An Example of a Sad Google Account Recovery Failure and Its Effects • Hacker News Board

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#61

Post by techsupporter » Mon, May 22, 2023, 3:31 AM UTC

fogzen wrote: post #51

My wife lost her life’s email despite knowing the password. Google didn’t recognize the device, asked to verify using a phone she doesn’t have access to anymore. Despite knowing her login and controlling the recovery email, she couldn’t login. Everything was tied to her email. She lost access to many other accounts connected to the gmail as a well. Lost contacts, lost YouTube account, and on and on. It was honestly t…

> My wife lost her life’s email despite knowing the password. Google didn’t recognize the device, asked to verify using a phone she doesn’t have access to anymore. Despite knowing her login and controlling the recovery email, she couldn’t login.

A friend of mine has encountered this with the TOTP authentication code method. During a move from the US to Europe, they lost their phone. Google let them log in to their regular account no problem, but a second account they use infrequently for a social group got locked out when they tried logging a month after the move. The TOTP secret key string is stored in their password manager and Google doesn't say that the password or TOTP key is incorrect, simply that "for your security, you must complete an additional step" by confirming in an app they no longer have.

Maybe I have been doing IT for too long, but knowing the username, password, and any[0] second factor should always be enough. Surprising users with something else, that they might not have, is unacceptable.

0 - I'm willing to forgive if a second factor was recently enabled; maybe the scammer got in and added a new phone number or backup email account or generated emergency access codes. But, configured more than 14 days ago? Must work.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#62

Post by sho » Mon, May 22, 2023, 3:42 AM UTC

saagarjha wrote: post #20

> They’ve all basically hit the brick wall of Google suggesting that at their scale, nothing can be done about such “edge” cases. The thing is that at scale your “edge” cases are still millions of people. Companies love the benefits that come from scale, like having a billion people use their service, but they never seem to be capable of handling the other parts that come with it :(

What I don't understand is why there isn't some kind of paid escalation option. I fully understand why they don't provide free human support for a billion unpaid users, but couldn't there be a $50 "OK, we will actually take a look at your issue" option? Surely that wouldn't be a money loser. Hell, you could outsource it.

It seems instead that they just don't even want to touch it.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#63

Post by clipsy » Mon, May 22, 2023, 3:57 AM UTC

franciscop wrote: post #42

clipsy wrote: post #36

Earlier quoted context omitted.

> We as a society have decided (correctly) that leaking your private photos, conversations and data is an unacceptable risk, and punish the companies strongly for it. On what planet do companies get punished strongly for leaking PII? It happens to me multiple times per year and if I'm lucky I get a pittance from a class action suit years later. The executives who raked in huge bonuses cutting security don't get punis…

Punish companies is not the same as you getting compensated. It happens (at least in EU) harsher with the GDPR, so yes it's fairly recent, but so is security online (just 10 years ago not even half of the sites used HTTPS). There's dozens of high-profile fines every year due to data mishandling from Europe, just a quick search: > Data protection supervisory authorities across Europe have issued a total of nearly EUR1…

If you think those fines are strong punishments you are, frankly, delusional. Those figures are a drop in the bucket and are regarded by the companies in question as little more than the cost of doing business. Start putting CTOs in handcuffs and I'll consider it a strong punishment.

Edit: Also, just to be clear, the reason I brought up class action lawsuits is not because I think all punishment will result in remuneration for those affected, but because in those cases the class action lawsuits were the only consequence the companies in question faced.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#64

Post by aqfamnzc » Mon, May 22, 2023, 3:58 AM UTC

sho wrote: post #62

saagarjha wrote: post #20

> They’ve all basically hit the brick wall of Google suggesting that at their scale, nothing can be done about such “edge” cases. The thing is that at scale your “edge” cases are still millions of people. Companies love the benefits that come from scale, like having a billion people use their service, but they never seem to be capable of handling the other parts that come with it :(

What I don't understand is why there isn't some kind of paid escalation option. I fully understand why they don't provide free human support for a billion unpaid users, but couldn't there be a $50 "OK, we will actually take a look at your issue" option? Surely that wouldn't be a money loser. Hell, you could outsource it. It seems instead that they just don't even want to touch it.

Seems like that would invite more bad PR than it's worth...

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#65

Post by davchana » Mon, May 22, 2023, 3:58 AM UTC

prepend wrote: post #29

kevincox wrote: post #23

Earlier quoted context omitted.

For me there are always a bunch of services that fail or are missing some data. So you need to keep retrying.

With google takeout? I’ve never experienced that and subsequent downloads always yield the same results.

Combined or not, google keep notes without titles always get failed or errors in takeout html.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#66

Post by alvarezbjm-hn » Mon, May 22, 2023, 3:59 AM UTC

new299 wrote: post #40

crazygringo wrote: post #10

Given the difficulty people talk about recovering an account to which they've lost the password or recovery methods, it seems like Google ought to periodically ask you to verify that your recovery e-mail and phone number and 2FA device are still correct. It seems like that would basically solve the problem in most cases. So I kind of find it strange that I use Google services extensively, and yet I can't recall ever…

I have a google account. I know the password. I have access to the recovery email. I however don't have access to the associated phone number. Google won't let me log in...

