by caseyf7 on 1/23/22, 10:15 PM with 774 comments
You’re trying to sign in on a device Google doesn’t recognize, and we don’t have enough information to verify that it’s you. For your protection, you can’t sign in here right now. Try again from a device or location where you’ve signed in before.
Even if I get the code from the recovery email account, it won't work. Is this the AI hell Google throws you into if you get a new phone and computer in the same year? Has anyone else on HN run into this and found a solution?
by steelframe on 1/24/22, 3:53 AM
I returned to Austin to visit old friends and took the opportunity to visit the Google office there. The Googlers sitting around me were primarily corporate sales.
They weren't getting any corporate sales calls at all as far as I could tell, but there was one extremely irate user who was locked out of their GMail account and was repeatedly calling them because they were the only human beings at Google the user was able to get in touch with, via something like "Press 3 for Corporate Sales." Of course these poor Google corporate sales people had absolutely no way to help this user even if they wanted to. Google literally did not have any GMail account phone support (at least at the time).
I could hear the poor guy screaming through their headsets about how he paid Google something for some service and was entitled to phone support and he demanded someone help him, but they just kept saying, "This is corporate sales. We do not offer consumer account support. If you want support, please visit the Google Support Forums at www dot..."
After they hung up on him 3 or 4 times, eventually a manager got on the phone and told him (between his screams), "Look, you're not getting any phone support because it doesn't exist. There's nowhere for us to transfer you. There's nobody who can call you back about this. Your only option is to search the forums for an answer to your problem. I am going to terminate this call now. Sir, I'm going to terminate this call. No, we can't help you. Nobody at Google can help you. I am terminating this call now. We asked you to stop calling this number. Do not call us again. <click>"
I'd frequently tell my co-workers, "If you're not paying for it, you're the product." That experience underscored that notion for me.
by parhamn on 1/23/22, 11:02 PM
If you're not on a whitelisted browser by Google, you can't log in (effectively, use) any of their properties.
This feels very anti-competitive to me. Notably all the whitelisted browsers are either theirs (Chrome) or sell them their search traffic. I'm building a browser for research [2] and have to frequently find workarounds. I'm not quite sure who I'd contact to get on said whitelist either...
[1] https://imgur.com/a/DASVkhl (here is the issue in the Vim browser and Min browser)
by Andrew_nenakhov on 1/23/22, 10:44 PM
Then, I gave up, moved all my services to another email account, and after 2 or 3 months tried logging in, and it suddenly allowed me to log in.
Needless to say, I will never again use gmail for critically important things.
by anter on 1/23/22, 10:51 PM
Just says "you can’t sign in" and that's it: https://i.imgur.com/4YrElkJ.png
by jscheel on 1/24/22, 3:07 AM
by supermatou on 1/23/22, 11:09 PM
> have three gmail accounts
> primary, name.surname@gmail.com
> secondary, name.surname.purchases@gmail.com
> tertiary, name.surname.work@gmail.com
> secondary and tertiary have primary as a recovery address
> log in/out once a week in 2nd and 3rd
> last August, try to log into name.surname.work
> "Password is incorrect"
> WTH?! of course it's correct.
> try several times, Google blocks me ("temporarily")
> next day, try again, no dice.
> OK, the hell with this: let's reset the password
> "what's the last password you remember?" duh, the last and only password is the one I already gave you, you stupid machine.
> "we need additional verification; input the recovery address" Finally! type my main address
> mail from Google arrives pronto, code in it
> type code in verification field
> new mail from Google: "Thank you for verifying your mail address" [my primary one?!] Based on the information provided, we cannot ascertain that [tertiary account] belongs to you"
This has been happening since. A few weeks ago, secondary account went down too, yielding the same error OP got.
Note: a) I have been using the same IP and the same machine to log into those accounts for many years; there is no other device or location where I've signed in before! b) primary account has multiple (4) Yubikeys associated with it, so it should be clear I'm a real person and not a bot.
I'm currently in panic mode: if my main account goes down, it will take a huge part of my life with it, from banks to government stuff.
by armchairhacker on 1/23/22, 11:05 PM
Not defending the practice at all. It shows we as a society and Google in particular need better security if they are flat-out locking people out of their Gmail accounts and others are still being compromised (I know they are). I honestly support Google forcing people to use recovery addresses and 2-factor authentication but I don't support them making the recovery authentication not work and providing literally no options for a legitimate user.
