Her comment: "What? Do I need a password for this? I hate passwords! Why do they make me use passwords?" Proceeds to klick password remainder link

True story. Would ve funny if it wasn't so tragic.

You would not let her drive, would you? Even if the car provided her more automomy, the risk of her running into another car would be too high. Why would you then let her expose herself to a world full of predators that are specifically targeting senior citizens to wipe their bank accounts?

Better to monitor her use of computers as if she was a young girl.

Kind of reminds me of myself following useless bureaucracy.

Have you tried providing written instructions? In my opinion, for her vectors of attack, it is much less risky to have her password written down in paper somewhere on a drawer at home than have an online mess.

Assuming she doesn't fall for any scams (which is a big assumption).

* set all redundant accounts to redirect mail to a main one

* do write the identifiers and passwords on paper notes, and have her keep them, for instance, inside her wallet

I ended up just picking random questions and setting them all to the same answer, which has nothing to do with any of the questions - something that I can't even misspell if I tried. This is going to be my new strategy moving forward.

And don't even get me started on their silly username and password "security" rules.

I'm sure other tools like KeePass have similar sections to do the same thing.

That way the answers aren't reproducible and you have them safely stored somewhere.

When Sarah Palin's "personal" email was hacked during the 2008 election, the attacker used her Wikipedia page and recovery questions.[0]

[0]: http://nypost.com/2008/09/19/dem-pols-son-was-hacker/

Just because they didn't impress you by finding a side channel timing attack for the password hashing algorithm used by Yahoo, doesn't make it any less of a hack.

Why spend millions investing in a network of computers to break encryption, when the key can be gained far more easily with a $20 tire wrench applied with sufficient force to the DBA's knee caps?

Having a cat named 1FD362BW9L6MBOWRD23SEF43 becomes a huge problem...

So, I could very well have my mother's maiden name be "panda porpoise flutist sandpile", but I understand what you're saying. It may not be for everyone, but I work in the security sector and usually over-paranoid is better than ill-prepared.

"What city did you meet your spouse in", "what was your first car" and "where were you born" are way too common of knowledge to work reliably. Security questions suck.

E.g.: "what was the name of the person you bought your house from?"

Really? Not only was that transaction about 15 years earlier, but I never even met the people. They moved out of town long before their house sold. Who the fuck cares what their names were?!?! Nowadays all that stuff is done through real estate agents and title companies.

So, while filling out an online form, I'm supposed to go rummaging through 15 year old records to find the names? And what if I stored those papers offline for safekeeping (e.g. at a bank)? How long will the question on the screen remain active before it times out?

There has to be a better way of doing these things.

Yesterday, my wife (same account) was locked out as well.

I'm wondering just how big of an issue this is.

I wrote off the account at that point and migrated a few accounts attached, but 2 weeks later the system let me enter a phone number to be able to log in.

Moral of the story: pay for support if you want it.

I had to deal with this a while back because TFA was enabled on my account and I got a new phone and number at the same time so my login options were all broken, and the recovery flow didn't work for the same reasons. Thankfully this was a Google for Work account so there was a way for me to prove domain ownership and they restored my access. If this had been my personal Gmail account (not attached to the domain), I would have had no way to recover it, partly because I couldn't prove ownership so easily, but mostly because they have basically no support for personal accounts.

Would that be the landing page? If so it asks a lot of 'company' type questions. Is there a personal landing page?

a) you're paying, if someone offers a free service that is shoving ads in your face all the time, tries to hijack your home page and lures you to install browser toolbars and whatnot. It isn't free, you generate revenue.

b) no service, free or not, should cause you to lose access to your data. While you might mumble "Backups! You should have those" that .. isn't exactly a decent reaction or something to tell a 70+ person either. Plus, the email address is an online identity. Tied into other services (password recovery there is now broken). Causing loss of future data, backups or not. If you provide a service like that, you should provide excellent ways to regain access to that in my world.

c) I'd probably (well, not me. I'd make her..) pay for a ticket. Given the option..

* Compare the security question's answer with a brain vs. strict equality ("Is the answer provided by the person essentially the correct one, spelling ignored?"). Right now the account is (forever?) inaccessible although the correct answer is known. It's a name of a place. She could provide GPS coordinates. For some reason she cannot come up with her original way of answering the question and you're very heavily rate limited, so she was able to try a couple variations only.

* Potentially validate the former password (if that is stored somewhere) or metadata ("I changed the password on day X, local time was around ...")

* Ask specific questions about account access or emails (last resort, but still better than losing the account forever imo)