I’m in a similar position except I know my password. Google decided for whatever reason that my location was too different and now requires that I verify via a phone number I no longer have. I have access to the recovery email and even get ‘suspicious login prevented emails’ at the recovery address. I tried working through google support and was given a form to fill out but never heard back.

I should have kept that number until I updated it yes... but I thought knowing the password and having the recovery email would be enough.... guess not.

But yeah... fuck you google.

Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system, it is a design for randomly fucking me over. If your system is designed to fuck me over, I would prefer to use something else, thanks.

It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it.

From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices.

Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.

The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.

This is what iNUM was supposed to solve. Sadly it didn't take off.

I know nothing about voip providers and this makes the setup sound scary to me.

I'm going to try and onboard this thinking into my life.

What is the alternative to Gmail? Genuinely interested. I'd be willing to switch if I found a future-proof email solution for both personal and business usage.

Step 2, Fastmail, Protonmail M$, ... will be happy to offer you email for few € a month. If you'd desperately need to save money on that, there is Czech provider Seznam.cz that offers email on custom domain for free. Only issue is that the registration is in Czech, but Google Translate your friend: https://emailprofi.seznam.cz/login It's like a biggest local internet company, not totally random provider, so should not just steal data or disappear right away and works reasonably.

All in all I've enjoyed their services. Their security/E2E Encryption support is nice (could still use a bit more functionality though) and they are definitely a lot more FOSS friendly than Google when it comes to actually using their services.

I actually pay for ProtonMail now and I'm in the process of moving all my communication to it. My Google account will stick around, but I'm diversifying my dependencies and it feels so good.

Never had a problem, and allows up to 3 aliases at a time that can actually be completely different instead of Gmail's useless [email protected]

(&yes, I use Gmail for junk or transactional stuff; need the acct for an Android mobile, and their UI is a horrific kludge of UI conceits trying to showcase their 'mad design skilz' - yuk!)

I would just suggest people think about what might happen if Fastmail gets enough of a userbase to be the next Gmail.

Apple iCloud for personal use.

I honestly think it's a much better approach to email. One of the key issues with having an email address is that anyone who knows it is granted permission to get your attention, whereas with HEY you get rid of that problem for the most part but without having to 'program' your inbox.

[0]: https://hey.com

Depends on what you're searching, there is also the perspective that YT is a vast library of content that would never have appeared on TV, such as lectures, talks, conferences, courses, demos, gameplay, cooking, home improvement, product reviews, obscure music. It's the library of Alexandria of modern age. I would be devastated if I lost access to it. Wikipedia and Arxiv are complementary collections.

(In Newpipe you can subscribe to creators' channels, see the comments and their other videos. You just can't comment from there.)

That's just the algorithm. There's still some amazing content on Youtube, but the algorithm will always try to offer you junk food. There are various ways to avoid this, but it becomes a problem for ditching Youtube. The positives are too enticing, and don't yet, at least for me, outweigh the negatives.

I generally hate suggesting a browser plugin to solve a problem with a service, but give this a try: https://github.com/SeinopSys/YTMySubs

You can no longer visit the home screen. Any attempt always redirects you to the subscription view. And from there, it simply becomes a matter of only subscribing to worthwhile channels. I've found it improves my Youtube addiction quite a bit.

It's been about a month.

I have a very short list of companies, the collapse of which I'd celebrate with a party, and Google is vying very successfully for that top spot against some pretty reprehensible competitors.

I'm pretty sure I even have the correct password, but it thinks my login is suspicious since it's from a new/unfamiliar device so requires me to further authenticate myself except I no longer have access to the phone number associated with it. I'm fairly sure I have the answers to the security questions as well as have succeeded at the other recovery options, but best I've been able to get is "try again later".

The email is being forwarded to another address of mine, so I can still receive email I just... can never actually get into the account ever again. Thankfully I don't/didn't ever use it for anything all that important.

I wish that there was a way to disable those "protections".

Do not use Google! It's as simple as that. I have never had a Gmail account until an Android device sort of forced it on me, because I definitely didn't want to link things up to my real email address, so I just signed up for the whole thing. Do I ever use that email address? Definitely not! Why would I?

What happens if I ever loose access to that account? I have to register a new one for my Android device(s). Boohoo.

Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. No longer have a PC and do everything including your banking, gaming etc. with the tablet (i.e. things you really need or things you paid a lot of money for)? Well, welcome to the walled garden where Google practically owns you.

I do think there is substantial room for a kind of "major provider reset" service, similar (at least) to what banks do physically. Lost your account access? You need to GO to a place, be on video, have an ID check done, multiple forms of whatever identification. It costs to do this kind of thing, and as a last resort I'm pretty sure most people would want to pay it, instead of losing account access.

Your argument seems to be "It would be massively inconvenient to lose access to these things so instead I will not have these things."

I really need to transition more things off of the Google ecosystem.

If you loose access to the account for that 'thing', sure you're screwed with regards to that 'thing'. But it's just one of the eggs in your basket.

If you do _everything_ through Google, then Google is your basket full of eggs and if you don't play ball with the basket, it will take away all your eggs.

Pleco is a necessity for me, but it's not tied to the Google account. It has its own registration system.

Same goes for WeChat.

The Android Kindle app isn't really a necessity, but it's desirable. It, too, has its own registration system. It's certainly tied to my Amazon account, but not to my Google account.

I do the same actually and don't use apps or services that will only allow you to "Login with Facebook", "Login with Google" etc.

(This isn't a defense of Google's behavior, just a comment on things that are actually within the end user's control.)

This doesn't work for services that send SMS 2FA codes and the like from a shortcode (as Twilio does not support receiving those), but Google appears to send from a longcode, so it works there.

Not saying that this isn't at least partly on Google, they should have responsive customer service that can verify accounts - but you could have easily prevented that by being less lazy with keeping your data up to date. Security and account recovery is the one thing you shouldn't cheap out on.

In the UK you can take your mobile number with you between network providers and they're not tied to your location.

That way, you can keep your old number for as long as you keep the SIM topped up (once per year where I lived).

And I don't think this is unreasonable. The country code and phone number format is different (10 vs 8 numbers). Most non-spam calls I get are from somewhere else in Norway. I'm going to guess you could keep the same base number so long as the format is the same (between Canada and US, for example) - but that country code would still change

When you set up MFA, it doesn't provide TOTP as an option. If you enable it with a phone number/SMS MFA, you can go back into the MFA options and add a TOTP device then remove the SMS option.

Of course, at that point they still have your phone number...

Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!

No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page.

They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.

Fuck you google.

Happy Edit: Following your post and just for the fun I tried to log back in and instead of the usual error message Google asked me to enter my full recovery email address. Then, I had to enter a valid phone number and to create a new password. I HAVE ACCESS TO MY ACCOUNT AGAIN!!!!! I don't know how the fuck it worked but if you're in the same position try to log again in a few weeks. What I did the past few months: fill out the Gmail recovery form. (no impact). Bought Google One and asked for support at least 3 times (no impact). Tried to log back in multiple times over the course of a month or two (no impact). Thought the account was toast, I was looking to alternative solutions but I tried again and it fucking worked!

They requested to send the confirmation code to a phone I do not have anymore. I replied the "security question" correctly. Then I had to provide the recovery email I once set up. Which I forgot.

So yes, I should have kept that up to date but it would not be difficult to prove I own the account (my usual google account pulls from that unavailable on for years) - it is just that there is nobody at Google to contact and have a look.

I will seriously look into fastmail or protonmail, despite being with Google for 14 years

Maybe I'm on thin ice..

This, btw, is what I think caused me to lose a Google account.

It was an old one I was checking very rarely, someone reset my (strong!) password from a phone. I reset it again, along with the questions, thought I was fine.

They once again reset it and then Google's recovery page was not letting me do anything, apparently I was the suspicious person. Oook Google.

This has also happened to me when using MVNO carriers (Cricket, for example).

It can be set up to forward inbound texts to another number, or you can see them via the app.

I haven't had the "blocked" issues others have, and.. in the case of the IRS, I do have someone who files my paperwork for me.

I've seen this before too. A huge problem right now is the massive tech companies want an unreasonable view into your life. They want your identity, phone number, photo id, location history, credit history, etc. before they'll treat you like a real person.

If you think I'm joking, spin up a transient environment, connect to a VPN, and try to participate online without linking all of your accounts to a piece of real world identity information that, in turn, can be linked to all the other things I listed above. You can't even get an email address without a phone number.