I think the best you can do right now is complain on HN and Twitter and you'll probably get your account back. In the future, maybe if you have a YubiKey or stronger form of 2FA Google won't lock you out, because obviously if someone can authenticate with a YubiKey they are practically guaranteed to be the real person.
by jacekm on 1/23/22, 11:14 PM
* log into other gmail account (with a long history) using Chrome without any addons, log out and then immediately try logging into the primary account (ideally google should ask you if you want to add another account)
* log in from the same location. I once spent two years abroad, and could not log in to one of my accounts. I regained access only after returning to my home country
* if you are working in an organization that owns an IP range, try logging in from work, i.e. do not use publicly available ISP.
You'll get best results if you can combine two or more of these points. Unfortunately even following this advice you are not guaranteed to be successful...
For the future reference, the only prevention that I know which works 100% times is using YubiKey for 2FA. 2FA with TOTP codes often helps unlocking the account, but I had cases where even the codes did not help.
by AshamedCaptain on 1/23/22, 11:07 PM
A couple hours later my account was blocked due to "suspicious login(s)" (i.e. mine), and the order I placed cancelled. They had me wait 24h until I could contact someone at support that could unblock it. He told he was going to disable 2FA (?) and send me a code that I could use to change my password.
The code was sent via SMS.
They think that someone who has just my SIM card (or a clone, FFS) is more trustworthy than someone who has my password, 2FA token, and email address.
These companies take user security as a joke, or as pure theater.
by moralestapia on 1/24/22, 1:35 AM
Most accurate search engine is now almost useless even for VERBATIM queries; queries that took milliseconds earlier (they even built a product around that, Google Instant), now take 2-3 seconds on average.
Best email service, now feels clunky and slow plus the spam algorithm not only stopped working, but is now working backwards.
Everything just worked and it was simple to grasp and to work with, now we have issues everywhere with their draconian 2FA among other "wise" decisions in the name of "security".
All this while on Android, basic stuff like calling 911 so you don't die is not possible because of all the other "features" they keep adding to the platform, see: https://news.ycombinator.com/item?id=29492884
by exolymph on 1/23/22, 10:41 PM
Personally, I'm still happy with Fastmail, which uses customer subscriptions fees to fund a professional support department, as well as contributing to email-related FOSS. (Among other things, obviously.)
by alanh on 1/24/22, 12:57 AM
https://tech.slashdot.org/story/11/12/18/2046221/why-google-...
by js2 on 1/23/22, 11:30 PM
Yup, I've got an old gmail account that Google won't let me into. First I get:
"This device isn’t recognized. For your security, Google wants to make sure it’s really you."
With options for "Confirm your recovery email" and "Get a verification code at <elided recovery email>."
Regardless of which I choose, it then asks me for a phone # for an SMS code. So I give it one, just to get:
"Unavailable because of too many failed attempts. Try again in a few hours."
Except, "a few hours" is a lie. I last tried this weeks ago. I get a "Try another way" option which prompts me "Enter the last password you remember using with this Google Account." at which point I'm at a dead end because this account only ever had one password.
The best part is that shortly after going through this exercise I get an email to the recovery address:
"Sign-in attempt was blocked. Someone just used your password to try to sign in to your account. Google blocked them, but you should check what happened."
With a "Check Activity" button that takes me right back to the Google sign page...
Buttle? Tuttle?
The irony in all of this is that I'd forgotten about the account until Google sent an "new terms of service" email to the recovery email address and decided I wanted to close the account. But I can't login to do so.
Anyway, I switched my primary email away to Fastmail years ago and I'm still happy with that decision.
by voisin on 1/23/22, 11:25 PM
by sercand on 1/24/22, 6:30 AM
I understand that you are referring to an incorrect LinkedIn profile which is visible under your business profile in Google. Please be informed that information from social profiles are collected by automated algorithms.
There's no way to manually remove these social profiles from our end. This is something which is driven by Google’s algorithm, based on the visibility, ranking, web presence, etc. of the particular business page. We at Google do not have any manual control over this.
by dfdz on 1/23/22, 11:12 PM
https://landing.google.com/advancedprotection/
When you login you are required to use a security key (like Yubi key) but it removes all the annoying emails and texts with codes, IP filtering, login AI, etc
by dTal on 1/24/22, 1:22 AM
by pkulak on 1/24/22, 12:41 AM
by ncann on 1/23/22, 10:38 PM
by Frost1x on 1/24/22, 3:45 AM
Ha! We have to wait 24 hours after wrestling through the page, I leave my holiday visit in 36 hours, that's fine we have time I say to myself. A little odd but whatever, the account itself has no payment or important data associated with it really. 24 hours pass and the recovery page then suggests 14 days for recovery. What?!?! Why!?! (I mean, I get why, sort of, but I've done highly secure work that has less/shorter security processes than a consumer phone account). Apple says there's nothing they can do.
