The main problem is that Google asks you for a recovery email address and then won't actually let you use it for recovery. This gives a false sense of security and creates a lot of gotchas.