Removing security keys that have been registered for years is very unlikely to be the right move even if my device has been compromised, as they are one of the most reliable ways I could prove I am the original account owner at some later point.

If the message had stated "We have removed recently added security keys" I would be a lot more understanding!

If you had your recovery keys stored in a note on lastpass you might have wanted to rotate those as well recently.

Yeah, in theory those recovery keys should still be secure, but you know for certain that a hostile attacker has the encrypted secure note, and without any confidence in lastpass it makes sense to change them as well.

Unfortunately this means you look exactly like someone doing an account takeover and changing the password and recovery keys on the account.

Thanks for the heads up.

I don't use lastpass, but if I did I wouldn't have to because this "Just to be safe" process also reset/removed the recovery keys.

> registered for years

Right, that's likely the "bug" part. On HN of all places, people shouldn't be surprised that bugs happen.

Unfortunately due to a lack of customer support posting here gives me the best chance of getting it fixed!

If google had working support flows I would not have written this up or posted here about it.

A few years back I lost access to a different google account as the recovery phone number was a landline and google was trying to send SMS messsages to it. I had the right password but it thought I was suspicious and insisted on SMS verification. I never managed to reach a human to get something done about the issue.

> Unfortunately due to a lack of customer support posting here gives me the best chance of getting it fixed! > If google had working support flows I would not have written this up or posted here about it.

They do, you just have to pay for that privilege via Google One.

If you are locked out you can't access Google One's support.

My understanding is that you can always call them, even if your account is blocked.

I don't have it but it looks like you have to initiate the call from the Google One page and they call you, they don't have an inbound number.

Googling "google one phone number" did show me a potential scam result in the infobox at "gooogle-live-personn" on google sites that obviously isn't official. You can't make this stuff up.

Went ahead and escalated this one internally. That's pretty bad.

That page is weirdly interesting to me. It's hosted on sites.google.com which was probably one of the worst ideas google ever had, security wise (yes mom, always make sure the page says Google.com - but not sites.google.com). It's clearly one of those blog spam page types, with the same 3 bits of information repeated over and over again. It does not have any clear phishing links, in fact it tells you to open support.google.com in your browser without a link. One of the number it links it's the official adwords support number (https://support.google.com/google-ads/answer/7218750).

Only after all of this it links to another number, which from what I can tell is a scam phone center which will offer to help you with your account for some money. I really wonder if they're betting on everything else being so hopeless that a person will eventually try to call this other number after trying all the other options before.

It does tell you something about Google support if scammers can do that...

> getting on HN might be the best way to get it looked at by a human... but also make sure you don't have any other issues going on.

Wait, why are we normalizing this? Getting on HN is always the second-best way to get it looked at by a human. The best would be, you know, Google devs doing their job and helping their users instead of solving LeetCode or writing their next promo packet or whatever it is they do all day.

I'm not a big fan of this trend where Google and other companies are essentially outsourcing their (terrible) customer service to this message board.

I mean I'll still upvote the post in case I need to fall back upon this (terrible) way, but I think it's reasonable to grumble about it.

To their defense: given the company's business model, there's probably no other way of handling it. They make money at a massive scale, and as an individual user, you're not worth enough to provide customer support - or really, any special consideration.

The problem might be the business model itself. Google is not attached to any one of its billions of users, but they can cause a lot of pain if they randomly cut you off - especially in a world where email is essentially online identity. But then, I'd wager that a good 90% of us are employed in places that want to replicate that model at any cost... glass houses and all.