That's fine, well just create a new email and account for them I say to myself for their iPad annoying and yet another account for them to remember, lose the password, and deal with but whatever. Ok new email, new Apple account, sign in and perfect. Now I just need to disassociate the phone with the account its locked out of and switch it to the new Apple account to make syncing things a bit easier between devices. Wait, I can't do this until I recover the account to sign in to then log out of in the device. Wow. Again, I understand the security model here, but wow, a consumer device? Insanity.
by NoPie on 1/23/22, 10:40 PM
If I happened to forget/lose all passwords (lost laptop, burned house etc.), I would probably need to deal with the hosting company who would try to identify me with my credit card or some other way (phone number, mailing a letter to my physical address on file). Nothing is absolutely secure but I think it is secure enough for me while I also have fair good chances to recover my lost access. I am not a big target to scammers anyway.
by harshalizee on 1/23/22, 11:29 PM
Years ago, I had my account suspended when I was implementing an Adsense integration into a site for no discernible reason. I have too many ancient financial institution's login tied up to my primary email. That was the last time I signed up for anything related to Google. At my workplace, I'm a strong advocate against the Google ecosystem. A few of us fought hard to keep our cloud systems away from Google and move to Azure. I've seen similar sentiments from quite a few devs in the last few years.
by mekoka on 1/24/22, 1:33 AM
It can get even worse if you provide a phone number for "added security" and find yourself in a different country with a different phone. I've witnessed a few fellow travelers getting locked out of accounts because they couldn't access the SMS sent to their home phone number and the app was ignoring the code sent via email. Yahoo, Amazon, Gmail. I've even seen someone unable to use their Airbnb account for this very reason, which is odd considering that the service caters to travelers (that was 6 years ago, so maybe things have changed).
If you travel and change phone numbers often, avoid giving it for security if you can.
by mrslave on 1/23/22, 11:06 PM
Anti-patterns in registration are annoying too. A recent example from Twitter: "sign up with phone or email" (defaults to phone); click email (colleague insists on only using phone for work); register with email only. 2 minutes later: "give us your phone number to unlock your account." Crazy.
by enobrev on 1/24/22, 12:53 AM
Except I bought the tickets through an app and now I didn't have that app. Nor did I know the password, because I use a pw manager. The person at the booth said I could use the confirmation email, so I tried on my wife's phone. It wouldn't let me log in to gmail from her phone no matter what I tried.
Different browsers, desktop mode, etc. There was no getting in. We were about to miss the start of the movie so I just went ahead and bought two more tickets and got a refund later.
by golem14 on 1/23/22, 10:48 PM
I'd also suggest not to rely on a phone number as 2nd factor, it's not that super safe.
by greatgib on 1/24/22, 5:29 AM
This is really annoying. Sometimes I have to join corporate meeting from my personal email account on my personal phone, because if I would like to login with my pro one, all my personal phone will be associated and controllable by the company.
by _tom_ on 1/23/22, 11:18 PM
Google used it, verified it, then said it wasn't enough, and there went an email account I had used for years.
No way to recover.
by C4K3 on 1/23/22, 11:39 PM
by IvanK_net on 1/24/22, 12:12 AM
There are billions of people creating various accounts. Hundreds of thousands of them had a weak password, or told their password to someone, etc, and their data leaked. There were so many news about "data leaks" and "security issues" in the past 20 years, and each time, a company was blamed, never a user.
We even made laws, where letting people log in with only a password can be illegal.
by davemtl on 1/23/22, 10:52 PM
Offline backups is a must at this point.
by aesyondu on 1/24/22, 6:46 AM
It would never happen of course, but it would be interesting.
by kmetan on 1/23/22, 11:00 PM
1) dont try to login couple of weeks (this was recommended on multiple boards)
2) try again with the recovery email
My problem was a) I didn't log in during the previous 12 months b) I moved to another country.
Only when I connected via vpn to the country of my previous residence, I got in. Took me more then 4 months to figure this out...
by missingcolours on 1/24/22, 1:23 AM
The one that I run into sometimes: in order to do "Find My Phone" for my wife's phone, I try to sign in as her. In order to 2FA authenticate, I need to press yes on her (lost) phone, or answer a phone call or text on her (lost) phone. What exactly is the point of a find phone feature that requires you to have the phone?