Part of the issue there is the huge tech companies are abusing their market positions to assign bad reputation to the IP blocks owned by everyone else. You can't use a VPS for ANYTHING but incoming connections because the IPs are flagged all by Google et al. How do you run an API server that needs to make any outbound connections if Google, Facebook, Microsoft, etc. all consider the IP block tainted? I guess you just need to buy your IPs from Google, right?

That's exactly the same tactic Google used with GMail. The original spam filtering was super aggressive and shitty and the solution, according to Google, was to use GMail instead of other providers. "Get a big provider" is a very poor answer to a question that has a technical solution IMO.

> My mailserver is marked as spam by gmail

Have you tried GSuite (or whatever they're calling it these days)? /s

Now, a scammer is trying to access your e-mail account. What level of proof do you want them to have to offer Google to get ahold of that e-mail?

These tech companies are not asking for an "unreasonable view" into your life as long as people are using these products to interact with the real world. They are trying to strike a balance between convenience and security that meets real-world needs. And they are trying to set that balance point somewhere where it works reasonably for the majority of their non-technical users, not for the edge-cases and not for people who think LARPing as a 90's cyberpunk novel is the most important usecase. So, yes, so long as the vast majority of GMail users are using their GMail account in a number of ways that intersect with the real-world financial system, they are going to want some way to verify your real-world identity if you lose the log-in credentials to your account.

If you need to reset your bank credentials (not solely a password - some form of second factor is universally required), it can't happen electronically without involving the real world; either you come to a branch with proper ID or you get mailed them to your registered physical address.

I mean, no matter what you do, you have to have some root of trust / root of identity, and it needs to be backed by (and verified in) the physical world - so you either have to do it yourself or delegate it to someone whom you'd trust a lot (i.e. not a random email provider). If a trustworthy universal government ID is available (which is a problem in some places, like USA) then that is a natural solution to that.

Alternatively, an institution is free to trust people remotely, putting effort into fraud monitoring, and taking on whatever risk their trust and processes enable - e.g. we've had some financial institutions verifying passports over videochat in such cases; I have no strong opinion on how safe or risky that is, but presumably the institution has considered the risks very carefully and found them both acceptable and necessary (in that case, sending a scan/photo/picture of the same document was not allowed, it was specifically about live videochat) - which is the key part of the whole thing, the alignment of incentives and responsibility for that risk.

If the consequences of these security risks fall on the users, then the users have to worry about security while financial institutions just wiggle their ears and blame "identity theft". If the consequences fall on the institutions, then the users can stop worrying about the things they mostly can't influence, and the institutions magically design their processes and workflows carefully so that they actually prevent fraud (since it's their own money at stake) and they're forced to implement decent solutions to any tradeoff between usability and security, since their profits depend on both.

Incidentally, in my country, there is a government-mandated (everyone has it) single sign-on solution that companies can use if they want to really know who someone is. The implementation isn't perfect and unfortunately they're starting to nudge people into using an app (that can only come from an app store, creating a sort of catch-22) instead of one-time pads, and there's a lot to complain about there. But I think the principle is completely reasonable, that just like we have passports, birth certificates etc., governments absolutely need to enter the digital era and provide modern forms of identity services. This is yet another area where everything moving to the internet has led to privatization through the back door, and I fear the world where some American company can turn me into a digital unperson much more than one in which my government can.

I used to have two email accounts, one something I registered for fun (and my main email), other with my name+lastname@gmail. I set up forwarding from second one to first one, then I forgot the password.

I tried to login probably a decade later last year. Couldn't remember the password. Asked internally if someone could help. They said they can't(they can easily verify who I am if they wanted). I asked them to send a password reset to the same email ([email protected] gets password reset email for [email protected]), they said they can't do. This would have worked for me due to forwarding, but no...

Something's at google are great. Support is not one of them.

I just had the same problem with my dad and even though he can send and receive email from his gmail account they still won't tell him the password. All he has is the fragile oauth token on mail.app on his apple smart phone that can only connect via wifi due to the loss of the old phone number.

Additionally, my mail from my independent mailserver just started being marked as spam by google (exactly when I sent mail to noaa.gov and fireeye's internal system was borked due to their solarwinds problems http://superkuh.com/spf-google-fuckery.txt). I signed up for google's postmaster tools set my DNS TXT records but apparently I don't send enough mass mail to not be a mass mailer.

