Isn't there an SMS option? buy a new phone and have them send you an OTP via SMS.
> once you're phone is gone, you are completely over with society?
yes, I'm waiting for the Black-Mirror episode where someone drops their phone and basically dies, can't contact anyone, can't unlock or start their car, can't get an uber, can't pay for anything, can't navigate without gps, can't log into anything etc.
Something I learned the hard way: it's a bad time if you are a Google Fi customer and your Android phone with an eSim becomes inoperable while traveling :)
just in general, it's difficult if your phone with an esim dies/lost/stolen (ie no access) to move the esim over. It's especially annoying if it just died, because instead of just popping the sim over you end up in a maze with the carrier (unless you are lucky enough to other lines on the account you have access to)
As an old curmudgeon I recoil at any service I can't interact with sans-phone. I hardly use mine for anything.
Just be glad your phone number is tied to your account, if you lose the number itself you are royally screwed, and basically anyone who gets your old number owns all your accounts now.
Same, it is kind of strange. Back in 2005 I was one of the first to carry the full internet on my phone and now I am leading the charge to avoid having to carry the internet in my pocket.
If your product or service requires a phone, I just don't do business with you. I know I sound archaic recommending this, but we (as a society) need to push back on your phone being the key to your life.
My phone is no more special than my laptop, however this requires an incredible amount of inconvenience for most people along with the constant social pressure to carry a cellphone. As you can imagine, I do not have many friends these days.
> It sounds like you solved the problem of losing access to society by losing access to society.
Perhaps, but frankly I have been more on the lookout for people like me. Natural filter for compatibility?
> Have you considered having backups instead? Carry a physical credit card, make sure you have a backup phone uncharged at home ready for a swap?
I mean, I carry a wallet. Most vendors and society still take cash or card. Where the real friction comes in is staying connected to a community. Everyone wants to keep social connections virtual for some odd reason. As a remote worker I definitely get the virtues of remote interaction, but sometimes meeting people in person has benefits. It does not have to be all-or-nothing and it feels like we are moving to an all-or-nothing digital way of life.
When I dropped my landline after more than 40 years, I transferred the number to a flip phone. This number is also used my family members as a backup phone number for 2FA and voice. Everyone has access to voice mail and can leave messages for others if a phone is lost, broken or stolen.
My wife recently had this happen to a work acquaintance. They are a recent immigrant who has only lived in New York since moving here, who was sent out to the Midwest where there is no public transportation and driving is mandatory, and is staying at a hotel. She lost her phone, and thus could not get anywhere or communicate with anyone, and couldn't pay for anything due to her phone being where all her money is stored (no physical credit cards or anything). Luckily, my wife was able to get her around and help her out until they eventually discovered it was in a lost and found. If she had been alone, I don't know what she would have done.
Imagine being on vacation and you lose your phone, or it breaks. You offloaded your payments to digital and have no cards or cash, you can't get in your hotel room because you used a digital key like hotels all want you to, maybe you brought a car but oops it's a Tesla and you're depending on your phone as the key because it's less stuff to carry!
I recently switched to a Minimal Phone with an e-ink screen, and it sucks (which is the point, obviously). One of the things that sucks is NFC. The payment terminals constantly have a hard time grabbing it, and when they do, they often throw a bizaare "multiple cards detected" error, which is extra strange, since I only have one card stored.
I have a separate sleeve wallet, which I can attach to the back of the phone magnetically that contains my physical debit card + drivers license. If I lost the phone, there's probably about a 50/50 chance that I'd still have the wallet sleeve in my pocket, so I'd at least have my ID and a way to pay for things...but if I lost them both, I'd be pretty screwed.
Convenience is nice, but switching to a shitty phone made me realise I can live without a lot of convenient things, and it's safer not to keep all your eggs in one black rectangle.
We need to better educate non-technical users about making multiple local backups of things like password managers, TOTP seeds, etc.
Yes, even writing the most important ones on a piece of paper and keeping it somewhere safe (like a safe in your house) is an option, as long as you have a low threat model, of course.
Happened to me, I was able to get SMS and recovery codes, but Google still required additional verification on now lost phone :D. On the end I acutely found the phone and was able to restore access. So what they do after couple of days of failed attempts the require additional verification, lets call it 3 step.
> One reason to strongly prefer Apple over Google is that (as I understand it) you can still walk into a store with ID and recover your online identity.
Is this true? If so, in what countries? (Poland has no Apple stores, for example, for inexplicable reasons Apple has been giving the middle finger to this market)
I think Google’s own textbook on SRE has an example in its very first chapter where everyone gets locked out of their bus fleet WiFi thanks to their secure system reaching an unforeseen state
Google actually puts effort into security for "normal" people who don't want to earn a PhD in cryptography just to have a damn free email account or watch Mr. Beast
That's why they had powerful and effective account takeover protection even 15 years ago. The kind that will prevent the hacker from taking over your account even though they got access to all your factors, because it shouldn't take expertise to know that if you logged in from Oregon twenty minutes ago, you definitely aren't also logging in from Ecuador.
Which of course makes it all the more stupid that your credit card company, all your medical service providers, and Facebook don't meet that absurdly low bar. Facebook will happily hand control to the scammer in Laos who got one of your factors and somehow that gave them access to change your password and recovery email
The best backup method doesn't need any computer knowledge, it's writing down or printing a few passwords and putting that piece of paper in the same box as your taxes or birth certificate.
This is why my self-hosted Vaultwarden is my one password that I have to remember and requires no 2fa, which is the only important account that doesn't have 2fa.
If I wake up in a bathtub missing a kidney I can still get to my passwords and 2fa sources stored with it. Some accounts require SMS (annoyingly) so I'd have to buy a phone but the auth and credit card numbers I need to do that are in Vaultwarden, too.
