Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Lost then regained access to Google account, with correct credentials

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#101

Post by kyrra »

donmcronald wrote: post #61
mihamaker wrote: post #23

I lost a lot of accounts because of this misunderstanding. I always use a VPN for work. I keep all logins and passwords in the password manager. But Google is very worried about my safety, even to my detriment.

Using a public VPN is almost guaranteed to flag your logins as suspicious at all of the big tech companies. If anyone wants to see how intent big tech is on tying your profiles back to personally identifiable information, connect to a VPN and try to create new accounts on various services. It's basically impossible without a non-VOIP phone number. If you manage to get an email address, big sites like Facebook and Twi…

Googler, opinions are my own. I don't work on these systems at all.

My general understanding is that Google wants to prevent account takeovers, as it happens far too often. They flag accounts for various heuristics, even if you know the login (as it could be someone that stole your credentials). This normally should just trigger 2FA for that login. If that doesn't work, you likely need to go through the account recovery flow:

https://accounts.google.com/signin/recovery

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#102

Post by ajross »

ttybird wrote: post #86

I hate this. If I know the password I should be able to log in to my account no matter what (unless if I have 2fa enabled). Sadly companies like Google and MS do not like this idea, they also often use the excuse that they can't verify you in order to mine your phone number. "Edit: Account recovered. I used chromium to login (which I never do) and then back to Firefox" How can google keep getting away with this? MS g…

The request for a phone number is precisely a 2FA mechanism, and that's how it's being used. I don't understand what the bad faith you're assuming on Google's part is. What do they want that phone number for otherwise?

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#103

Post by probably_wrong »

londons_explore wrote: post #38
probably_wrong wrote: post #29

Earlier quoted context omitted.

If you are in Europe, and at least for email, it is regulated. The GDPR's Right to Data Portability means that a company is obligated to give you access to your personal data - they are within their right not to have you as a customer anymore, but they must give you at least a copy of whatever data they already have. Of course, you'll probably have to jump some hoops to prove that you are you, but IMHO that's a reaso…

Doesn't work with Google. If you cannot log into the account, their legal team won't accept that you are the account holder. Even if you provide passport and driving license etc., they can't be sure, because you didn't upload the passport and stuff when opening the account.

I'm having trouble deciding whether you talk about something that has happened or about something that could happen.

Assuming it's the latter: given enough evidence that you are you (same name as the recipient, deep knowledge of the account, knowledge of the password, etc), any court would rule in your favor and force Google to turn over the account. But I would be willing to bet that, assuming you are no one "special", they would relent much earlier in the process - the cost of the lawyers alone would probably outweight whatever profit they obtain from you, and GDPR fines can be high.

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#104

Post by kevincox »

junon wrote: post #91
ttybird wrote: post #86

I hate this. If I know the password I should be able to log in to my account no matter what (unless if I have 2fa enabled). Sadly companies like Google and MS do not like this idea, they also often use the excuse that they can't verify you in order to mine your phone number. "Edit: Account recovered. I used chromium to login (which I never do) and then back to Firefox" How can google keep getting away with this? MS g…

Google denying me access to YouTube videos asking me to verify my age by giving them either my passport or my credit card should be illegal as well. Then they expanded it to the app store - some apps, even ones that don't seem to need to be age restricted - now require I verify my age in the same way. I just give them the middle finger and manually install the APKs for those apps. Unfortunately, no way to get around…

> Google denying me access to YouTube videos asking me to verify my age by giving them either my passport or my credit card should be illegal as well.

Wasn't this added because of some EU law? It seems that YouTube's interpretation was that asking this is the opposite of illegal, actually legally required.

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#105

Post by chrisan »

jacquesm wrote: post #94
daitangio wrote: post #65

Earlier quoted context omitted.

I switched to my hosted email, it is not so difficult to manage, and I feel very free. Also I have created accounts for my children, my wife with very little costs. The magic? This very well supported project: https://github.com/docker-mailserver/docker-mailserver

Typically solutions like that will work for a few months or years and then you are in much bigger trouble than before. Highly annoying. This is because just like every other server you will need to keep it up to date, you are going to have to deal with being falsely labelled as a spammer, you will have people attempting to abuse your server and so on. I'm still doing this but the overhead is such that I'm tempted to…

Even paid email you can be identified as a spammer. I use Namecheap's private email for my side project. I do zero marketing/automated emails.

All of a sudden my hand written emails to clients were going to spam. Namecheap verified my spf/dmarc/etc was all setup correctly and told me there was nothing they can do.

I don't communicate often and am just using my personal email address for now, but I'm looking to switch providers

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#107

Post by absolute-evil »

Hi, this account was created for this post. My personal gmail beta account is to this day being held ransom by Google. It was only used for my most important accounts, my bank, gov, utilities etc. My life, online and offline.

Despite only ever logging in from a residential line in the same city for entire life of the account; one day there was """suspicious activity""". I did everything asked.. confirmed every detail, provided backup codes, secret answers, gave up phone numbers, every password change and dates, even the exact date and location when the account was created, E V E R Y T H I N G.

Turns out that my account is so secure that even I cannot access it. Well I'm sure you can imagine what a total fucking nightmare it was to workaround the absolute evil that is Google. That's my rant, I'm glad that you got your account back OP.

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#108

Post by NikolaNovak »

decrypt wrote: post #76
alvarlagerlof wrote: post #72

Earlier quoted context omitted.

Can you even use that if you're not logged in?

Could you elaborate on what you mean by "use"?

How do you gain meaningful access to help/support without being able to sign-in to their help portal / ticket system?

I've been exposed to that type of Kafkian catch-22 nightmare scenario all too many times :|

Re: Tell HN: Lost then regained access to Google account, with correct credentials

#110

Post by probably_wrong »

dahfizz wrote: post #96
probably_wrong wrote: post #82

Earlier quoted context omitted.

I wrote about my experience for that exact same situation here: https://7c0h.com/blog/new/lost_gmail_ii.html In short, you can send their Data Protection Office a letter demanding access to your data. In my case it took almost three months but they eventually relented and reset my password. I guess a lawyer could have gotten it done faster, but who knows.

Did they ever verify the you had the old password / recovery email like you offered? It seems strange to me that they reset an account password because they got many letters asking them to.

All e-mail communications were sent through the same address I gave as recovery address, so they didn't have to ask. It is possible that one of their e-mails was sent to my recovery address instead of my personal address, but since they are the same account I wouldn't know.
Post reply on HN