Literally, you are giving your account to the phone company.

I'm more convinced by the printed security codes. I have encrypted copies in several storage providers, and that includes publicly-accessible copies. I have a copy in my safe, I have some in my family's safe in a different country. No phone company involved.

It's a similar story with the "recovery email address" they let you add to your account. You'd expect that if you have access to that recovery email you'd be able to gain access but no, there are cases where Google refuses to send any recovery email because "we can't verify this account belongs to you at this time" so no recovery email for you.

This would all be fine if they didn't enforce we have to have 2FA enabled and then refuse to provide support even when you're a paid up member. [1]

[1]: https://news.ycombinator.com/item?id=31073302

Now I use paid email services.

I use both Authy and Bitwarden

Its the same with your address, what if your landlord randomly decides to kick you or your house burns down? Where I live my mobile number is very secure and will not change until I fuck up very hard. And in this case I have multiple other backups (printed codes, rescue number).

Not the same at all, you can just go to the post office and file a forwarding address and all is well.

Phone numbers are very ephemeral. I have many phone numbers associted with many older accounts, like one from an office phone from a company that doesn't even exist anymore. Learning from those lessons, I go out of my way to never associate a phone number with anything anymore, it's just asking for future pain.

If Google actually gave options to its users instead of babying them and pressuring them to give up all their personal info (like EVERY OTHER EMAIL PROVIDER), this would not have been a problem. Google clearly cannot be trusted with anything of value.

"Because I've been warned by security conscious people never to use phone number as a 2FA because it's so insecure, and using it as a recovery option seems to create an even weaker link.". I happened to read so many articles in the recent past of SIM Swapping, that I was afraid to use my cellphone number as 2FA and removed it from my gmail account. What with Google being evil and all

Sadly you read only one part of the warning from security conscious people. The main part is to get U2F/FIDO key or use QR-code/authenticator. The same security conscious people use Fdroid/AndOTP where you can export all your 2FA codes.

There NO reason to say if I shatter my phone. Yes, you can also print recovery codes and keep it at home.

Select forgot password; the it asks Insert U2F Key. Then recovered. Yes, it may be that if one loses U2F key in Metro it is dangerous but some risk is always there. (i.e) how many times have you lost your key in your life? If more than one per year then keep one U2F at work and one at home.

SIM-swaps are easy but do not scale. This means that they don't actually affect a lot of people. The improvement in security posture from SMS 2FA to TOTP is actually fairly small, because both lose to phishing and phishing is orders of magnitude more common that SIM-swaps or malware that steals SMS codes.

As a solo recovery option, it is indeed a more meaningful risk. But we also observe that people just lose their accounts all the time if they don't have a phone-based recovery option so I do understand why the option is offered.

To be clear, 2FA != account recovery.

I only used that account for communicating with one friend, [our mail hosts were blocking each other in some kind of spam war tit-for-tat] now deceased, so it was no great loss to lose the account, but rather annoying that they pretend harvesting phone numbers is some type of "authentication."

All of this is so that they can mine phone numbers for older accounts. Now they require a phone number by default.

It makes sense to add a way to recover access to your account if you fear that you may forget your password. It makes no sense to give google your phone number just in case they may out of nowhere decide that you look suspicious (for using firefox? moving to another country? something else?) and reject authenticating you despite being able to enter your password correctly.

"you should not have used their service for your whole life's activities anyway"

You should not do that in general as Google is extremely unreliable. I had given them my phone number for my account but this did not help. I posted about it at https://news.ycombinator.com/item?id=30544030 a few months ago.

Why should the reason you need to recover the account matter?

If the account is important to you, wouldn't losing it be equally bad regardless of whether you lost it because you forgot your password or you lost it because Google did something annoying?

It might sound rude, but people have to learn a thing: only things you really own are yours, the rest might be there or not, might be good or bad, but it remain something ephemeral, not to be trusted for anything. And that's why we MUST stop connected-devices to fill our life from cars to home doors: we do not really own them and we should.

This is blaming the victim instead of the ham-fisted limitations imposed by google.

There is no justifiable reason for google (or any of the cloud companies) to be imposing their arbitrary account locks on users.

I should be able to configure my gmail account with a setting that says never ever require anything other than my password to access it, because I know my password is strong and well protected. I don't want any of these misbehaving AI detections locking up my account for reasons that I don't want.

If someone else want to configure their account with these trip hazards, more power to them, but it's not ok for these cloud companies to impose it.

Another reason why I mostly self-host everything, but for less technical people who are not able to do so it's a huge problem. Let's not blame the victim.

We need a federal law that two factor authencation needs to work on landlines.

The technology is there. It's not expensive either.

PS stop validating their top-down model by referring to SMS nags as "2FA". It's snake oil for the corporate motive of demanding identifying information.