I don't have good solutions now for OP (other than buy a new phone through your carrier and transfer the number). But everyone else do think through your personal DRP. Generate backup codes and put them somewhere safe, too.
One of my favorite things about self-hosted Vaultwarden is that you get distributed backups for free. Every client keeps an offline copy of your entire password vault, kept in sync when the client is online.
So for me to lose my vault, not only would my server have to get hit by a bus, but also my phone, my desktop, my HTPC, both laptops...
You're going to have more success working with the providers of the other accounts and services rather than Google. That means a lot more legwork on your part but banks and other online services all have processes to deal with lost passwords and 2FA devices. In some cases you may have to physically go somewhere with ID and other documents.
At one time I heeded advice not to rely on 2FA SMS because you know it's not secure, so I kept everything in a 2FA app.
Well through an unfortunate sequence of button clicks I wiped my 2FA state and had a hell of a time getting into the apps that I removed my SMS from.
In theory yes SMS is an attack vector but personally the safety and convenience of SMS is more valuable than the odds that someone impersonates me at my mobile provider.
(Also I stopped using that 2FA app and just use a keepass db stored in onedrive).
Yeah I lost my phone some months ago. Quite the panick because I am also MS365 admin for 2 orgs... 3 hr later a trucker called my wife using the iPhone emergency contact feature (what a hero). Now I bought an iPad that stays at home and has all the apps. Honestly, I should also put a second phone somewhere else.
Also frees me up to experiment a bit more on the Phone side (just got a Pixel 10 with GrapheneOS), although, so far it all just works (with Google Services of course).
It's annoying that you really do need either Android or iOS nowadays. If only we could virtualize one of those platforms properly (and free as in freedomly).
Doesn't help obviously if you already lost your phone, but I recommend anyone to use a third party authenticator app. Most services offer to scan a QR code to set up MFA, which can easily be backed up. Don't use Google/Microsoft authenticator apps directly. Personally I use Stratum, but any that allows export/import will do.
All those times you logged in and were prompted to verify your backup email address, and when you set up 2FA and were given recovery codes, and when given the option to sync 2FA codes to another copy of the authenticator app: This Is Why.
I'm sorry you're dealing with this - hopefully everyone else here can take it as a cautionary tale.
I'll fill out a "help my friend" form internally unless someone beats me to it (I have a 1hr meeting coming up). The gmail address in question is the same one as on your website?
That's nice of you, but I'd urge anyone with influence at Google to consider 1) many many many more people who use Google services probably don't know or run in the same circles as Googlers who can bail them out of such a scenario, and 2) these people, being much less likely to understand 2FA, are also more likely to accidentally lock themselves out. An separate class of people who know how a system works or have connections to its operators become nose blind to its terrible UX because they have access to workarounds.
All true, but I’m guessing the set of people at Google who can fill out that form is about 1000x larger than the ones who have the ability to influence the underlying product decisions that led to this situation.
Sorry to bother, but I have been without access to the account I use for my YouTube channel for months because I stupidly entered a random phone number many years ago and it is now demanding access to it. If you would be willing to fill out that form for me, I would greatly appreciate it. Account is this username at gmail. Thanks!
Did you try going through the normal account recovery procedure?
During that procedure, did you have to provide an alternative email address that you have access to?
The account recovery procedure only asks for the last password I remember (which I know is correct) and then says "You can’t recover your account at this time because Google doesn’t have enough info to be sure this account is yours."
I know the email, password, (wrong) phone number on file, and associated YouTube channel. I am logging in from a different IP address but on the same ASN and approximate geolocation that I always logged in and used the account from.
I have tried all combinations of entering password, entering the phone number, try another way, etc., and it never lets me enter an alternative email address.
I have to click "Try another way" at least twice on g.co/AccountRecoveryRequest to get the option to provide an alternative contact email address. Maybe try a private session to make sure coookies aren't taken into account.
Attempt 1: Entered email, got captcha, clicked "try another way". Result: Google couldn’t verify this account belongs to you. Try again later or use Account Recovery for help.
Attempt 2: Entered email, got captcha, completed captcha, got enter last password screen, clicked "try another way". Form asked to confirm phone number. Entered phone number, sent code (which I can't get), clicked "I don't have my phone". Site asked for alternate email, which I provided and supplied the code. Result: "Reply to your Google support email or contact to let the team know you've successfully completed your account recovery request. To try signing in again, follow the steps in our Help Center on how to recover your account."
Attempt 3: Entered email, got captcha, completed captcha, got enter last password screen, entered password, got asked to confirm phone number, clicked "I don't have my phone". Site asked for alternate email, which I provided and supplied the code. Result: "Reply to your Google support email or contact to let the team know you've successfully completed your account recovery request. To try signing in again, follow the steps in our Help Center on how to recover your account."
All attempts were done with new Chrome Incognito windows and no other Incognito windows open. I still can't sign in at all. Is this account just permanently locked?
Discord, please. Username is on my profile here. If you don't use Discord, please use the email on my profile. I will remove them once you send me a friend request on Discord or email.
Recovery is similar to leaving a copy of your door keys to a trusted neighbour (a tradition in some places, it comes in handy when someone goes out and realizes they forgot the keys inside...), so in that comparison, having a recovery email unused for 12 years feels like leaving your backup keys to a neighbor that you never saw ever again in more than a decade.
This kind of posts are a valuable trigger for all others who are reading it. To the author: good luck, I hope you sort your situation soon! I'm now headed to check my accounts for what recovery options I left in there.
This happened to me on my iPhone 8 many years ago. I reset it to let my son use it, and did not have google authenticator in mind. I had to reset each account with the providers. Now I use a cloud account to sync these. I reset most accounts with an SMS or email one time code -- which led me to remove SMS and email as recovery options from google. And, I put a code on t-mobile to prevent sim transfer.
I'm not saying it's the best option or anything but I use authy authenticator which I have on multiple devices.
