Did not have access to associated phone number.
* gave correct password * gave correct secret question response * have access to backup email address
“Thank you for verifying that you have access to the backup email address.
We have been unable to verify your ownership of this account”
Are you serious?? Google must seriously want to tie everything to real world IDs.
After about 5 years of occasionally flunking the questionnaire to prove I was me, Google relented and allowed me to update my password via a code sent to my phone and another sent to the gmail account itself.
Which is to say that I was saved by a device that had access to my original gmail for five years without ever asking for the password. Which doesn't seem like an example of sterling security.
You probably know this already but if you're making the effort to do this you absolutely must purchase a domain name that you own, it's the only way to make sure you'll never have go through this process ever again.
Then, three months later, I visited, and suddenly they've let me in. This is extremely annoying.
Oh, and I was visiting using the same IP address!
Oh please no, no, no, no a million times. I shoudn't have to run Google services on my phone, I shoudn't need to have a phone, and my big heavy immobile desktop should BE a 2FA device of its own because it's much harder to steal. Don't make the use of a desktop require a phone.
Also, as the article already says, as does Google's announcement, this won't do anything at all if you don't have any suitable additional factors.
https://www.researchgate.net/publication/315541163_No_Digita...
It really opened my eyes that google was willing to hold my emails hostage. Google's roadblock was unrelated to security, because an attacker could provide a new phone number too.
I checked my account and I don't see any secret questions options.
This experience is what pushed me off Gmail.
I think it's obvious that Google is too big, but it's not like they can help it. Capitalism in the internet age requires constant growth if you want to maintain your company's value, which is a large part of why they can't turn people away from their service. The best they can do is require a phone number to sign up and limit the number of accounts a phone number can be associated with (which they already do).
Craigslist is doing fine with a small number of employees and no need to grow.