The Google support people should have mentioned it, but hopefully, they wouldn't be able to tell him the password without investing tens to hundreds of thousands of dollars in cracking the hash.

https://plaintextoffenders.com/

I'd hope the phone tech support understand the goal was to regain access to the account, through a reset or whatever mechanism, and not to just know the password. But maybe if my dad worded it like I did the same confusion could've happened.

We're talking about giving out a forgotten password, not getting access to email contents.

I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.

They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.

If it was, then someone forgetting to log out on a machine they didn't own could be a much more serious problem than it is. Rather than just temporary access to the account that the true owner has the ability to revoke, it could result in a completely stolen account.

And I have a theory. My theory is they did the risk benefit analysis of all this and decided this was the best way to go. I think the the hole that opens up when you are open to appeals and special cases is too great, the bad press from one bad case is so bad that it's ok to ignore all the folks who have lost their accounts. I mean, what other explanation, what other reason can there possibly be for this?

Edit: also consider setting up a mail forwarder to another address you own if you can from the app UI, I would do this on a test account first in case it forces you to reauthenticate, as it can be a suspicious action.

[edit: I wonder how many of the down voters have actually sent email to a government agency using Gmail or dealt with some of NSF email issues firsthand?]

How would you split Google into entities that won't go bankrupt within a year? ( And you wouldn't want that because it would piss off people and would help the cause of the anti-regulation and anti-government uneducated people). Maybe GCP, Android foundation, YouTube, rest of Google could work, but the "rest of Google" is still too big and too powerful.

Forcing them to open their data and platforms ( e.g. allowing other ad networks to access Google's tracking data and to serve ads via them) could diminish their monopoly, but it could also diminish their profits and force them to cut some less profitable parts of the company even more ( and that might be good).

Same thing with Facebook, just a bit easier - splitting off Instagram and Whatsapp will absolutely improve things, but the remainder is still to big and powerful. Twitter is even worse, you can't split anything.

Anti-monopoly laws and frameworks need to be updated for the modern world, because the logic that worked for physical assets, sales and infrastructure ( e.g. the US split oil companies and telcos along physical lines) no longer works for Internet companies.

Many power companies have government enforced monopolies across the US. They also are heavily regulated and limited in what they can do to prevent them using their monopoly to extort, abuse, or neglect consumers.

Made an account about 10 years ago with email address x, mobile telephone number y, bank debit card z with some security questions thrown in.

I cannot remember my password from 10 years ago so I need to reset it.

If I try to reset it, they want to send me an sms otp to the mobile number from 10 years ago which I no longer have. Obviously I cannot update the mobile number if I cannot log in.

Another option they give me is to enter some portion of the debit card number that was linked to the account. I no longer have that account from that specific bank, nor have the old cards laying around.

Another thing they offered was for me to fill out the answers to the security questions, but I absolutely hate these and always fill in random characters by mashing my keyboard, so no go here.

In their help guide they say you can contact support if you cannot log in at all, but you have to log a support ticket.... which requires me to log in. Last time I gave up after 30 minutes of poking around their site to try and find a way to speak/email a human that can help me get back into the account, since almost every path leads back to the login screen which wants my debit card number from 10 years ago.

So I've started ignoring paypal now. All their emails that I still get goes in the trash and I will never use them again. Keep in mind this was a business account linked to a business bank debit card (it was the only way back then to link to an account in my country, and only one bank offered the integration, since then things have become much more reasonable (cheaper business credit cards = international ease)).

I'm fully willing (well not anymore) to send them a copy of my national id card to unlock my account while we speak on the phone, but they seem to have no path to support their clients unless logged in. Maybe its been fixed by now but I no longer care about it enough. If you build systems with an auth mechanism, please cater to all the unhappy paths your clients might fall into. I'm not one of those people who will go scream on twitter to get help, I just silently walk away and you lose a client. It's that simple. I'm not expecting them to treat me like a king, I just wanted to log into their site, that's all.

> Another thing they offered was for me to fill out the answers to the security questions, but I absolutely hate these and always fill in random characters by mashing my keyboard, so no go here.

This should go as a cautionary tale to always use a password manager. I, too, hate insecurity questions. But instead of mashing keys, I generate unique passwords for them and use the question as a username. Then save them in there as well.

On principle I will not ever supply Security Questions with real answers, they are rubbish. Most of them you have to answer exactly correctly (spelling/casing), so you are biased to use simple one word answers that any of you family members or close friends can guess.