I got burned by Google authenticator in the past and had to jump through hoops to regain access to my accounts (non Google ones). It was painful. I learned the hard way I suppose.
It's a "feature" that you can't call google to help with getting "locked out":
"For your security, you can't call Google for help to sign into your account. We don’t work with any service that claims to provide account or password support. Do not give out your passwords or verification codes."
You can add a passkey (preferably a physical one) to authenticate. You can also add a software passkey but that kind of defeats the purpose.
Actually keeping your recovery options recent is the trick. Print out your recovery codes or store them somewhere safe. Check regularly (yearly, maybe more often) that there's a way to access your critical accounts.
For Google, you can also grab the cheapest Android phone you can find, sign in, and maybe boot it once a month or so to keep the tokens active.
If you've set up your account to only accept one source of 2FA and you lose thst source of 2FA, you lose your account. Same happens when you set up your account to only accept your password and then lose your password. If you lose your recovery email/2FA backup codes, you lose access, unless you're special enough to convince customer support that you are who you claim you are and not just a bot trying to hack you.
If you've lost your account and haven't set up any recovery mechanisms, you're probably out of luck. Your best bet will be looking for an old browser session with enough trust from Google's side to get access without reconfirming your 2FA trust.
Yup, having _two_ active devices which are logged in to Google (and possibly other services that you rely on that opt you in to app-based 2FA) + with backups of 2FA is a must at this point. When I buy a new phone, I make it a "primary", and keep my old phone as "backup".
If you're not into cloud-based password/2FA syncing, Google Authenticator supports local export/import across devices via a QR code. For passwords, I use KeePass Portable / Keepass2Android + syncing between devices from time to time through a USB-C pendrive (The source of truth KP DB is on pendrive, and both phones work off a local on-device cache).
You don't need to have your phone stolen for things to get messed up. If your screen breaks, you can't type in a PIN anymore, can't unblock with a fingerprint, and you effectively can't access anything on the phone. ADB won't connect because screen is off, and you can't unlock / accept a new external connection etc.
The same way you recover any other deleted data for which you didn't make a backup: you don't. You eat the loss & make new accounts. Then you remember to make and test backups for the future.
Even if they had customer support, if that customer support had a backdoor to unlock your account it would be regularly used by malicious parties to steal people's accounts & data.
This has often been abused with mobile phone carriers to get SIM cards issued for targets by just knowing enough customer details. This then allowed them to intercept SMS 2FA challenges and access even more sensitive accounts.
Dumb question, does backing up my iphone to icloud help solve this? Assuming im willing and able to get a brand new phone? What 2fa would the Apple store need, if hypothetically my lost iphone was my only apple product?
It's not a dumb question, but there isn't any single answer. It depends on what protections you have on your iCloud account. For most users, if you've lost your phone, but remember your iCloud password and have a new phone with the same number, you can get in. It's made even easier if you have another device already signed in, such as a laptop.
Luckily I do have a macbook, and try to put all my passwords in a "neutral" password manager, but this post has made me think about the edge cases of this sort of thing.
Ive always said, the number one reason I will stick with an iphone - despite any present for future dumb ux changes - is that I will always be able to physically go to an apple store and get someone to help me.
This situation is why I don't use authenticator apps, or passkeys linked to a device. Single point of failure, and obviously with any of the big tech companies, zero recourse.
Try blocking the phone first, then recover your number, and only after that try recovering the account. Or, if you have any backup verification methods through email or something like that, use those.
If you have another device that is logged in, you can get a code from that one to log into your account on your new phone or other device. It is an option but it's kind of buried. There's a special link you go to.
You are screwed. I lost access to my account, by trying to buy YouTube premium ironically. If Google even tried to help me I would still use them but they don't, so I switched to Proton and use YouTube with VPN only so they get zero ad revenue :)
Man, passwords sure are nice aren't they! All you have to do is remember one because your password manager remembers all the rest of your randomly generated passwords for you and as long as you keep a backup of the password database you never have to worry about this bullshit.
OTP works with a password manager too. I have Authy on my Android, and Pass on my Linux computers. The second is backed up properly. This approach just means that enabling 2FA (which is mostly OTP in any case) just means registering the OTP URI in two locations instead of one.
Additional benefit: I can generate an OTP for any service protected like this without having to get my phone from wherever it is.
Another thing to know: in the hamburger menu there is a "require face id option". Turn it on, otherwise if your phone is snatched from you (while unlocked), they can access your 2-factor codes.
I had some experience similar to this and found that after some months, when logging in on an extremely familiar to Google setup, that there was an additional prompt where it asked for some old passwords IIRC and then let me in.
I've had this issue before, and the only thing that saved me was SMS (phone number) backup.
I believe Google is slightly easier than Meta to contact by phone so this should help.
While we are on this, is there a comprehensive guide on how to "theft-proof" your iPhone? Not in the sense of preventing the theft, but rather the fallout on all our various online service access.
Using the iPhone backup to setup a new phone is a good reminder every time that not half of the stuff comes back correctly..
I'm not sure you'd really need a guide. Just use the phone as a phone and pretend like it isn't a smartphone. Suddenly you are teleported back into 2005: physical credit cards, physical transit passes, online banking via a desktop website. It is still up to you what era you decide to live in technologically today.
Well that’s why you should have software 2FA and even backing up the tokens so you can generate that one time code even if you lost access to your main authenticator, having your phone as the only 2FA is like having those yubikey hardware used as 2FA without making a redundant one, losing it, you lost access, which is usually known since no one would use yubikey without being tech savvy to start with, now google or other companies are turning phones as an attestation method for the crowd, you might soon in the future become citizen-less because your digital ID can only be proven in the lost phone.
Honestly.... This is why I have everything in Bitwarden. All 2FA runs through it so even if my phone got stolen, I could still access everything. I honestly don't understand why more people don't pay the $10 a year and just use Bitwarden.