Apple doesn't have this issue BTW; they have some 2FA stuff but Find My iPhone is excluded so you can use it if your phone is missing.
by 2bitencryption on 1/23/22, 10:49 PM
Imagine the insanity if the email account that received the code in turn asks for a code sent a code to the first one.
by newsbinator on 1/23/22, 10:36 PM
by blibble on 1/23/22, 10:50 PM
I only managed to solve it by digging out an old phone that was still signed into the Google account... if I had factory reset that then I suspect I would have lost it forever
this experience is one of the many reasons I've dumped Google wherever possible
by foxfluff on 1/24/22, 9:51 AM
I don't believe I've ever had passwords compromised. The only time I know I had malware was when I was a kid and installed a runescape autominer.. I've had some close calls with software vulnerabilities (I patched opensmtpd mere hours before bots started attacking it), but that's rare. haveibeenpwned only shows involvement in the last.fm compromise, which is a no biggie since I wasn't 1) using the service any more 2) using the same password with other services 3) using that email address with anything worth caring about.
By contrast, I've been burned by service providers blocking me many many times. They call this security but how is the equivalent of "we decided to take all your mail and not deliver it to you, and changed the locks to your apartment so nobody can get in" security? It's security in the same sense as "we decided to burn all your money so nobody can steal it, hope you're happy."
As a consequence, I've tried to cut out as many services and third parties out of my life as I can. It's an uphill fight though, and most services are hell bent on adding points of failure. E.g. where my bank before supported OTPs (in addition to login & password), now they require a phone too. It's probably not a matter of if but when I get bitten by this; I've had a Samsung Xcover physically break.
I think any notion of security should include secure access for the relevant party. If you can't access your stuff, security has failed (unless it can be demonstrated that there was an active attack going on and the only way to prevent it was to block everyone.. which these overzealous blocking systems in place can't demonstrate).
by dynamohk on 1/23/22, 11:25 PM
by gitowiec on 1/23/22, 10:53 PM
by throwaway55852 on 1/24/22, 10:18 AM
My situation was somewhat different. I had a rarely-used account with no recovery email/phone. When I entered the password correctly using a web browser, I was asked to provide a (new) phone number so I could be sent a verification code before continuing. I didn't want to provide a phone number, so I tried to log in with that account during the initial setup of a freshly-reset Android phone and it worked (allowing me to add a recovery email).
I'm curious if this strategy helps in your case. (You mentioned getting a new phone, but I assume you are signing in on that phone after it has been set up, which may be different to signing in during the initial setup.)
By the way, in your reply to a comment on 2-factor authentication (https://news.ycombinator.com/item?id=30051366) you said you had a recovery account. There is a difference between enabling Google's "2-Step Verification" and having a plain recovery email/phone (though from other comments it sounds like you can get locked out even with 2FA, and not all 2FA methods are equal).
P.S. If you want to allow people to contact you privately, consider adding some contact details to your HN profile.
by kvhdude on 1/24/22, 1:05 AM
by WithinReason on 1/23/22, 11:24 PM
I recommend ProtonMail, you can set emails to autodelete after X time so you never fill your quota.
by CRConrad on 1/24/22, 6:55 PM
1) Log in on everything now and then (hm, maybe gotta so that myself soon); and perhaps even more important,
2) When getting a new device / phone number / email address, log in to everything from the new one before getting rid of the old one. That way, you can jump back to the old and confirm the validity of the new. Then set up the new phone number for 2FA / email as your backup address / recognised login device... Only then can you dispose of the old.
by einpoklum on 1/23/22, 11:04 PM
Long-term solution: Stop using Google. Why? Not just because of this type of shenanigans, but because Google spies on you:
* It keeps a copy of all of your correspondence, even if you delete it.
* (Rephrased) The US National Security Agency (NSA) has gotten access to much of your correspondence, by tapping links between Google's data center; it may still have such access today and Google's extent of collaboration with this is not known for certain (to me anyway).
* It uses your correspondence and other information about you allow commercial companies to manipulate you with advertisement.
(The NSA part was verified by Edward Snowden's revelations, several years back; see: https://www.washingtonpost.com/world/national-security/nsa-i... for example)
Now, no third-party mail service is perfectly safe; but you should want one which is at least somewhat-safe, and that doesn't treat you unfairly.
I won't make specific recommendations, but I've personally had decent experience with ProtonMail (Switzerland) and gmx.com (Germany).
by exodust on 1/24/22, 6:08 AM
I had correct password AND correct secret answer to my own secret question I set years ago, but was denied entry because of new device, or time sine last login or whatever.
The explanation it gave made no sense, sending me in circles with no recourse. So I decided enough is enough. Their system is broken. When a user has both password and secret answer, there is no reason to deny them at that point. Good riddance Gmail.
by gue7890dfg on 1/24/22, 6:57 AM
It is impossible to have anonymous reliable email accounts nowadays.
