Building proprietary, impossible-to-understand Rube Goldberg mechanisms based on associations between accidental aspects of my life (location:phone number pairs, for instance) is not a security system, it is a design for randomly fucking me over. If your system is designed to fuck me over, I would prefer to use something else, thanks.

It is a system for building better profiles of potential targets for advertising. Gathering data is a means to improve online advertising services to Google's customers. The more data you volunteer, the more their online advertising services can potentially improve. That is one way to look at it.

From another perspective, all the "security" measures are a red flag for me that Gmail accounts are high risk if using for important, personal matters. (And that people are increasingly using it for such things.) The available solutions to that problem from the user's perspective should include the option to stop using Gmail, not simply to support Google's rollout of the next set of Kafkaesque "security" processes that incidentally always require more privacy sacrafices.

Giving me a notice that a User-Agent header changed (by suggesting they have detected a "new device") is not my idea of "security", but it reminds me that this data point is among the ones they are collecting for their online advertising services. It makes me wonder what assumptions and proclamations someone might be making based on such "evidence". I did an experiment where I saved a session cookie for an account I registered and used it outside the browser weeks later, without any User-Agent header. It worked flawlessly and I got no warnings of a "new device". Makes one wonder what is in that cookie and how long it will last. Is it restricted to IP address/location. If it never expires, then if an attacker ever gets a session cookie and the user never logs out of that session, the attacker will be able to "silently" use the account, forever. Yikes.

The capriciousness that one often finds on a company like Google that means whatever they allow now isn't necessarily going to be honored in six months.

This is what iNUM was supposed to solve. Sadly it didn't take off.

I know nothing about voip providers and this makes the setup sound scary to me.

I'm going to try and onboard this thinking into my life.

What is the alternative to Gmail? Genuinely interested. I'd be willing to switch if I found a future-proof email solution for both personal and business usage.

Step 2, Fastmail, Protonmail M$, ... will be happy to offer you email for few € a month. If you'd desperately need to save money on that, there is Czech provider Seznam.cz that offers email on custom domain for free. Only issue is that the registration is in Czech, but Google Translate your friend: https://emailprofi.seznam.cz/login It's like a biggest local internet company, not totally random provider, so should not just steal data or disappear right away and works reasonably.

All in all I've enjoyed their services. Their security/E2E Encryption support is nice (could still use a bit more functionality though) and they are definitely a lot more FOSS friendly than Google when it comes to actually using their services.

I actually pay for ProtonMail now and I'm in the process of moving all my communication to it. My Google account will stick around, but I'm diversifying my dependencies and it feels so good.

Never had a problem, and allows up to 3 aliases at a time that can actually be completely different instead of Gmail's useless [email protected]

(&yes, I use Gmail for junk or transactional stuff; need the acct for an Android mobile, and their UI is a horrific kludge of UI conceits trying to showcase their 'mad design skilz' - yuk!)

I would just suggest people think about what might happen if Fastmail gets enough of a userbase to be the next Gmail.

Apple iCloud for personal use.

I honestly think it's a much better approach to email. One of the key issues with having an email address is that anyone who knows it is granted permission to get your attention, whereas with HEY you get rid of that problem for the most part but without having to 'program' your inbox.

[0]: https://hey.com

Depends on what you're searching, there is also the perspective that YT is a vast library of content that would never have appeared on TV, such as lectures, talks, conferences, courses, demos, gameplay, cooking, home improvement, product reviews, obscure music. It's the library of Alexandria of modern age. I would be devastated if I lost access to it. Wikipedia and Arxiv are complementary collections.

(In Newpipe you can subscribe to creators' channels, see the comments and their other videos. You just can't comment from there.)

That's just the algorithm. There's still some amazing content on Youtube, but the algorithm will always try to offer you junk food. There are various ways to avoid this, but it becomes a problem for ditching Youtube. The positives are too enticing, and don't yet, at least for me, outweigh the negatives.

I generally hate suggesting a browser plugin to solve a problem with a service, but give this a try: https://github.com/SeinopSys/YTMySubs

You can no longer visit the home screen. Any attempt always redirects you to the subscription view. And from there, it simply becomes a matter of only subscribing to worthwhile channels. I've found it improves my Youtube addiction quite a bit.

It's been about a month.

I have a very short list of companies, the collapse of which I'd celebrate with a party, and Google is vying very successfully for that top spot against some pretty reprehensible competitors.

I'm pretty sure I even have the correct password, but it thinks my login is suspicious since it's from a new/unfamiliar device so requires me to further authenticate myself except I no longer have access to the phone number associated with it. I'm fairly sure I have the answers to the security questions as well as have succeeded at the other recovery options, but best I've been able to get is "try again later".

