somewhere else * Maintain a list of every site you've registered your tokens with. * If you lose a token, or one breaks, unenroll it from all those sites, get a new token, and enroll the new token. Do this urgently.
karlshea 3y ago
I have a paid Workspace account and I can’t view my payment information on the non-Workspace accounts site because they can’t “verify it’s me”. This is with 2FA and a passkey, and multiple logged in devices. There’s a lot of idiocy going on there, I wouldn’t trust them with a single thing for any reason whatsoever.

throwaway290 3y ago

Recovery codes saved my ass a few times though. Advanced protection is a good pointer. Seems like losing the hardware token device can be a disaster? On the other hand giving a service money is dangerous. They would be making money from you which means stricter checks. I'm still semi banned on Github because they had my card with Russian billing address (for sponsoring) when Putler attacked Ukraine. Good I didn't pay for anything Google.

jefftk 3y ago
> Seems like losing the hardware token device can be a disaster? If you only have one, yes. But I'd recommend: * Get three tokens * Keep one on you, one at home, and one somewhere else * Maintain a list of every site you've registered your tokens with. * If you lose a token, or one breaks, unenroll it from all those sites, get a new token, and enroll the new token. Do this urgently.

karlshea 3y ago

I have a paid Workspace account and I can’t view my payment information on the non-Workspace accounts site because they can’t “verify it’s me”. This is with 2FA and a passkey, and multiple logged in devices. There’s a lot of idiocy going on there, I wouldn’t trust them with a single thing for any reason whatsoever.