Today a lot of data are collected. For those data to have any value they need to be quality data, so that they can be used. Many would think for AI, but what is more lucrative maybe is to sell them or services based on them to government intelligence in USA. Similarly, maybe government is also putting pressure that accounts of big providers are not mass used or hacked by adversaries. Google may have some hidden deals.
Starting with Facebook, Google, Microsoft as the biggest ones, you are forced by all means to have non-anonymous accounts. Google accounts measures point to one direction: tell them your identity. Make sure you are in that location, no VPN, tell them you phone number when you register an account, etc, so they know it is you for sure.
This makes it impossible to use Google, etc, anonymously. It is impossible to open any Google account, as I do not want to drop my VPN, or give them a phone number. I also have 2-3 accounts of Google open many years before, when these restriction were not so bad in place. I was relying on them for various things. I assume since a while, that I will loose access to those any moment and I am not using those much anymore.
by hsbauauvhabzb on 1/24/22, 2:25 AM
by throwhauser on 1/23/22, 10:59 PM
by pettycashstash2 on 1/23/22, 10:23 PM
by osrec on 1/24/22, 4:36 AM
It should be easier, much much easier. Then we can all stop relying on external providers for substandard email services.
by iszomer on 1/24/22, 5:49 AM
At least Google doesn't recycle usernames unlike other services and account retention is trivially automatic if you use an Android phone.
by anshumankmr on 1/24/22, 7:48 AM
*The script I wrote is a variation on the one I wrote while working at my company (where we use AppScript to sync some sync data to Firebase... the same issue never occurred for me while using my company's account)
by wruza on 1/24/22, 12:27 PM
Less reliable way: log out of all google, login to all of your “best” accounts, then login to this one. When you are logged in and google knows they were logged in at the same time before, restrictions get relaxed (there is sort of a “skip security” button, or a similar setup).
by grammarnazzzi on 1/23/22, 11:09 PM
Reailize that what you call "security" isn't there to protect you. It protects Google's interests. Google wants to minimize the risk of hackers compromising any google service; and if doing so might destroy your livelihood, well, that's a risk Google is willing to take.
by windex on 1/24/22, 2:55 AM
by Minor49er on 1/23/22, 11:34 PM
The biggest issue that I have is that I have an email account through my web hosting provider that isn't connected to Google. If I email anyone with a Gmail address, it gets rejected for being potential spam, despite not having any links or anything. Even if I respond to someone writing from a Gmail address, Google will reject it, saying that it was unsolicited since I was the one initiating the conversation, which is simply ridiculous. I usually end up logging into a separate Gmail account just to communicate with those users.
by SMVS on 1/24/22, 7:50 AM
I'd set inactive account recovery, so if I died my brother would get access six months later. That didn't happen either. Google is a joke.
by alyandon on 1/24/22, 12:43 AM
So Google knew the following:
1) I have the correct password to the Google account
2) The recovery email address is valid and the code I entered matched
by tptacek on 1/23/22, 10:48 PM
by ajdoingnothing on 1/23/22, 10:54 PM
by tpoacher on 1/23/22, 11:07 PM
My main account gave me a similar message to yours; the only option was to approve this location via a link sent to my "nominated backup email".
Which, also refused to let me in for exactly the same reason. *facepalm*
by pllbnk on 1/24/22, 8:46 AM
What's funny is I have another account to which the Gmail of the said locked account is connected, so I can send and receive emails by the locked account, but I cannot use it for any other purpose. It has been the trigger due to which I had switched my primary email to my own personal domain and a better service provider for a few bucks a month. It's painful and I'm still in progress of transferring all communications to the new domain, however it's totally worth it because I have a sense of actual control.
by 4cao on 1/24/22, 12:45 PM
I moved away from Gmail for most of my mail a while ago for privacy reasons, and in anticipation that something like this would happen eventually.
Not much later, I was locked out of a Gmail account I had for an extensively long time (created back when Gmail was still in beta and by invitation only).
I know the password, I know the recovery e-mail address, and have access to the recovery account, yet I'm not allowed to access the Gmail account or recover the password regardless. Go figure.
The account was used mainly for all kinds of registrations where I expected I might end up getting spammed but I definitely wasn't doing anything suspicious with it. I didn't bother too much trying to restore it but any attempts would have likely failed regardless.
by riidom on 1/24/22, 12:07 AM
Currently, I use a posteo mail, which costs me 1€ (I believe) per month, for the important stuff. Mails which come as part of my webhosting package for most of the other stuff. And a free adress (web.de) as experiment, but it didn't turn out too bad so I keep it for unimportant stuff They just send ads as mail once a week. Calling this "mildly annoying" is exaggerated already.
