Hacker News Reader

Comment by qingcharles | Hacker News Reader

It also sucks if you lose your phone number.

I haven't been able to log into my primary Google account for many years because while I have the username, the password and the recovery email address (and all the emails are forwarded to me), I no longer have the phone number associated with the account, so clearly I'm trying to break in.

View on HN

Google is really atrocious in this respect. It won’t even use recovery email addresses properly. The only solution is to move back to an IP address range that seems like your original “home” location and pray that it works. I have some choice words for whoever in Google thought not allowing account access or recovery is a good thing.

Or if you’re just traveling. I’ve been logged out of accounts while abroad and with no access to SNS.

Or refuse to give them a phone number. I lost access to two accounts where they now demand it.

Even have the audacity to send me an email with “someone tried to log in with your username and password!” Yeah, that was me clowns. :-p

I'm in a similar situation with LinkedIn.

Out of nowhere, they locked me out of my account, then they asked for my phone number, and I had to put in a code received through SMS. But that was not enough, because then they asked for a national ID card (the gall!). Of course I did not send it.

However, I kept trying to log in with the password and SMS code for a couple of days hoping that the ID requirement faded away, and now they say that I "have reached the maximum number of attempts. Please try again at a later date.". Well, duh.

So, now I have a ghost LinkedIn account with my face and my data that I can't even delete.

I'm seriously thinking about asking a bunch of people to mass report my account for racial hate speech or something so that at least it gets deleted.

Well, keep in mind almost nothing is deleted any longer. Only a deleted_at column is populated in the database, which prevents it from being listed by default. But data is not deleted, and those accusations might last forever as well.

This is where being an EU resident would be handy.

Yeah, it sure would be nice if the same nations that deeply/fundamentally benefit from being epicentres of cutting-edge technology would actually do something to protect the rights of people who are reliant on and are affected by said technology.

It's gotten so bad that it's now a regular paid service that I see offered for people to use bots to mass report your old accounts for a fee to get them removed and delisted for you. "100% guaranteed ban and delist. 1hr turn-around time!"

Of course, using it as a weapon against your competitors is the unsaid reason for these operations...

They say for security purposes they need my phone number (that I've never given them before) to verify I'm me. I've seen this on first login on a new account. I guess they think I'm pretty stupid and I'll believe that.

Facebook once balked and demanded my driver's license scan to keep using the account for security purposes or no more login for you. I called their bluff and abandoned the account. A few months later I tried again and suddenly the driver's license wasn't needed anymore. Then I stopped using it for YEARS until they sent me a single email with a link, which LOGGED ME IN to the dormant account without asking for a password on a new PC that had never used facebook before. I actually don't even remember the password at this point but it is still logged in!

none of my google accounts even have phone numbers, and I've never been asked for one...

Yeah, that's what's especially insidious about it. Until you attract the eye of Sauron by somehow setting off whatever unknown security trigger (which btw will never ever be disclosed to you), you'll never notice just how quickly everything can be taken away without any recourse. Everything seems just fine, doesn't it? Until it isn't.

A bunch of people like to say it is fine they use the phone number because you can use your other methods as a backup if you use it. Yet I've read plenty of stories like this about google demanding everything they have on you.

EU is supposed to get a unified digital identity wallet. There’s already a qualified digital signature. My country’s ID has a chip with public key cryptography. Just let me permanently tie my Google account to my national identity and then the problem will solved (at least for EU residents). I’ll be able to just use one just YubiKey without stress of losing it and I’ll be able to get my account back if someone steals it.

> I’ll be able to just use one just YubiKey without stress of losing it

How does the "without stress of losing it" part work?

I swear this is a bug, the recovery email is supposed to remove the need for sms auth. But google have no help desk or ability to report bugs.

Shame on you google.

The problem I have with Google's authentication flow (and also Microsoft's) is that there's no right way to use it. They both make unpredictable demands at unpredictable times, so you can't rely on being able to authenticate when you need to.

Randomly losing account availability like this is completely unacceptable for critical services like the ones they provide.

I've spent hours on the phone to many Google internal numbers that I can find trying to get someone to help me.

I think my best action is to use one of the sim-swap services myself to intercept the SMS to the guy who owns the number now.

In my case, nobody owned the number so our phone provider gave it to us, you can also ask the current owner if they could help, though alarm bells may go off in their head

I've tried texting them and no response and they hang up if I call :p

Once I was in a situation where I could either have wired ethernet or cell service, but not both (it was a 30 minute drive to cell service). There was no way to log into my Google account because it decided my laptop was suspicious (due to the strange IP address, probably).

When I got back to civilization, I turned off Google 2FA, and will never turn it back on, at least for personal accounts. I would rather drop my usage of their services than deal with their account login bullshit.

Reply on news.ycombinator.com