Having your passwords and 2FA with the same provider carries some risk. If someone can access your Bitwarden account they will have full access to all your accounts.
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other 2FA method
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
My phone is logged into Bitwarden so even then I can recover my passwords and data in case of a serious incident immediately.
Even if both my house and my friend's house burn down at the same time, I can still recover my data from my phone unless my phone is left in the house, all of which to say I still have the recovery phrase written down in a box somewhere in a different country
I can't help you but my comment may help others...
As a techie you should have known better: you first learn how 2FA using TOTP works. You understand what happens when you create an entry in Google Authenticator (or whatever app). You reproduce the procedure: you verify that you end up with the same 6-digit numbers.
If you've got a partner, you register your secret keys for each service on your partner's device and vice-versa.
Then you've got backups of your secret keys on paper, in a safe at your bank. Next to each secret key there's a checkbox: "Successfully initialized from this secret key?".
When those TOTP became ubiquitous (way, way, way before Yubikeys or passkeys were a thing), 2FA was a godsend compared to just passwords.
I understood they were here to stay for years, and years. And then more years.
So I learned how they worked.
When later on QR code generalized to initialize those (IIRC it wasn't a thing in the early days of 2FA TOTP: you'd just always get the secret key as characters, not as a QR code), I refused to ever scan a QR code: I always first decode the QR code (for the services only showing the secret key as a QR code, without also showing it as text), extract a copy of the secret key and then register it from my copy.
Stuff like that.
Now... As most services are deeply broken and have completely insecure practices you just say "I lost my 2FA, I want to reset it" and because they're clueless when it comes to security, they'll allow you to reset it. If someone hacks your email, they pretty much can reset every single of your account (at least those tied to that email).
honestly a piece of paper that has your password without saying it is your password and use that password for your most important thing (email) or password manager
can you recover one of the old contact points (phone or email) for a reset code?
I would send a paper letter to the Google legal contact. It's the only way to get escalated support.
I agree the covenant for account recovery has been broken. Every 6 months, a new artifact is expected to access the account, without adequate preparation for the recovery.
I mistakenly changed my phone number due to spam call, then i tried to login Google account in another device. Now, this fucking google don't allow me to login at all. It keep saying "Google can't verify you". I have accepted prompts, given them passkeys from 1password, have recovery code and everything. But no lock. I am now scared if my google account gets logged out, i will be in very problematic situation.
Google Employee, can you please fix your shit? Losing phone number doesn't mean you have to lose everything....
Isn't there an SMS option? buy a new phone and have them send you an OTP via SMS.
> once you're phone is gone, you are completely over with society?
yes, I'm waiting for the Black-Mirror episode where someone drops their phone and basically dies, can't contact anyone, can't unlock or start their car, can't get an uber, can't pay for anything, can't navigate without gps, can't log into anything etc.
Something I learned the hard way: it's a bad time if you are a Google Fi customer and your Android phone with an eSim becomes inoperable while traveling :)
Went through the same last month. I had to both buy a new phone and still have my old one repaired to be able to authenticate to set up the new one.
I was a CyanogenMod user before switching to Pixel, and that experience was a monumental shove towards moving to Graphene.
just in general, it's difficult if your phone with an esim dies/lost/stolen (ie no access) to move the esim over. It's especially annoying if it just died, because instead of just popping the sim over you end up in a maze with the carrier (unless you are lucky enough to other lines on the account you have access to)
Pretty similar to how my life feels right now.
As an old curmudgeon I recoil at any service I can't interact with sans-phone. I hardly use mine for anything.
Just be glad your phone number is tied to your account, if you lose the number itself you are royally screwed, and basically anyone who gets your old number owns all your accounts now.
Same, it is kind of strange. Back in 2005 I was one of the first to carry the full internet on my phone and now I am leading the charge to avoid having to carry the internet in my pocket.
If your product or service requires a phone, I just don't do business with you. I know I sound archaic recommending this, but we (as a society) need to push back on your phone being the key to your life.
My phone is no more special than my laptop, however this requires an incredible amount of inconvenience for most people along with the constant social pressure to carry a cellphone. As you can imagine, I do not have many friends these days.
It sounds like you solved the problem of losing access to society by losing access to society.
Have you considered having backups instead? Carry a physical credit card, make sure you have a backup phone uncharged at home ready for a swap?
> It sounds like you solved the problem of losing access to society by losing access to society.
Perhaps, but frankly I have been more on the lookout for people like me. Natural filter for compatibility?
> Have you considered having backups instead? Carry a physical credit card, make sure you have a backup phone uncharged at home ready for a swap?
I mean, I carry a wallet. Most vendors and society still take cash or card. Where the real friction comes in is staying connected to a community. Everyone wants to keep social connections virtual for some odd reason. As a remote worker I definitely get the virtues of remote interaction, but sometimes meeting people in person has benefits. It does not have to be all-or-nothing and it feels like we are moving to an all-or-nothing digital way of life.
When I dropped my landline after more than 40 years, I transferred the number to a flip phone. This number is also used my family members as a backup phone number for 2FA and voice. Everyone has access to voice mail and can leave messages for others if a phone is lost, broken or stolen.
My wife recently had this happen to a work acquaintance. They are a recent immigrant who has only lived in New York since moving here, who was sent out to the Midwest where there is no public transportation and driving is mandatory, and is staying at a hotel. She lost her phone, and thus could not get anywhere or communicate with anyone, and couldn't pay for anything due to her phone being where all her money is stored (no physical credit cards or anything). Luckily, my wife was able to get her around and help her out until they eventually discovered it was in a lost and found. If she had been alone, I don't know what she would have done.
Imagine being on vacation and you lose your phone, or it breaks. You offloaded your payments to digital and have no cards or cash, you can't get in your hotel room because you used a digital key like hotels all want you to, maybe you brought a car but oops it's a Tesla and you're depending on your phone as the key because it's less stuff to carry!
