Comment by merek | Hacker News Reader

Comment by merek | Hacker News Reader

Parent Full thread

Pixel 7a phone. Purchased for work, intended for infrequent use. I created a new Google account since I didn't want the phone associated with my personal account.

After a couple of months of inactivity, I needed access again. The finger print didn't work (not accepted after a time of inactivity), and I cannot remember the PIN or Google account. I'm essentially locked out.

I can easily prove I'm the rightful owner with an invoice or bank statement, however neither the retailer nor Pixel will do anything, despite multiple conversations.

It raises the question of who owns the device: The person who purchased it, or the person who initially set it up? The Pixel is designed for the latter. I would argue it should be the former since transactions can be verified through intermediaries, whereas anyone could have set up the device, however I understand the complexities of Google verifying retailer receipts.

So I'm left with an unusable device, and I've run out of possible PINs to try.

Hopes for the future:

- On initial setup, a big ugly warning about being permanently locked out, and that I should ideally add recovery options to the new account, and be careful in choosing the PIN

- Requirement for retailers that stock Pixels to accept refunds in these situations, either through the kindness of Google's non-evil heart, or consumer law ("fit for purpose"?).

Any suggestions for what to do with a "bricked" phone would be welcome!

If you can't reset from Settings or you can't use your screen, try a reset with your phone's buttons.

If your phone is on, turn it off. Learn how to turn off your Pixel phone. Press and hold the volume up button and power button at the same time for 10–15 seconds. For Pixel 6 and newer devices: Press and hold the volume down button and power button at the same time for 5–10 seconds until the 'Fastboot mode' screen shows. If you hold the buttons for too long, the phone restarts. If this happens, try again from step 1. Use the volume buttons to change the menu options until 'Recovery mode' is displayed on screen. To select, press the Power button once. On your screen, 'No command' is displayed. Press and hold the Power button. While you hold Power, press the Volume up button and let go of both buttons quickly. Android recovery options should be displayed. With the volume buttons, scroll to 'Wipe data/factory reset' and press the Power button. With the volume buttons, scroll to 'Factory data reset' and press the Power button. Factory reset should start. At the bottom of your screen, when the reset is finished, 'Data wipe complete' is displayed. With the volume buttons, scroll to 'Reboot system now' and press the Power button. To set up your Pixel, after the phone completes the OS install, tap Start. Follow the on-screen instructions to set up your phone and restore your backed-up data

IIRC on modern Android phones, doing this will prompt you to log into the original Google account when setting it up after resetting. If you can't log in, the phone is effectively still locked. It's supposed to be an anti-theft measure so that thieves can't just factory reset and make the phone useful again

Edit: This feature is called Factory Reset Protection, read more at https://support.google.com/android/answer/9459346?hl=en

> If you can't give this information during setup, you won't be able to use the device at all after factory reset.

You can wipe or factory rest without a pin. There are many articles and exact instructions at the top of search results for “reset pixel without PIN”.

As for who owns the data, that is most definitely the person who sets up that account with a PIN, not the device owner. If you forget the PIN, that’s a nasty situation, but unfortunately working as I think most would agree is best.

You can reset it. But then, Factory Reset Protection kicks in and asks for the Google Account password.

I thought the PIN was the issue. Can't op just do a pw reset, wipe the phone and log in again?

Since OP didn't want the Google account on the pixel to be associated with their personal google account, it is possible no recovery phone number or email was set on it which can make reseting password difficult / impossible without someone at google actually looking in to it.

That's really an issue of you throwing the keys in the ocean...

If you lose your house keys, you don't have to give up your house and all your furniture. You are allowed to pay a locksmith or break a windows, you own it after all.

Thanks for sharing your story. While I think that "forgetting" you pin is something that should not have happened, I understand why it did and it is another example of google not being able to give a proper way to prove your identity.

That's exactly the reason why I've started using GrapheneOS on a < 200 bucks smartphone lately (indeed I paid 90 bucks for a Pixel 4a). Pretty unlikely that someone would steal it (and if so, just buy another one), there is no google or generally FFANG at all and it's pretty usable with only FOSS apps. Of course the camera is not the best but it is good enough for more than snapshots. For banking stuff I keep an old iPhone at home locked in the safe - iPhones have real good software / app support and don't require a google account...

> On initial setup, a big ugly warning about being permanently locked out, and that I should ideally add recovery options to the new account, and be careful in choosing the PIN

Phones and computers should come with a USB-C HSM that can reset and unlock them. This should be in addition to all the existing mechanisms to reset any kind of activation-lock.

In my view, It's beyond absurd that Apple/Google/whoever can sell devices that only they can decide are permanently bricked in extenuating circumstances.

If I have the device, its box, and everything that came in the box, I shouldn't be locked out of it forever.

Isn't your experience exactly what would happen with any other modern smartphone? What you ran into is called Factory Reset Protection, which basically all Android phones have, and iPhones have Activation Lock, which is just their name for the same thing.

Curious your reasoning behind a requirement to offer a refund?

If you dont need the data two options 1. Install GrapheneOS on it. It's absolutely a more secure option. 2. Reflash it using stock android at flash.android.com

Flashing must be enabled in the OS settings. Without that, the bootloader can't be unlocked.

Yes sorry forgot that. First thing to do when buying a phone is to enable Developer settings and unlock bootloader I guess

You could but then you also leave it wide open for others to mess with it if they get their hands on it (evil maid attack)

There's a reason security-conscious roms like GrapheneOS and CalyxOS only support devices where the bootloader can be relocked after installing.

there also quite a few apps, like many banking apps that refuse to work on a rooted phone.

These roms are not rooted as they consider rooting a security hole (which it is if you don't know what you're doing)

I don't even know if this is fully valid anymore as I haven't reviewed the latest passkey implementations, but it's definitely a fear of mine if passkey becomes the standard.

Reply on news.ycombinator.com