I prefer 2FA, but back then offline 2FA wasn't that big of a thing and most sites only supported 2FA via an sms otp, if they even supported it (aka justified the financial costs).

I've been burned by that logic at several companies. It's really infuriating. I've even had one where they had a phone number to call for support, but the phone number was locked away behind a support login screen.

My friend dropped her phone in the Uber vehicle about 1.5 years ago, so we phoned Uber support whom insisted that we log into their website to log a support ticket... BUT, in order to log into their site, you have to enter the otp sent via sms.. to the phone that is in the car. Took the support lady a few attempts to understand that we cannot log in.

We rand her phone twice, within 10 minutes of realising the phone is missing. First time it rang, second time he switched the phone off.

Eventually we managed to talk to the driver, but he insisted that there was no phone in his car. We never got the phone back. When we asked Uber support again what can we do, they rambled stuff about drivers being Independent Contractors etc. I personally haven't used Uber since that day. She still uses Uber.

We couldn't track her phone because it took 6 days to do a sim swap, again, needing to receive an otp from Google to login to track the phone, but by then it was off.

I used Uber Eats earlier this year and an order took 2 hours (it was obvious the guy is using more than one delivery app), same story from Uber support. Haven't used it since.

You tried calling the phone, and it didn't work. I guess the next step is going to the police.

It's likely not about ipv6, but instead it's about your ipv4 having bad reputation in the past. Basically you changed your source address to a cleaner one.

My current IP shows "0 - low risk" with that tool. Grabbing a random PIA IP shows "93% - Abusive IP" with a warning about being a high risk proxy connection. The random VPN IP is also on SPAM blocklists.

I'm guessing a huge portion of cheap shared hosting is the same.

1. https://www.ipqualityscore.com/ip-reputation-check

It very well could be. That wasn't an endorsement by any means. The problem from what I can see is if services like that are convincing CTOs to use their lists it becomes relevant (even if the info isn't accurate).

Edit- The IP my employer uses as its outbound nat IP that we vpn from while WFH (so it actually is a proxy) gets a clean bill of health while our corporate email server (not a proxy at all) is tagged as one.

If you're running a serious mail service your IPs don't change that much. Not only will you have a pool of IP addresses just for that reason, you'll also likely need a few unused ones for when one of your users tanks your reputation and you have to roll them.

Nobody taking real money for email will use a randomly assigned IP as source. (unless it's randomly selected and then tested for reputation before use) Mailgun and other services even allow you to book a dedicated IP just for your outgoing emails.

Turns out, when you use free services, you don't get support, but when you pay them even just like ~$1/mo (I think my Google One for more photo space in the cloud is $15/yr?) they'll pick up the phone and answer anything.

But that's true of nearly all consumer level support in all industries. Businesses pay big dollars for consultants and service level agreements for access to the higher level folks.

I recently started using the startup https://hanami.run to forward my mail. It's a brand new startup that I read about here on HN and the creator is super helpful.

Edit: I realize that parents Mom and my Mom are not going to do this, but us Hacker News types should.

At the moment I'm with Fastmail, but the pricing isn't so competitive

Not according to this page:

https://support.microsoft.com/en-us/office/use-your-own-doma...

It's actually a very old problem [0] introduced by Google in 2013. There are different workarounds depending on the MTA you use. Whenever you set up a new mail server you need to go through an increasingly longer checklist and it includes dealing with this issue.

[0]

The password reset also supports a backup email along with a ‘when did you sign up for this account’ question - for me the backup email was not working. I was able to derive the creation date via an email to my account (which was the backup email address). For me, the backup email function wasn’t working, thus sniping the mobile number from a provider was the solution.

Now I use GMail as secondary email address along with my other emails, and avoid to use google docs.

On my home network I installed PIHole and it works quite well.

I live with no fear of banning and I am free to express my idea on my self hosted wordpress blog, and decide what to advertise in total freedom.

I was very happy with the proceedings. This happened twice over the last 10 or so years.

Kind, professional, knowledgeable & acting according a strickt rulebook that tries to prevent social engineering as good as possible.

I love google :)

An unencrypted token is just as vulnerable as an unencrypted password.

But if the stream isn't encrypted then it doesn't matter. A robot can easily collect the token and utilize it before the token expires.