I recently switched to a Minimal Phone with an e-ink screen, and it sucks (which is the point, obviously). One of the things that sucks is NFC. The payment terminals constantly have a hard time grabbing it, and when they do, they often throw a bizaare "multiple cards detected" error, which is extra strange, since I only have one card stored.
I have a separate sleeve wallet, which I can attach to the back of the phone magnetically that contains my physical debit card + drivers license. If I lost the phone, there's probably about a 50/50 chance that I'd still have the wallet sleeve in my pocket, so I'd at least have my ID and a way to pay for things...but if I lost them both, I'd be pretty screwed.
Convenience is nice, but switching to a shitty phone made me realise I can live without a lot of convenient things, and it's safer not to keep all your eggs in one black rectangle.
We need to better educate non-technical users about making multiple local backups of things like password managers, TOTP seeds, etc.
Yes, even writing the most important ones on a piece of paper and keeping it somewhere safe (like a safe in your house) is an option, as long as you have a low threat model, of course.
I lost my phone, and slacks recovery model is essentially like this.
If you don't have the authenticator backup codes and you didn't turn on cloud sync in the app, you might be out of luck.
You can get a replacement SIM though and use it with a new phone, so the phone number recovery option should work.
Happened to me, I was able to get SMS and recovery codes, but Google still required additional verification on now lost phone :D. On the end I acutely found the phone and was able to restore access. So what they do after couple of days of failed attempts the require additional verification, lets call it 3 step.
This feels objectively worse than writing down a password somewhere
I have passkeys, authenticator etc... and everything except phone number, and now i am unable to login my account in other device.
Google sucks, they are randomly denying access because their dumb model can't figure out not everyone is trying to steal account.
This. Can't you get your number moved to a new phone? I have never don't anything magic when upgrading my phone other than move contacts.
How would moving your number to a new phone help? We're talking TOTP here, not SMS "auth".
does google not offer a backup via sms? it's a common enough recovery flow elsewhere. (i dont use google stuff, so i am genuinely asking)
Any less secure backup method, means others are less secure.
A required “more secure” method is less secure if it means you can be locked out by not-exactly-uncommon real-life situations.
Denial of service is a security issue.
I’ve repeated it a hundred times security = confidentiality, integrity and availability.
One reason to strongly prefer Apple over Google is that (as I understand it) you can still walk into a store with ID and recover your online identity.
> One reason to strongly prefer Apple over Google is that (as I understand it) you can still walk into a store with ID and recover your online identity.
Is this true? If so, in what countries? (Poland has no Apple stores, for example, for inexplicable reasons Apple has been giving the middle finger to this market)
That would be a huge difference.
I think Google’s own textbook on SRE has an example in its very first chapter where everyone gets locked out of their bus fleet WiFi thanks to their secure system reaching an unforeseen state
yes, i understand. i was asking specifically whether google has sms recovery flow, not how secure sms recovery flow is compared to other options.
Google actually puts effort into security for "normal" people who don't want to earn a PhD in cryptography just to have a damn free email account or watch Mr. Beast
That's why they had powerful and effective account takeover protection even 15 years ago. The kind that will prevent the hacker from taking over your account even though they got access to all your factors, because it shouldn't take expertise to know that if you logged in from Oregon twenty minutes ago, you definitely aren't also logging in from Ecuador.
Which of course makes it all the more stupid that your credit card company, all your medical service providers, and Facebook don't meet that absurdly low bar. Facebook will happily hand control to the scammer in Laos who got one of your factors and somehow that gave them access to change your password and recovery email
The best backup method doesn't need any computer knowledge, it's writing down or printing a few passwords and putting that piece of paper in the same box as your taxes or birth certificate.
You can export from Google Authenticator to another device just fine.
How do you export from a phone you no longer have?
This is why my self-hosted Vaultwarden is my one password that I have to remember and requires no 2fa, which is the only important account that doesn't have 2fa.
If I wake up in a bathtub missing a kidney I can still get to my passwords and 2fa sources stored with it. Some accounts require SMS (annoyingly) so I'd have to buy a phone but the auth and credit card numbers I need to do that are in Vaultwarden, too.
I don't have good solutions now for OP (other than buy a new phone through your carrier and transfer the number). But everyone else do think through your personal DRP. Generate backup codes and put them somewhere safe, too.
Welll yeh until a Hargrove fails on your self hosted server
One of my favorite things about self-hosted Vaultwarden is that you get distributed backups for free. Every client keeps an offline copy of your entire password vault, kept in sync when the client is online.
So for me to lose my vault, not only would my server have to get hit by a bus, but also my phone, my desktop, my HTPC, both laptops...
True.. but now you have more devices to have to secure against attacks...
Edit: this "feature" did save me when my home hosted vaultwarden died due to hdd failure.
You're going to have more success working with the providers of the other accounts and services rather than Google. That means a lot more legwork on your part but banks and other online services all have processes to deal with lost passwords and 2FA devices. In some cases you may have to physically go somewhere with ID and other documents.
Consider it a learning experience.
I had similar issues: https://news.ycombinator.com/item?id=45451567 (including my personal domain, Dropbox; my Apple account is still MIA...)
We've all been reduced to a passphrase.
When I've lobbed this scenario to the security managers/employees at these companies, they all give me a really great answer:
Q: What happens if a sitting senator gets mugged and they have their printed 2fa codes sitting in their wallet?
A: They have a special number they can call.
After they go get a second phone
It's a good reminder to everyone who uses 2FA. Be sure you have multiple ways in for when your phone becomes unusable.
At one time I heeded advice not to rely on 2FA SMS because you know it's not secure, so I kept everything in a 2FA app.
Well through an unfortunate sequence of button clicks I wiped my 2FA state and had a hell of a time getting into the apps that I removed my SMS from.
