That link involves someone with no backup email address connected to their google account for recovery purposes, for what it's worth.

You can set a backup email address for Google accounts if they're using Google email addresses, but you can't do this if they're using non-Google email addresses as the primary address, such as the one in that link.

I'm logged in to such an account right now and there's no way to do this. The account primary email is also set as the recovery email address and there's no way to add another.

It's actually deceptive to the user to even call it a recovery email address in this case, since Google will never offer to alternatively send a verification code there if the 2FA device is unavailable.

I lost access to a Gmail account for which I had the correct password and a recovery email with a different email service. I was still unable to convince the Google machine that the account was mine. My suspicion is that because I'd changed operating systems on my desktop, I appeared to be 'someone else' as far as Gmail was concerned.

I took three steps against this happening:

  1) Not providing phone number for 2FA. Never.
  2) Using multiple (3 pcs.) physical keys for 2FA (like Yubikey and similar). Authentication app is an alternative for one choice of 2FA (but not the sole one!)
  3) Only using a limited set of Google functionality. Use for secondary purposes mostly.

Well, the last one is mainly to mitigate the consequences if happens anyway, for other reasons too (like with that poor guy who made picture of his own naked baby for a remote diagnostics with his doctor and the Google locked him out for months - and still counting at the time of the article - for child pornography)

I took one step:

     1) Don't use anything Google.

Please tell this to all homeless people.

I get funny looks when people ask for my email. I have @protonmail.com email

I have that too! : ) That is dedicated for the important things.

My sympathies go out to you, I get similar looks for not having a phone.

Likewise, I've never had a cellphone and I have no intention of ever getting one. Interacting with a website should never require a portable device.

You took a step that requires a lot of skill, wealth, and privilege.

Privilege?

Really?

Or did you just toss that in for the free upvotes?

I verify that this is true at the time of posting. In previous volunteer work at a non-profit run by university students, the organization assigned a free Gmail account to each executive. Each year, we ran into a problem where the executives would change, and we needed to transfer the Gmail account to the new person.

Problems would happen when the new person tried to log in to the account. Since the login was from an unrecognized device and an unrecognized IP address, security was tightened. Even after inputting the correct password and entering the right backup email, it was mandatory to enter an SMS message from the phone number tied to the account, even after various troubleshooting and attempted workarounds. That meant getting ahold of the previous executive, who may be busy or changed their number.

You could argue that Gmails weren't meant to be used this way, which is fair; the goal of this comment is just to provide additional evidence that the description provided by the parent comment is true. (In the end, we went for a low-cost, reliable email service to fix the issue in the long-term. We also found that registered non-profits are eligible for free Google Workspace or Microsoft Outlook email plans subject to certain eligibility conditions, though we did not have a need of becoming an officially registered non-profit at the time.)

FWIW, if you're the administrator of the organization, you can disable 2FA from the admin console for that user's next login. I've done this a few times for similar reasons.

Thanks for the tip, though this just works for a paid Google Workspace email plan (or a free Google Workspace for Nonprofits plan) [1]. We couldn't do this because we were using free personal Gmail accounts at the time (by transferring the credentials from retired executives to new executives) as we lacked budget and formal non-profit registration (to be eligible for the Nonprofits plan) since the group was fairly small and undergraduate student-run.

The difficulties were to be expected as personal Gmails weren't meant to be used like this (the goal was just to share an anecdote about the difficulties of phone numbers used for two-factor authentication with the free service even once a year). The long-term solution we used was to pay for a reliable but low-cost (in comparison to Outlook and Google) email host initially recommended on HN and a few sysadmin forums, to gain access to organization-wide admin features.

[1] https://support.google.com/a/answer/2537800?hl=en#zippy=%2Cc...

One of the many reasons why I switched from GMail to Fastmail.

Google accounts are required for many other Google services besides Gmail. Replacing Gmail is the easy part.

Agreed. It's irresponsible that the homeless don't have $50 a year for Fastmail. It's worth going hungry to be the customer and not the product.

This is what one-time backup codes are for.

Alternatively you can purchase a hardware key and store it in a trusted place, but admittedly they are expensive, so OTBC is the usual route.

yes I am confused why people aren't discussing OTBC ... is it an assumption that if you lose all your possessions then you lost these as well? Doesn't seem valid as you can certainly give them to a trusted person for safe keeping as well. Or bury them in the ground if you want somewhere.

It’s this sort of thing that has prevented me from activating 2FA on my gmail account. I pay for Google Drive (as a tertiary backup) and would be willing to pay more for service that include actual customer service. At this point though I feel locked in. I could switch (any suggestions on paid email with *real* support available?) but it’s a pretty big burden to go through every site & service that uses my email as either a login or password reset vector and change things over.

Heck, here’s an idea for a startup: a digital “moving” service. IRL I could pay a company to take everything I own, pack it up, ship it somewhere else, and even unpack it too. I’d like to see a digital equivalent.