I had just the opposite problem - I've had the same phone number linked forever, but I left my backup email set to my work address at a previous job. I wasn't able to reset my password without access to the latter.

After about 5 years of occasionally flunking the questionnaire to prove I was me, Google relented and allowed me to update my password via a code sent to my phone and another sent to the gmail account itself.

Which is to say that I was saved by a device that had access to my original gmail for five years without ever asking for the password. Which doesn't seem like an example of sterling security.

This was the biggest eye opener for me, I used to think having a recovery email address would be enough to rescue my account. It turns out Google goes full on "spy vs spy" and can assume your recovery account is also compromised if it's secret algorithm decrees it so. It was such a relief to start the de Google journey and gain (some) control back.

This prompted me to make a plan to start deleting my gmail accounts today and shift to a new service. It felt pretty cathartic. For whatever reason, I could never unsubscribe myself from quora no matter how many times I tried.

I've started this process and it's surprising to see the number of services that won't let you change your email address without signing up for a brand new account.

You probably know this already but if you're making the effort to do this you absolutely must purchase a domain name that you own, it's the only way to make sure you'll never have go through this process ever again.

I recently had the same experience. They say, "try again later", but i kept returning a few weeks, nothing happened. Had to abandon accounts on some services as the result.

Then, three months later, I visited, and suddenly they've let me in. This is extremely annoying.

Oh, and I was visiting using the same IP address!

> Google's preferred 2FA method is the "Google Prompt," a notification Google pushes to your phone

Oh please no, no, no, no a million times. I shoudn't have to run Google services on my phone, I shoudn't need to have a phone, and my big heavy immobile desktop should BE a 2FA device of its own because it's much harder to steal. Don't make the use of a desktop require a phone.

The quote isn't true. This isn't in fact Google's "preferred 2FA method". If I need another factor (for example if I were to log into my Google account from some random device) I can just use any of my Security Keys or other means to do U2F/WebAuthn, which is - in fact - Google's preferred 2FA method.

Also, as the article already says, as does Google's announcement, this won't do anything at all if you don't have any suitable additional factors.

I had this happen recently but it had been previously tied to a phone number and I responded with it. And it appears to be locked permanently. Granted it is a pretty random side account and not that big of a deal, but that was an eye opener. I literally answered every challenge they gave me correctly and yet it is now gone forever.

I never agreed to this insane 4 factor authentication. I feel like google has locked me out just to reduce costs on its end.

The most annoying thing was that this was due to me changing my home router, which triggered an IP switcharoo from my ISP. Because it was a rarely used account Google freaked out. The more I tried to prove it was me the more it started sending me angry notices that it detected malfeasence and then boom.

This exact thing happened to me today as well. After waiting a few hours I've regained access to the account but can't change the recovery phone number because to get into that settings panel it requires me to verify it... with the old phone number.

I lost my Skype account the same way. I had been using it normally when suddenly one day it automatically logged me out, then when I logged in with the correct password it insisted on sending a code to a phone number that I have long lost.

What about homeless people who don't have cell phones and use Gmail accounts? Maybe they don't have a backup email?

There are free online SMS services

I've never had one of those work for that kind of stuff. I assumed they were all blacklisted by default.

All of them are blacklisted.

well, they get scroogled

I've met a lot of homeless people with cell phones

>Utilizing data from a study of 421 homeless adults moving into PSH, this paper presents descriptive technology findings, and compares results to age-matched general population data. The vast majority (94%) currently owned a cell phone. /.../ Most (85%) used a cell phone daily, 76% used text messaging, and 51% accessed the Internet on their cell phone. One-third reported no past 3-month Internet use.

https://www.researchgate.net/publication/315541163_No_Digita...

A friend of mine in the mid-90s was experiencing homelessness and had a "virtual home" via website, including some VRML code. Considering in that era few people were "on the internet", it's not a far leap to find someone experiencing homelessness in the modern era who own a cell phone

I also tried to log into an old gmail account. After I successfully verified my identity, gmail's final screen asked for a new phone number. My account never had a phone number; it wanted a new one. It wouldn't let me access my emails if I didn't acquire a phone and give them its number. I was glad that I didn't care about the emails in that account, or I would have no choice but to accept.

It really opened my eyes that google was willing to hold my emails hostage. Google's roadblock was unrelated to security, because an attacker could provide a new phone number too.

Is this secret question like "whats your favourite movie" etc or a question they generate that they expect you to know about your account?

I checked my account and I don't see any secret questions options.

It asked me for a secret question and answer when I signed up years ago. Didn’t make any difference though.

I lost a gmail account like that too. The telephone number is gone and I have access to the backup email address but the email address isn't enough, and it's gone.

Isn’t it great how they will let you sign up for an account with just a password then demand a phone number later on when you’re already using it.

Pretend you had this problem after you'd had everything stolen from you, including your apartment key, during your first day in Colombia lol.

This experience is what pushed me off Gmail.

That's the message I got the last time I tried to log into my google account. I'm so glad I had separate self-hosted email and didn't rely on anything from them.

whenever i reinstall a computer i have the same problem for like two weeks unless i just copy over the .mozilla directory from a previous install. and that's on an IP that is already accessing the same account on another computer. if you keep trying it may eventually work, but maybe not

Google is the biggest security risk for a lot of people since a lot of people throw their whole lives on Google - Google has to defend against literally the most dedicated attackers trying to hack political officials and fortune 500 executives alike. It's obvious that, at their scale, they're going to have a lot of false negatives and false positives. Even a 99.99% success rate of detecting fraud would mean millions of false positives or negatives locking people out of their account or allowing illegitimate actors into accounts. It's also the reason why they don't have general account support besides an account recovery process that only sends requests to humans under very specific circumstances: humans are bound to have an even worse success rate than the machines at preventing illegitimate access.

I think it's obvious that Google is too big, but it's not like they can help it. Capitalism in the internet age requires constant growth if you want to maintain your company's value, which is a large part of why they can't turn people away from their service. The best they can do is require a phone number to sign up and limit the number of accounts a phone number can be associated with (which they already do).

Isn't this why they have their advanced threat protection thing? So people who aren't political officials or fortune 500 execs don't get that treatment?

> Capitalism in the internet age requires constant growth if you want to maintain your company's value

Craigslist is doing fine with a small number of employees and no need to grow.

They don't have shareholders or a private equity firm requesting growth, so they don't have to grow. If they did, you'd see a renewed interface, ads more vaguely differentiated from regular results, and an ebay-like payment system. It's the difference between optimizing for maximum profit vs. optimizing for longevity.