In theory yes SMS is an attack vector but personally the safety and convenience of SMS is more valuable than the odds that someone impersonates me at my mobile provider.
(Also I stopped using that 2FA app and just use a keepass db stored in onedrive).
Yeah I lost my phone some months ago. Quite the panick because I am also MS365 admin for 2 orgs... 3 hr later a trucker called my wife using the iPhone emergency contact feature (what a hero). Now I bought an iPad that stays at home and has all the apps. Honestly, I should also put a second phone somewhere else.
Also frees me up to experiment a bit more on the Phone side (just got a Pixel 10 with GrapheneOS), although, so far it all just works (with Google Services of course).
It's annoying that you really do need either Android or iOS nowadays. If only we could virtualize one of those platforms properly (and free as in freedomly).
Doesn't help obviously if you already lost your phone, but I recommend anyone to use a third party authenticator app. Most services offer to scan a QR code to set up MFA, which can easily be backed up. Don't use Google/Microsoft authenticator apps directly. Personally I use Stratum, but any that allows export/import will do.
This. Authy and a throwaway phone added in that sits in a safe place.
I stopped using Authy when they were bought by Twilio and stopped supporting their desktop client (thus eliminating my alternate device backups).
I can highly recommend Ente Auth though.
All those times you logged in and were prompted to verify your backup email address, and when you set up 2FA and were given recovery codes, and when given the option to sync 2FA codes to another copy of the authenticator app: This Is Why.
I'm sorry you're dealing with this - hopefully everyone else here can take it as a cautionary tale.
I'll fill out a "help my friend" form internally unless someone beats me to it (I have a 1hr meeting coming up). The gmail address in question is the same one as on your website?
That's nice of you, but I'd urge anyone with influence at Google to consider 1) many many many more people who use Google services probably don't know or run in the same circles as Googlers who can bail them out of such a scenario, and 2) these people, being much less likely to understand 2FA, are also more likely to accidentally lock themselves out. An separate class of people who know how a system works or have connections to its operators become nose blind to its terrible UX because they have access to workarounds.
Consider the fact that they have made this difficult a sign that they have no interest in making it easy.
All true, but I’m guessing the set of people at Google who can fill out that form is about 1000x larger than the ones who have the ability to influence the underlying product decisions that led to this situation.
Sorry to bother, but I have been without access to the account I use for my YouTube channel for months because I stupidly entered a random phone number many years ago and it is now demanding access to it. If you would be willing to fill out that form for me, I would greatly appreciate it. Account is this username at gmail. Thanks!
Did you try going through the normal account recovery procedure? During that procedure, did you have to provide an alternative email address that you have access to?
The account recovery procedure only asks for the last password I remember (which I know is correct) and then says "You can’t recover your account at this time because Google doesn’t have enough info to be sure this account is yours."
I know the email, password, (wrong) phone number on file, and associated YouTube channel. I am logging in from a different IP address but on the same ASN and approximate geolocation that I always logged in and used the account from.
"Try another way" until you can give an alternative email address that you have access to.
I have tried all combinations of entering password, entering the phone number, try another way, etc., and it never lets me enter an alternative email address.
I have to click "Try another way" at least twice on g.co/AccountRecoveryRequest to get the option to provide an alternative contact email address. Maybe try a private session to make sure coookies aren't taken into account.
Attempt 1: Entered email, got captcha, clicked "try another way". Result: Google couldn’t verify this account belongs to you. Try again later or use Account Recovery for help.
Attempt 2: Entered email, got captcha, completed captcha, got enter last password screen, clicked "try another way". Form asked to confirm phone number. Entered phone number, sent code (which I can't get), clicked "I don't have my phone". Site asked for alternate email, which I provided and supplied the code. Result: "Reply to your Google support email or contact to let the team know you've successfully completed your account recovery request. To try signing in again, follow the steps in our Help Center on how to recover your account."
Attempt 3: Entered email, got captcha, completed captcha, got enter last password screen, entered password, got asked to confirm phone number, clicked "I don't have my phone". Site asked for alternate email, which I provided and supplied the code. Result: "Reply to your Google support email or contact to let the team know you've successfully completed your account recovery request. To try signing in again, follow the steps in our Help Center on how to recover your account."
All attempts were done with new Chrome Incognito windows and no other Incognito windows open. I still can't sign in at all. Is this account just permanently locked?
Attempt 2 enabled the potential internal escalation to proceed.
The form is now asking me for details that we best talk non-publicly about. What's the best place to contact you privately, other than HN?
Discord, please. Username is on my profile here. If you don't use Discord, please use the email on my profile. I will remove them once you send me a friend request on Discord or email.
Sent on Discord!
Recovery is similar to leaving a copy of your door keys to a trusted neighbour (a tradition in some places, it comes in handy when someone goes out and realizes they forgot the keys inside...), so in that comparison, having a recovery email unused for 12 years feels like leaving your backup keys to a neighbor that you never saw ever again in more than a decade.
This kind of posts are a valuable trigger for all others who are reading it. To the author: good luck, I hope you sort your situation soon! I'm now headed to check my accounts for what recovery options I left in there.
This happened to me on my iPhone 8 many years ago. I reset it to let my son use it, and did not have google authenticator in mind. I had to reset each account with the providers. Now I use a cloud account to sync these. I reset most accounts with an SMS or email one time code -- which led me to remove SMS and email as recovery options from google. And, I put a code on t-mobile to prevent sim transfer.
Everything you listed, plus a recovery email option, plus backup codes, plus SMS.
That's already a lot and anything easier would allow people to just take over accounts that they don't have a right to.
I'm not saying it's the best option or anything but I use authy authenticator which I have on multiple devices.
I got burned by Google authenticator in the past and had to jump through hoops to regain access to my accounts (non Google ones). It was painful. I learned the hard way I suppose.