Yea, so the takeaway (imo) is, leave the sinking ship before it sinks you. The process may take weeks or months if you proceed it relaxed (that's how I did it), so start before one of your important addresses gets hit.
by iamtedd on 1/24/22, 6:18 AM
* My password is very long and complicated and stored in a password manager
* I don't use any device I don't own and can see the moment the SMS messages came
* I have no other indication that I've been compromised
Google: Just one damn easy thing would give me more information about the situation and allow me to act appropriately: Have the email address associated with the verification code in the message.
by Guest19023892 on 1/24/22, 1:23 AM
Fortunately this was a secondary email address, and my primary email was on my own domain.
by whoknew1122 on 1/24/22, 12:50 AM
Can someone show me the Goldilocks zone for internet security? It's a moving target.
by ryguytilidie on 1/24/22, 4:16 AM
My FAVORITE feature ever is: "huh. You just woke up on a Tuesday and need to get to work? Well, we've logged you out of all your accounts and need you to log in again."
The worst.
by nocommandline on 1/24/22, 4:13 AM
I had the same experience last year with the gmail account I created for my app. I travelled and Google didn’t allow me login from my laptop (cos I was in a different country). Entered the code from my recovery account and still no show.
In both instances it asked for a phone number to send me a code. If it refused to accept the code from my recovery email, why would the one from a text message be different. Besides, I didn’t want to provide my phone number to gmail
by EamonnMR on 1/23/22, 10:55 PM
by IronWolve on 1/24/22, 4:32 AM
Defeats the purpose of a titan key and 2fa enabled.
There is no option to turn off android auth confirmation popups, so you have to de-activate all signed in google phones, and remove google account on your cell for more security and stop trolls from spamming you, if your phone number is public. People been asking google for years to fix this major fubar.
Google auth is designed by idiots, to be as easy as possible, but bad actors can abuse.
by Madmallard on 1/24/22, 1:09 AM
by muthuraj57 on 1/24/22, 2:04 PM
by rkalla on 1/24/22, 1:44 AM
I feel like Risk underwriting at Finance/FinTech companies goes through something similar... the list of rules only ever gets longer/gets added to.. I don't know that anyoen rewinds the clock every 5 years and starts from a clean slate to build out a new model.
by ahnick on 1/23/22, 10:46 PM
by zeroimpl on 1/24/22, 1:18 AM
Some long time later (year+) I retried and got in. I attempted to change the security settings, but it wouldn’t let me.
Some long time later again, I’m now locked out again.
This whole thing is ridiculous. I know the password, and have access to the account to which it forwards all emails. It should be obvious that their is no IP address which regularly uses this account, and that they are clearly locking out the account owner for no good reason.
by y3sh on 1/25/22, 2:14 PM
As a result I unintentionally caused the very problem I was trying to prevent.
by 3np on 1/23/22, 10:56 PM
by itchyjunk on 1/24/22, 2:12 AM
Edit: I was super happy to see a human response at that point and was very hopeful when I tried to sign in again.
by zuccs on 1/24/22, 4:14 AM
I think it's this link: https://accounts.google.com/signin/recovery (don't go through the usual forgot email/password process on the login page or you get that stupid AI loop).
I think it helps to use Google Chrome too.
by octoberfranklin on 1/24/22, 4:07 AM
Eventually they locked me out and demanded that I verify my account via SMS using a landline telephone number I hadn't had access to in over 8 years.
Obviously since this was a landline, I could not possibly have given them this phone number for verification purposes and forgotten that I had done so. Evidently they scraped the phone number out of my email; I'd had PacBell e-bills emailed to that gmail address.
Google is unreliable.
by jerieljan on 1/24/22, 3:26 AM
In terms of security, it's great, but it's terrible when you're going back to old, dormant accounts and have lost trusted devices.
Thankfully, it's not a problem if you've set recovery emails and 2FA options, but it is easy to forget if the accounts are set up for someone else who isn't checking often (like family members who only use their accounts rarely)
It really takes months for the lockout to clear up, and it sucks when it happens.
by dimsum4 on 1/24/22, 3:32 AM
by jayzyone on 1/25/22, 2:00 AM
by empressplay on 1/24/22, 12:28 AM
by gxs on 1/24/22, 5:40 AM
It’s buried deep in settings but it can be disabled.
The first time this happened to me I had to talk to an old employer to let me use my old laptop and sure enough it worked. I was very lucky.
