If the Google machine decides to cull me, probably nothing I can do, but it costs me nothing to keep it sitting in a drawer.
Now I pay 1€ a month for mail.
In another light, it’s a reminder that Google doesn’t really think of these accounts as ours, but theirs.
Edit:also, how do you replicate access to email/calendars across devices? (smartphones/PC)
If I wanted to host my own I wouldn't ask about providers...
Email these days is about much more than just email. Calendar integration and sync between devices that lets you access email on said devices as well as resiliency one would want for an essential service mean just "hosting your own" is definitely not trivial.
Then there is antispam etc.
Email is just so sticky, it is really hard to make the switch, but I know that it just takes some butterfly wings to upset the blackbox.
For a number of close family members Google has variously refused to accept valid recovery emails, valid recovery codes, and valid backup phone numbers in order to regain account access.
Despite how ridiculous it is from a consistency and security perspective, your MFA- or backup contact- enrolled phone number with SMS is still essentially Google’s gold standard for determining rightful access to an account.
Their auth and password reset processes are constantly changing and they have several steps that are automatically adaptive.
The only foolproof ways I’m aware of to always retain access to your Google account is to enroll in Advanced Protection, and/or to use a paid Google Workspace account.
Advanced protection is a good pointer. Seems like losing the hardware token device can be a disaster?
On the other hand giving a service money is dangerous. They would be making money from you which means stricter checks. I'm still semi banned on Github because they had my card with Russian billing address (for sponsoring) when Putler attacked Ukraine. Good I didn't pay for anything Google.
If you only have one, yes. But I'd recommend:
* Get three tokens
* Keep one on you, one at home, and one somewhere else
* Maintain a list of every site you've registered your tokens with.
* If you lose a token, or one breaks, unenroll it from all those sites, get a new token, and enroll the new token. Do this urgently.
This is with 2FA and a passkey, and multiple logged in devices. There’s a lot of idiocy going on there, I wouldn’t trust them with a single thing for any reason whatsoever.
- buy a domain name to never have the same issue
- select a new service
- setup forward from gmail to the new service.
- start using new mail
- wait multiple years and Tadaa ^^
Bonus: if you loose access the forward will continue :).
I was screwed as all of my PCs/laptops, Servers, tablets, etc...burned up or were flooded by fire dept. I found my phone 8 hours later on the basement floor where it had been submerged in 8" of water from the fire dept. Miraculously it was dead and just wanted to be charged. (Samsung s22, fwiw). I'm typing on that now and still have access to everything! Phew.... take your personal DR seriously.
Good thing google has a high quality help desk to report bugs /s
Makes sense really.
Anecdotally, my Google account's password has never been in any dump (password manager, very long random alphanumeric, changes every 6 months) and I too deal with these annoying prompts.
Despite having access to the password, the recovery email account and an active session, I could not activate a new session.
It didn’t make sense, not that it matters when google refused to have a help desk or meaningful way to report bugs.
(Curious how easy it was for me to forget that it's something I can turn off, once I turned it on.)
I have a client who tries to share one Google / Gmail Inbox account between users internationally and Google does not like that at all!
Google constantly requires verification for logins!
May be you/your client needs a proper workflow. May be you need to run some security company/email service at the level of Google to see.
It's a weird problem. Can't log in to my account from unknown mobile but works just fine on an unknown PC.
So frustrating.
And the answer should never be just "sorry, we can't confirm your identity right now". If I pass every challenge Google throws at me, I should be let into the account, period. If they have more, sure, whatever, let's play the game, but if I did everything right and still can't get in, that's a broken authentication system.
If that is your argument then it is their service. They can decide how to offer it. Services like this are designed for majority - and a majority are happy. If you don't prefer then you can find alternate services. Market is wide open.
lol