The only secret option I know of is to have a popular social media account and complain online.
Other than that, I copy/pasted your post into Claude and it had some good ideas.
It's a "feature" that you can't call google to help with getting "locked out":
"For your security, you can't call Google for help to sign into your account. We don’t work with any service that claims to provide account or password support. Do not give out your passwords or verification codes."
for the future: https://support.google.com/accounts/answer/7684753
You can add a passkey (preferably a physical one) to authenticate. You can also add a software passkey but that kind of defeats the purpose.
Actually keeping your recovery options recent is the trick. Print out your recovery codes or store them somewhere safe. Check regularly (yearly, maybe more often) that there's a way to access your critical accounts.
For Google, you can also grab the cheapest Android phone you can find, sign in, and maybe boot it once a month or so to keep the tokens active.
If you've set up your account to only accept one source of 2FA and you lose thst source of 2FA, you lose your account. Same happens when you set up your account to only accept your password and then lose your password. If you lose your recovery email/2FA backup codes, you lose access, unless you're special enough to convince customer support that you are who you claim you are and not just a bot trying to hack you.
If you've lost your account and haven't set up any recovery mechanisms, you're probably out of luck. Your best bet will be looking for an old browser session with enough trust from Google's side to get access without reconfirming your 2FA trust.
Yup, having _two_ active devices which are logged in to Google (and possibly other services that you rely on that opt you in to app-based 2FA) + with backups of 2FA is a must at this point. When I buy a new phone, I make it a "primary", and keep my old phone as "backup".
If you're not into cloud-based password/2FA syncing, Google Authenticator supports local export/import across devices via a QR code. For passwords, I use KeePass Portable / Keepass2Android + syncing between devices from time to time through a USB-C pendrive (The source of truth KP DB is on pendrive, and both phones work off a local on-device cache).
You don't need to have your phone stolen for things to get messed up. If your screen breaks, you can't type in a PIN anymore, can't unblock with a fingerprint, and you effectively can't access anything on the phone. ADB won't connect because screen is off, and you can't unlock / accept a new external connection etc.
> buy a new phone, I make it a "primary", and keep my old phone as "backup".
Sadly this is why I never end up trading in my phone. Always feels too risky to not have an overlap period.
The same way you recover any other deleted data for which you didn't make a backup: you don't. You eat the loss & make new accounts. Then you remember to make and test backups for the future.
Even if they had customer support, if that customer support had a backdoor to unlock your account it would be regularly used by malicious parties to steal people's accounts & data.
They could do ID verification
There's no way, no human contact. That's why I de-googled myself.
No human contact is a plus for security, as the human is the weakest link that can give up your authentication to someone that isn’t you.
The human factor is walking into your local branch with your face and an ID - something that can’t be done on a large scale by bots.
This has often been abused with mobile phone carriers to get SIM cards issued for targets by just knowing enough customer details. This then allowed them to intercept SMS 2FA challenges and access even more sensitive accounts.
Have you heard about Meta AI doing support?
Only if you can log in. I am Meta Verified, but I cannot log in to get support.
"I am permanently locked out of my account with no recourse" is also a security issue.
Very sorry to hear this, I thought phone theft was becoming rare nowadays. Did it get stolen abroad?
need to save your recovery keys (text file) before you lost the phone
Excellent idea... shit my house just burned down with my phone.
Backups, backups, backups.
Now on to how to keep those backups secure.
need to save your recovery keys (text file) before you lost the backups
Dumb question, does backing up my iphone to icloud help solve this? Assuming im willing and able to get a brand new phone? What 2fa would the Apple store need, if hypothetically my lost iphone was my only apple product?
It's not a dumb question, but there isn't any single answer. It depends on what protections you have on your iCloud account. For most users, if you've lost your phone, but remember your iCloud password and have a new phone with the same number, you can get in. It's made even easier if you have another device already signed in, such as a laptop.
Luckily I do have a macbook, and try to put all my passwords in a "neutral" password manager, but this post has made me think about the edge cases of this sort of thing.
Ive always said, the number one reason I will stick with an iphone - despite any present for future dumb ux changes - is that I will always be able to physically go to an apple store and get someone to help me.
This is why I always have at lest two devices connected to 2fa and a UF2 Security Key
This situation is why I don't use authenticator apps, or passkeys linked to a device. Single point of failure, and obviously with any of the big tech companies, zero recourse.
I have Ente Auth on my phone, desktop and laptop (on top of printed recovery keys for each service using the authenticator).
I think many services allow you to set up more than one passkey for this reason.
Try blocking the phone first, then recover your number, and only after that try recovering the account. Or, if you have any backup verification methods through email or something like that, use those.
If you have another device that is logged in, you can get a code from that one to log into your account on your new phone or other device. It is an option but it's kind of buried. There's a special link you go to.
Have a look at: https://github.com/muquit/twofa-rescue
You are screwed. I lost access to my account, by trying to buy YouTube premium ironically. If Google even tried to help me I would still use them but they don't, so I switched to Proton and use YouTube with VPN only so they get zero ad revenue :)
All the more reason email and banking should be handled by the post office.
Man, passwords sure are nice aren't they! All you have to do is remember one because your password manager remembers all the rest of your randomly generated passwords for you and as long as you keep a backup of the password database you never have to worry about this bullshit.
OTP works with a password manager too. I have Authy on my Android, and Pass on my Linux computers. The second is backed up properly. This approach just means that enabling 2FA (which is mostly OTP in any case) just means registering the OTP URI in two locations instead of one.
Additional benefit: I can generate an OTP for any service protected like this without having to get my phone from wherever it is.
Going forward, consider using an authenticator that securely syncs across multiple devices to remove the single point of failure risk.
I use Proton Authenticator now [0]
Authy used to do this, then they enshittified their app and bricked the desktop version.
