Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do I get my Google account back?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 154 posts

Re: Ask HN: How do I get my Google account back?

#131

Post by UncleMeat »

orblivion wrote: post #32
sigmoid10 wrote: post #24

>Unfortunately I did not have a phone number associated with this account. My understanding is I would have been able to recover my account, If I had one. It boggles my mind how people can have their entire life tied to this service and not connect a phone number, especially since google regularly warns you during login that this can happen if you don't add your number. They even ask to confirm every now and then in…

Because I've been warned by security conscious people never to use phone number as a 2FA because it's so insecure, and using it as a recovery option seems to create an even weaker link. If that's somehow not true, I haven't gotten around to figuring out why that is because I only have so much time for this shit.

Security conscious? Or security expert?

SIM-swaps are easy but do not scale. This means that they don't actually affect a lot of people. The improvement in security posture from SMS 2FA to TOTP is actually fairly small, because both lose to phishing and phishing is orders of magnitude more common that SIM-swaps or malware that steals SMS codes.

As a solo recovery option, it is indeed a more meaningful risk. But we also observe that people just lose their accounts all the time if they don't have a phone-based recovery option so I do understand why the option is offered.

Re: Ask HN: How do I get my Google account back?

#133

Post by dadarecit »

0des wrote: post #82
adingus wrote: post #45

Earlier quoted context omitted.

Buying new hardware might be slightly over the top but it's essentially my experience with losing a Gmail account. The hijacker was extremely fast trying to get into my Amazon, PayPal, bank, credit card accounts and trying to steal my identity. The whole situation was awful. I was stupid and used poor security which made it easier for this person (who was also probably using data from the Equifax leak for social engi…

credential recovery and account takeover is trivial, most people have automated that process. once the lock is popped, all value can be extracted, verified, and pivoted in moments.

How do you pivot value xd fr nu-hn is too hilarious for my health

Re: Ask HN: How do I get my Google account back?

#134

Post by tyrfing »

davidmitchell2 wrote: post #84
tyrfing wrote: post #56

Earlier quoted context omitted.

How does your human support handle a user forgetting their password?

Assuming they have cryptography all data is lost.

Exactly. Seems like poor support. "We're amazing because we'll put a human on the line to tell you that you're fucked and we can't do anything" doesn't seem like the status-quo-busting human support the "mainstream" wants.

Re: Ask HN: How do I get my Google account back?

#135

Post by thetinguy »

davidmitchell2 wrote: post #34

> presumed that the security message was because of new IP addresses that must have been assigned. While I was initially able to log in to my accounts after replacing both the routers, o 1. Verify if your router or router software that you installed in your PC is doing something fishy. 2. As long as you have a browser window with cookies - even new IP address should NOT matter. It should allow you. I am almost always…

Google, Microsoft, and Apple all use previously authenticated ips as a signal for their account recovery processes.

Re: Ask HN: How do I get my Google account back?

#136

Post by sigmoid10 »

0des wrote: post #81
sigmoid10 wrote: post #19

Earlier quoted context omitted.

Could also just be plain bad luck. Dynamic IPs are given out based on availability. So you could stick with one for months if you keep your connection active and then just happen to lose it during one of the moments you unplugged the router. To google this would seem like a static IP that suddenly changed.

nope, this is a tried and true method i use to change my ip on non static service. I change the router mac address, flip the modem, and voila new IP

Not necessarily. The fewer IPs in your ISP's dynamic pool, the bigger the chance that you will get the same one. In the extreme case when there's just one free address (I have seen this happen with some really shitty ISP) you'll 100% get the same one back.

Re: Ask HN: How do I get my Google account back?

#137

Post by davidmitchell2 »

tyrfing wrote: post #134
davidmitchell2 wrote: post #84

Earlier quoted context omitted.

Assuming they have cryptography all data is lost.

Exactly. Seems like poor support. "We're amazing because we'll put a human on the line to tell you that you're fucked and we can't do anything" doesn't seem like the status-quo-busting human support the "mainstream" wants.

That is what it means by encrypted data storage. Only the user has access. If they managed to see/recover your files then it is not encrypted.

(at the end, people will complain at both ends - some want convenience and do not care if companies see data. Others want total encryption and do not care if lost.

Re: Ask HN: How do I get my Google account back?

#138

Post by davidmitchell2 »

orblivion wrote: post #98
davidmitchell2 wrote: post #53

Earlier quoted context omitted.

> Because I've been warned by security conscious people never to use phone number Sadly you read only one part of the warning from security conscious people. The main part is to get U2F/FIDO key or use QR-code/authenticator. The same security conscious people use Fdroid/AndOTP where you can export all your 2FA codes. There NO reason to say if I shatter my phone. Yes, you can also print recovery codes and keep it at h…

We're not talking about 2FA, we're talking about account recovery. I do have my authenticator app set up. Can I use it to prove myself if Google thinks somebody stole my account?

Yes, I just tested it with one my accounts that has NO recovery email address/phone. ONLY U2F key.

Select forgot password; the it asks Insert U2F Key. Then recovered. Yes, it may be that if one loses U2F key in Metro it is dangerous but some risk is always there. (i.e) how many times have you lost your key in your life? If more than one per year then keep one U2F at work and one at home.

Re: Ask HN: How do I get my Google account back?

#139

Post by davidmitchell2 »

j4tech wrote: post #129
davidmitchell2 wrote: post #61

Earlier quoted context omitted.

2. Instead of that use separate firefox profiles - one exclusively of Gmail. Another for casual browsing. If you clear cookies all the time then it seems like you are logging in so many times per day. This could be a warning sign of hacked account - for google. (i.e) do not do unusual things. 3. At the end U2F is the proper solution, albeit late!

Good point @davidmitchell2. I will do that.

I therefore have one for facebook, slack and so on (i.e) for every major company when I login. Then one is for just browsing.

Re: Ask HN: How do I get my Google account back?

#140

Post by duskwuff »

zinekeller wrote: post #124
resonious wrote: post #96

Earlier quoted context omitted.

Doesn't this just move your single-point-of-failure over to the service you bought your domain name from? I suppose NameCheap and friends may be less likely to irrevocably lock you out than Google. And perhaps even if you are "locked out", your ownership of the domain will expire and then you can just buy it again from another registry... So perhaps you're right, but I wonder if there are any other reasons or caveats…

> Doesn't this just move your single-point-of-failure over to the service you bought your domain name from? Unfortunately this is very long but this has saved my butt countless times. Everyone hates it, but it'll be better to know these definitions. TLD means top-level domain, the .com on ycombinator.com. Registry means the company operating the specific TLD, for example Verisign operates .com and .net. Registrar are…

> ccTLDs are two-letter (exceptions apply)

ccTLDs are two letters by definition. Other geographic TLDs like .cat, .wales, or .london are not ccTLDs.

.gov, .mil, and .edu are not considered ccTLDs or gTLDs. They're technically in another category entirely: "sponsored TLDs".

> First: use only a registrar listed on ICANN […] Second: are your registrar accredited by the specific registry?

Both of these are guaranteed to be true by the governance structure of gTLD domain registries -- a gTLD registry cannot provide services to registrars which don't have accreditation.

> Domain resellers (without ICANN accreditation) go bust nearly everyday and recourse is hard if you decide to go to a reseller

This is not true. Resellers can "go bust", but the registrar of record (that is, the "real" registrar that's being resold) has the customer's contact information and can continue to offer registration services. In fact, they're obligated to do so.

Post reply on HN