I hate google at this point - or rather how big these trillion dollar tech companies are getting.
Would love a viable email alternative, but fast mail isn’t it.
by upbeat_general on 1/23/22, 11:21 PM
I eventually started using 1Password for all my backup google accounts to setup TOTP making it just as convenient as without 2FA. It was still a pain to have to wait and go through the process though.
by TheChaplain on 1/24/22, 6:20 AM
If you can't, at least set a mail-forward to a different mailprovider (I have an old hotmail account) so if you get locked out, at least you can receive mails.
Use Google Takeout at least twice a year.
Another option would probably be to use Office365, I don think it's that expensive and I guess you would have the possibility of getting real support?
by isarat on 1/24/22, 6:00 AM
by zdw on 1/24/22, 3:30 AM
This also affects paid Google Workspace accounts, which has a setting on GW to disable phone-based auth...
So you're stuck. you can't have people sign into 2FA until they do it via phone... and they can't do it via phone by security policy...
Just nuts.
by pmlnr on 1/23/22, 11:28 PM
Google is not one of these.
by smukherjee19 on 1/24/22, 7:52 AM
by atarian on 1/23/22, 11:26 PM
by secondaryacct on 1/23/22, 10:46 PM
by tootahe45 on 1/24/22, 5:46 AM
I logged into my google account on a mobile emulator VM while testing some apps and have since deleted the VM. However, when i sign into my gmail acc it has 'tap yes on your android x device to confirm it's you' (which i deleted). I have recreated the exact emulator VM and the same thing happens..
by vorhemus on 1/24/22, 7:23 AM
by aimor on 1/24/22, 3:54 AM
Maybe 10 years ago I experienced forgotten Gmail password hell when a family member forgot their password and was never able to recover the account.
Can't wait to see what the process is like another 10 years from now.
by lucb1e on 1/24/22, 1:10 AM
This did reinforce that running my own email server was a good idea. Like, what are you going to do if it actually is important? Call google support? I'd be surprised if they have a helpdesk with humans nowadays, let alone to fix some free account at 1am in the morning. Or even if you get to talk to a human, what are they going to do? Disable a security measure because a kind voice asks them to?
Google thought my IP address was in Russia (I was in Germany) and I guess that makes it suspicious? (Feels a bit odd that entire countries are basically banned. Not as if criminals can't use a VPS or VPN, it's security theater and seems insulting to everyone living there: they're all considered guilty until proven innocent.) I think I later checked and saw that there were no other active login sessions, so it knew that I could not possibly have done as it suggested. (Or maybe that was another instance of this problem, not sure anymore after 5+ years. I never forgot the lesson though...) The reason for logging in wasn't time-sensitive so I let it go for the four days of the event.
A related problem is that I have to clean up my inbox after logging into various services. Twitter was one of the first and I apparently got annoyed enough that I stopped using it subconsciously (I only later noticed that I had stopped checking Twitter and figured that the annoyance factor must be the reason). Like yeah you don't recognize my device, I don't want your "tweet" buttons across the web to track me so of course this appears as a new login device. What would be more suspicious is a login from a known device to this account, if the machine learning functions correctly...
by ranger_danger on 1/24/22, 5:38 AM
by rswail on 1/24/22, 2:08 AM
My own email is with fastmail. They do what they do particularly well and are worth it.
by bananamerica on 1/24/22, 1:18 AM
It says so here https://support.google.com/accounts/answer/1187538?hl=en&co=...
Does it actually work?
by dannyw on 1/24/22, 1:05 AM
Within a second and before the search completed, I was immediately kicked out of all active sessions, and my account was locked.
by eyelidlessness on 1/24/22, 3:21 AM
by lucideer on 1/24/22, 2:32 PM
Absolutely outrageously dangerous system, no way I can trust that service with anything remotely essential again.
by ammonammonammon on 1/23/22, 11:17 PM
by menage on 1/24/22, 6:47 AM
by frozenlettuce on 1/24/22, 12:10 AM
by ericls on 1/23/22, 11:19 PM
by hysan on 1/24/22, 6:08 AM
by alanh on 1/24/22, 12:55 AM
My primary email account is on Fastmail these days, and I like them.
by LegitShady on 1/23/22, 11:43 PM
no longer have associated phone number
Do have backup email (primary email).
Do have password.
Google doesn't care. Won't let me log in, won't send an email to the primary account for recovery, etc.