[0]: https://proton.me/authenticator
Google authenticator supports syncing across multiple devices.
is that new? I migrated at the time from GA to Authy and from Authy to Ente because it was not supported.
https://security.googleblog.com/2023/04/google-authenticator...
So relatively new, and I didn't know this and moved to proton for this reason recently.
Another thing to know: in the hamburger menu there is a "require face id option". Turn it on, otherwise if your phone is snatched from you (while unlocked), they can access your 2-factor codes.
I had some experience similar to this and found that after some months, when logging in on an extremely familiar to Google setup, that there was an additional prompt where it asked for some old passwords IIRC and then let me in.
I've had this issue before, and the only thing that saved me was SMS (phone number) backup. I believe Google is slightly easier than Meta to contact by phone so this should help.
The passkey I use for Google syncs to multiple devices, so that's how I handle it. That and a backup code stored in a separate location.
Does your browser have the email password saved?
Too late for you now, but I set my backup email to my work email. Granted, I have to change it when I change jobs.
While we are on this, is there a comprehensive guide on how to "theft-proof" your iPhone? Not in the sense of preventing the theft, but rather the fallout on all our various online service access.
Using the iPhone backup to setup a new phone is a good reminder every time that not half of the stuff comes back correctly..
I'm not sure you'd really need a guide. Just use the phone as a phone and pretend like it isn't a smartphone. Suddenly you are teleported back into 2005: physical credit cards, physical transit passes, online banking via a desktop website. It is still up to you what era you decide to live in technologically today.
Well that’s why you should have software 2FA and even backing up the tokens so you can generate that one time code even if you lost access to your main authenticator, having your phone as the only 2FA is like having those yubikey hardware used as 2FA without making a redundant one, losing it, you lost access, which is usually known since no one would use yubikey without being tech savvy to start with, now google or other companies are turning phones as an attestation method for the crowd, you might soon in the future become citizen-less because your digital ID can only be proven in the lost phone.
Honestly.... This is why I have everything in Bitwarden. All 2FA runs through it so even if my phone got stolen, I could still access everything. I honestly don't understand why more people don't pay the $10 a year and just use Bitwarden.
Having your passwords and 2FA with the same provider carries some risk. If someone can access your Bitwarden account they will have full access to all your accounts.
I always feel conflicted with this.
Using my password manager to store 2FA codes is convenient, but it adds a layer of indirection if they are elsewhere.
But if you've compromised my password manager, you almost certainly have enough access to my machines to get to the alternatives.
> All 2FA runs through it
I hope that isn't true, because I sure can't think of a good way to use Bitwarden's TOTP as 2FA for Bitwarden! :)
FIDO2 USB Security key -> Bitwarden (With master password) -> Every other 2FA method
I have 3 FIDO2 USB Security keys, One I carry with my persons at all times, one that stays with my main machine at all times and an offsite backup that is sitting in a friend's server, if my house burns down, I can either physically collect the key or use USB-IP to authenticate back into bitwarden and enroll a new key. (Actually all 3 are at home right now but that's ok)
My phone is logged into Bitwarden so even then I can recover my passwords and data in case of a serious incident immediately.
Even if both my house and my friend's house burn down at the same time, I can still recover my data from my phone unless my phone is left in the house, all of which to say I still have the recovery phrase written down in a box somewhere in a different country
What's your plan when you lose access to Bitwarden?
What happens when your Bitwarden gets compromised?
You were supposed to save your backup codes.
I think this
I went through something like this years ago with my wife and she just scraped enough data together to satisfy the account reset process.
After that we both created a set of one time codes and stored them offline.
I can't help you but my comment may help others...
As a techie you should have known better: you first learn how 2FA using TOTP works. You understand what happens when you create an entry in Google Authenticator (or whatever app). You reproduce the procedure: you verify that you end up with the same 6-digit numbers.
If you've got a partner, you register your secret keys for each service on your partner's device and vice-versa.
Then you've got backups of your secret keys on paper, in a safe at your bank. Next to each secret key there's a checkbox: "Successfully initialized from this secret key?".
When those TOTP became ubiquitous (way, way, way before Yubikeys or passkeys were a thing), 2FA was a godsend compared to just passwords.
I understood they were here to stay for years, and years. And then more years.
So I learned how they worked.
When later on QR code generalized to initialize those (IIRC it wasn't a thing in the early days of 2FA TOTP: you'd just always get the secret key as characters, not as a QR code), I refused to ever scan a QR code: I always first decode the QR code (for the services only showing the secret key as a QR code, without also showing it as text), extract a copy of the secret key and then register it from my copy.
Stuff like that.
Now... As most services are deeply broken and have completely insecure practices you just say "I lost my 2FA, I want to reset it" and because they're clueless when it comes to security, they'll allow you to reset it. If someone hacks your email, they pretty much can reset every single of your account (at least those tied to that email).
honestly a piece of paper that has your password without saying it is your password and use that password for your most important thing (email) or password manager
it's too late now but there's an app called Google Authenticator that you could have setup on alternate android devices
your only hope to get your google account back is to convince your phone carrier to transfer your old phone number to a new phone that you control
can you recover one of the old contact points (phone or email) for a reset code?
I would send a paper letter to the Google legal contact. It's the only way to get escalated support.
I agree the covenant for account recovery has been broken. Every 6 months, a new artifact is expected to access the account, without adequate preparation for the recovery.
I mistakenly changed my phone number due to spam call, then i tried to login Google account in another device. Now, this fucking google don't allow me to login at all. It keep saying "Google can't verify you". I have accepted prompts, given them passkeys from 1password, have recovery code and everything. But no lock. I am now scared if my google account gets logged out, i will be in very problematic situation.
Google Employee, can you please fix your shit? Losing phone number doesn't mean you have to lose everything....
> or anything to deal with this type of situation?
call sergey brin \s