"I have a google account. I know the password. I have access to the recovery email"

This also applies to microsoft. Except Microsoft also asks for PII (name, dob, country, gender) But they still want the old phone number

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#67

Post by fogzen » Mon, May 22, 2023, 4:00 AM UTC

Narishma wrote: post #54

fogzen wrote: post #51

My wife lost her life’s email despite knowing the password. Google didn’t recognize the device, asked to verify using a phone she doesn’t have access to anymore. Despite knowing her login and controlling the recovery email, she couldn’t login. Everything was tied to her email. She lost access to many other accounts connected to the gmail as a well. Lost contacts, lost YouTube account, and on and on. It was honestly t…

> Just pay $5/mo for an email service that won’t ruin your life for no good reason. Just because you're paying doesn't mean you won't get into these situations.

Hey it’s your email, trust Google with it if you want. Just know if you ever run into a situation there is no support and they will not help you regain access.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#68

Post by zbrozek » Mon, May 22, 2023, 4:01 AM UTC

swang wrote: post #2

I have a very old account that I still use for some email forwards to my main account. Even though I can verify all the other requirements, since I haven’t logged into that account with a machine it recognizes that I still have, apparently I will never be able to log into the account. Literally nothing can be done because google would rather take the easy way to handle this.

I have an account that I made in 2005 that can't get past the circle of login nonsense even though I can provide verification codes when it emails the "backup account". What's the point of the secondary account if you can't use it to log in?

There are now email addresses of some friends from my youth (before I wised up and stopped letting my Google account hold important data) forever locked away where I can't get to them. I'd probably have to work at Google to have any chance at all of recovering.

Scroogled indeed.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#69

Post by CrendKing » Mon, May 22, 2023, 4:10 AM UTC

sho wrote: post #62

saagarjha wrote: post #20

> They’ve all basically hit the brick wall of Google suggesting that at their scale, nothing can be done about such “edge” cases. The thing is that at scale your “edge” cases are still millions of people. Companies love the benefits that come from scale, like having a billion people use their service, but they never seem to be capable of handling the other parts that come with it :(

What I don't understand is why there isn't some kind of paid escalation option. I fully understand why they don't provide free human support for a billion unpaid users, but couldn't there be a $50 "OK, we will actually take a look at your issue" option? Surely that wouldn't be a money loser. Hell, you could outsource it. It seems instead that they just don't even want to touch it.

If that actually becomes a paid service, it must legally bind Google to provide some formal results out of it, or people that paid can now sue Google for something like negligence. Then Google can't conveniently hide all the details about of why accounts got banned when people demand in court. It's a whole can of worm for Google for morsel amount of revenue.

Re: An Example of a Sad Google Account Recovery Failure and Its Effects

#70

Post by flangola7 » Mon, May 22, 2023, 4:16 AM UTC

justin_oaks wrote: post #59

ocdtrekkie wrote: post #53

Earlier quoted context omitted.

The trick is regulation. A huge difference between the wildly profitable tech companies and most other large companies is that everyone else has to have customer service departments... large departments providing hundreds or thousands of jobs and salaries helping users with the product. Very simply, Google and the like should be required by law to have customer service adequate to support user needs in every language…

In the case of a free GMail account, the user who doesn't get the support they need can get a full refund. In all seriousness, how does it even make sense to regulate expensive customer support for a free product? If you do, you may not have any free products anymore. But perhaps we'd be better off having decent customer support with no free products. As for paid products, it does make some sense to have some minimum…

I don't pay anything for my bank account, but there will absolutely always be a human at the bank I can talk to about problems. It's also not as if users aren't paying for Gmail, business users are paying for it with currency, regular users with data.

Such legislation isn't theoretical or difficult, India already has their new IT law rules:

>The IT rules 2021 provide for creating avenues for grievance redressal apart from Courts and ensure that the Constitutional rights of Indian citizens are not contravened by any Big-tech Platform by ensuring new accountability standards for SSMIs.

>During the extensive public consultations on the ITRules, the Minister of State for Electronics & Information Technology and Skill Development & Entrepreneurship, Shri Rajeev Chandrasekhar had articulated the stand of the Government that - safety and trust of every Digital Nagrik, and robust grievance redressal system to ensure accountability of all Internet platforms offering a service or product, was an unambiguous goal and that all grievances must be 100% addressed.

>The Grievance Appellate Committee (GAC) is a critical piece of overall policy and legal framework to ensure that Internet in India is Open, Safe & Trusted and Accountable. The need for GAC was created due to large numbers of grievances being left unaddressed or unsatisfactorily addressed by Internet Intermediaries. GAC is expected to create a culture of responsiveness amongst all Internet Platforms and Intermediaries towards their consumers.

https://pib.gov.in/PressReleaseIframePage.aspx?PRID=1894258