The email is being forwarded to another address of mine, so I can still receive email I just... can never actually get into the account ever again. Thankfully I don't/didn't ever use it for anything all that important.

I wish that there was a way to disable those "protections".

Do not use Google! It's as simple as that. I have never had a Gmail account until an Android device sort of forced it on me, because I definitely didn't want to link things up to my real email address, so I just signed up for the whole thing. Do I ever use that email address? Definitely not! Why would I?

What happens if I ever loose access to that account? I have to register a new one for my Android device(s). Boohoo.

Some of this obviously requires 'abstinence' and not having the same 'cool toys' as other people. I.e. if I buy lots of fancy apps that I actually rely on for my daily life, then loosing this Google Account will hurt. No longer have a PC and do everything including your banking, gaming etc. with the tablet (i.e. things you really need or things you paid a lot of money for)? Well, welcome to the walled garden where Google practically owns you.

I do think there is substantial room for a kind of "major provider reset" service, similar (at least) to what banks do physically. Lost your account access? You need to GO to a place, be on video, have an ID check done, multiple forms of whatever identification. It costs to do this kind of thing, and as a last resort I'm pretty sure most people would want to pay it, instead of losing account access.

Your argument seems to be "It would be massively inconvenient to lose access to these things so instead I will not have these things."

I really need to transition more things off of the Google ecosystem.

If you loose access to the account for that 'thing', sure you're screwed with regards to that 'thing'. But it's just one of the eggs in your basket.

If you do _everything_ through Google, then Google is your basket full of eggs and if you don't play ball with the basket, it will take away all your eggs.

Pleco is a necessity for me, but it's not tied to the Google account. It has its own registration system.

Same goes for WeChat.

The Android Kindle app isn't really a necessity, but it's desirable. It, too, has its own registration system. It's certainly tied to my Amazon account, but not to my Google account.

I do the same actually and don't use apps or services that will only allow you to "Login with Facebook", "Login with Google" etc.

(This isn't a defense of Google's behavior, just a comment on things that are actually within the end user's control.)

This doesn't work for services that send SMS 2FA codes and the like from a shortcode (as Twilio does not support receiving those), but Google appears to send from a longcode, so it works there.

Not saying that this isn't at least partly on Google, they should have responsive customer service that can verify accounts - but you could have easily prevented that by being less lazy with keeping your data up to date. Security and account recovery is the one thing you shouldn't cheap out on.

In the UK you can take your mobile number with you between network providers and they're not tied to your location.

That way, you can keep your old number for as long as you keep the SIM topped up (once per year where I lived).

And I don't think this is unreasonable. The country code and phone number format is different (10 vs 8 numbers). Most non-spam calls I get are from somewhere else in Norway. I'm going to guess you could keep the same base number so long as the format is the same (between Canada and US, for example) - but that country code would still change

When you set up MFA, it doesn't provide TOTP as an option. If you enable it with a phone number/SMS MFA, you can go back into the MFA options and add a TOTP device then remove the SMS option.

Of course, at that point they still have your phone number...

Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!

No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page.

They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.

Fuck you google.

Happy Edit: Following your post and just for the fun I tried to log back in and instead of the usual error message Google asked me to enter my full recovery email address. Then, I had to enter a valid phone number and to create a new password. I HAVE ACCESS TO MY ACCOUNT AGAIN!!!!! I don't know how the fuck it worked but if you're in the same position try to log again in a few weeks. What I did the past few months: fill out the Gmail recovery form. (no impact). Bought Google One and asked for support at least 3 times (no impact). Tried to log back in multiple times over the course of a month or two (no impact). Thought the account was toast, I was looking to alternative solutions but I tried again and it fucking worked!

They requested to send the confirmation code to a phone I do not have anymore. I replied the "security question" correctly. Then I had to provide the recovery email I once set up. Which I forgot.

So yes, I should have kept that up to date but it would not be difficult to prove I own the account (my usual google account pulls from that unavailable on for years) - it is just that there is nobody at Google to contact and have a look.

I will seriously look into fastmail or protonmail, despite being with Google for 14 years

Maybe I'm on thin ice..

This, btw, is what I think caused me to lose a Google account.

It was an old one I was checking very rarely, someone reset my (strong!) password from a phone. I reset it again, along with the questions, thought I was fine.

They once again reset it and then Google's recovery page was not letting me do anything, apparently I was the suspicious person. Oook Google.

This has also happened to me when using MVNO carriers (Cricket, for example).

It can be set up to forward inbound texts to another number, or you can see them via the app.

I haven't had the "blocked" issues others have, and.. in the case of the IRS, I do have someone who files my paperwork for me.