I've written it off. Essentially if I'm not paying someone for it, they don't care.
by anonymousiam on 1/24/22, 4:07 AM
by kasi_hasi on 1/24/22, 4:17 AM
I've pretty much completely degoogled my live and don't miss anything.
by ashtonkem on 1/24/22, 12:02 AM
by mikotodomo on 1/24/22, 12:25 AM
by dmitrygr on 1/24/22, 12:34 AM
-Xoogler
by perth on 1/24/22, 8:22 AM
by cmurf on 1/24/22, 3:14 AM
by tonymet on 1/23/22, 11:03 PM
by neogodless on 1/24/22, 12:32 AM
by cinntaile on 1/23/22, 10:52 PM
by YeBanKo on 1/24/22, 3:39 AM
by eddieh on 1/24/22, 2:56 AM
by Groxx on 1/24/22, 5:16 AM
I'm very glad that I've already started moving my accounts off.
by diegolyanky on 1/24/22, 7:59 PM
by akkartik on 1/23/22, 10:46 PM
One less risk to worry about.
by Khaine on 1/24/22, 11:17 AM
I get its trying to help protect people, but you know, if it creates friction for the user, you have fucked up. And google's automate everything is admirable, but where there are no feedback loops, it is worse than useless, as no-one knows something is broken and needs fixing.
by avodonosov on 1/24/22, 7:38 AM
by Havoc on 1/24/22, 12:43 AM
by ksec on 1/24/22, 12:11 AM
I am wondering if YubiKey would have the same problem? Edit: Looks like not.
by ComodoHacker on 1/24/22, 6:57 AM
by _7kjo on 1/24/22, 3:02 AM
Google is one of the companies I’d trust the least for anything critical.
by reactspa on 1/23/22, 10:46 PM
by gkanai on 1/24/22, 3:17 AM
I have a gmail account but only use it for mailing lists, ecommerce orders, etc. Relying on Gmail for everything is a bad, bad idea.
by johnnyApplePRNG on 1/24/22, 4:58 AM
I understand editing titles to articles but self posts...???
by thaumasiotes on 1/23/22, 11:01 PM
In my case, I was able to access my email in an incognito tab, although that didn't seem to be a universal solution.
by 5ESS on 1/23/22, 10:55 PM
by pixel_tracing on 1/23/22, 11:28 PM
Good luck.
by fuzzy2 on 1/23/22, 10:46 PM
by dusted on 1/24/22, 7:00 AM
by kart23 on 1/23/22, 11:14 PM
try sending it to your senator and local representative. I think the FTC would also be interested in this. if google won’t even give you support for the issue, that should really be addressed by the government imo.
by tadzikpk on 1/24/22, 12:57 AM
by zoellner on 1/23/22, 11:22 PM
by novok on 1/24/22, 12:22 AM
by joejohns on 1/24/22, 2:48 PM
by ranuzz on 1/24/22, 3:24 AM
by qbasic_forever on 1/23/22, 11:08 PM
by endorphine on 1/24/22, 5:54 AM
by Delfino on 1/24/22, 5:55 AM
by prafullss on 1/24/22, 6:56 AM
by prafullss on 1/24/22, 6:55 AM
by nuker on 1/24/22, 9:16 AM
by whitesilhouette on 1/24/22, 12:56 AM
by tlhighbaugh on 1/23/22, 11:06 PM
by throwawayboise on 1/24/22, 5:07 AM
by ck2 on 1/24/22, 5:23 AM
old accounts without a valid phone number attached to get a SMS code are pretty much screwed if you change ISPs
by nikolay on 1/24/22, 12:23 AM
by kadenwolff on 1/24/22, 3:54 AM
by nathias on 1/23/22, 10:45 PM
by Avamander on 1/23/22, 11:41 PM
Have to reset my password basically once a month because their heuristics are absolutely dogshit.
by kome on 1/24/22, 4:34 AM
by floatingatoll on 1/23/22, 10:39 PM
by alexnewman on 1/24/22, 12:57 AM
by izzytcp on 1/24/22, 2:41 AM
by mediumsmart on 1/24/22, 6:38 AM
by coldtea on 1/23/22, 10:58 PM
by eyeball on 1/23/22, 11:10 PM
by husamia on 1/24/22, 4:02 PM
by eitland on 1/24/22, 6:28 AM
Aren't companies required to have a way to get a manual review of anything an AI does?
And aren't they also to safeguard your data?
I'm not a GDPR expert but I know GDPR is a bit larger than many expect.
by pkilgore on 1/24/22, 1:36 AM
fastmail.com
if its that valuable to you, pay!
by mcantsin on 1/24/22, 9:27 AM
by tester756 on 1/23/22, 11:05 PM
You might not like it, but then you're free to disable this IIRC?