My big mistake was to use 2FA - more precisely authenticator.

Around the same time my old phone broke and i had to change the password.

I must have mistyped the password while changing it in both fields and since then have never managed to re-access the account. I have old passwords, backup email, previous contacts, phone, ... But i cant restore the password because i hadnt yet set up authenticator on my new phone.

My fault? Probably. But that there's no way out, no option beyond the horrible restore wizard - that's Google's irresponsibility. How many millions must have lost access to their gmail accounts by now?

Backup codes and use of Authy (running on phone and desktop), instead of Google Authenticator, can help in such situations.

Authy on desktop sounds like such a terrible idea, though. Take that second factor and put it right next to the first.

How is this any different from what you have on your phone?

If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email.

The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.

Not sure I get it. 2FA does not protect anyone from someone having your password AND having your phone or desktop.

It prevents from someone, somewhere, having your password but not your 2nd factor.

If someone manages to put software on your desktop then they have access to your password and 2nd factor.

I mean, it's game over in pretty much any situation that your endpoints are compromised.

It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."

I'd still rather they didn't have direct access to my second factor in that situation.

But that’s your phone too. The second factor, is practice, having access to an active session on your device.

Alternatively if you dont want your keys stored in Authys cloud, you can replace Authy with AndOTP and export your keys in to an encrypted file which can be imported later back in to your phone when needed.

That's wahat I did for a while, but I heard Aegis takes security more seriously than AndOTP, so I use that now (both are available on F-droid).

AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone.

I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)

This happened to me ages ago and I was also unable to recover my accounts but recently I tried again, and I was able to recover 1 of my 2 lost accounts. The second one is pending. It seems Google has changed the process and after a semi-failed attempt to recover they actually pass it to a human. All my previous attempts ended in a stone walled error "We are unable to verify it is you", even when I was able to provide things like old numbers, old passwords or verification codes from backup emails.

Maybe try again. :)

One thing to note is that I was unable to access an old account for so long that it no longer has any old email in it.

If you can still read the email, you can likely find the first couple emails and use that to guess when you signed up?

Do you have ~15 year old emails available in gmail?

I don't think my earliest emails are available at all, I may well have deleted them, but even if they were, the device that remained logged in is over a decade old, uses POP or IMAP or something and barely functions. Not the gmail web interface, that's out of reach.

I wonder if signing up for Google One, which apparently comes with support, would possibly get access to a real person who could resolve the issue?

IMAP might do it via the "All Mail" folder? (Just a guess.)

Also, anyone who still can should print out Google backup codes and store them somewhere safe. Google Authenticator is not enough, because phones break eventually. A Yubikey is not enough, because they can break too.

> Also, anyone who still can should print out Google backup codes and store them somewhere safe.

The 2fa set up process for many websites (and iirc Google too) do not make this a priority. They should clearly emphasize the importance of saving the backup codes, and make you check a box that says you printed them. The 2fa should not be enabled until that is done.

I remember within the past few years when I was talking to someone who seemed to be unfamiliar with the idea of storing all your really important papers in a safe deposit box. I'm not sure if that's the times have changed, or the particular person I was talking to, or that it never was that standard.

Google Auth now enables you to export codes. I have the same authenticator on multiple phones at home (being a mobile dev i have a crapton of phones)

You need more than one Yubikey and probably three. Keep at least one somewhere reasonably remote and safe (lockbox, your parents' house, etc).

...not to mention there is or was an option to delete email automatically after downloading, that I used to use.