Gmail's backup codes are useless to access account

[Andrew_nenakhov]

Ok, I have a work account on Gmail. Having the experience of being locked out of Gmail previously (endless loop of "You are entering the correct password but we're not sure that it is you, try again later"), I created a 2fa via Google Authenticator and set up Backup Codes and thought I'm safe from them asking me to sign in on another device or enter sms code (I don't carry that phone with me).

So, one sunny day I decided to add standard iOS mail app to this account, and lo, an hour after connection I get a message, that due to strange activity on my account, I need to enter code sent via sms.

Ok, I don't have that phone with me, so I try to log in with Authenticator, and no, no good: 'we are not sure that it is you, enter code sent to sms'. Ok, I dig backup codes, enter them, and still get 'we are not sure what it is you' message.

What's even the point of allowing to set up Authenticator or Backup Codes if they don't do anything?

If there are some people from Google reading this, please, don't reach out to me offering to help. Just change this dumb system.

[NearAP]

It isn't just the backup codes.

More than once, I was in a different country and tried logging into a workspace gmail account. Google flags it as a strange activity (fair enough) and needs to authenticate me. It asks me to enter the complete address for my recovery email (I do this), it sends me a code to use for sign in (I do this) but it still refuses to sign me and says it can't authenticate me. It says I need to sign in from a location that I've signed in from before.

So, for the period that I was out of the country, I couldn't access my email. This happened each time I'm in a new country. My only work around was to sign in to my email (on my laptop) before traveling and not sign out (for security reasons, I don't like to do this).

Something similar happened when I used a new laptop.

I just don't understand this. What then is the point of having recovery email and phone number if you won't use them?

[david422]

I created a gmail account in 2004 and then completely forgot about it. Just last week I realized that I had registered that account. I went to the forgot my password page, and it prompted for the last password I remembered using, which I took a guess at. It told me that wasn't enough information to recover the account, and that was it, because I didn't have a backup phone, email etc. attached.

But then I thought- what if I just try that password to login. And it worked.

So when I thought I had forgotten my password, gmail prompted me for a piece of information that I got correct, and then wouldn't accept it.

I also have another email account that forwards all mail to my main account, but I've definitely forgotten that password, and I have no way to actually get back into that account, even though I've tried. I guess it just forwards mail forever.

[roywiggins]

> I guess it just forwards mail forever.

Probably not forever:

https://www.npr.org/2023/11/27/1215285876/google-inactive-ac...

[nickdothutton]

I’d love to see a fully mapped login/auth flowchart with every permutation. New accounts, ancient accounts, accounts with 2FA, without. I bet Google themselves dont even have one now. Remind yourself they are really just an advertising monopoly that does other things as a side project.

[modeless]

If you want to prevent SMS from being used, remove the recovery phone number and/or 2-step phone number from your account. That's how I've had my account set up for many years, to prevent SIM swapping attacks. Just make sure you set up all the other 2-step options.

[Andrew_nenakhov]

I did it on the account mentioned in post (didn't set TOTP though), and Google locked me out saying "You're entering correct password but we're not sure it is you. Try again later". And I tried and tried and tried, for a few weeks.

Then, after 2 months, I tried logging in and suddenly it worked.

[venusenvy47]

Does this remove the full screen popup that occurs on both my phone and tablet when logging into my Google account? I'm not sure what type of 2FA this is called, but I would like to remove it and have it directly ask for the TOTP.

[SoftTalker]

When my bank introduced the option to use TOTP codes instead of SMS for 2FA, I said "Great!" and enabled it immediately. Unfortunately they don't let you remove the other 2FA options. So logging in, I now get three options for 2FA: SMS code, emailed code, or Authenticator code.

[ikekkdcjkfke]

So we are at a point where just a strong password stored in memory is actually the safest option (given brute force protection)?

[mikece]

One of the first things I do with all of my Google accounts is set up TOTP authentication and not with Google Authenticator. So far I haven't had any issues getting into an account after not logging in for a while (because my gmails all forward) but I wonder if Google will disable standard TOTP in favor of requiring Google Authenticator (which will be a problem because then I would need to get a separate handset for each account).

[Andrew_nenakhov]

Google Authenticator is a TOTP client as far as I know, and it can transfer codes to third party clients without problems.

The point of my rant was that with modern day Google, TOTP authentication is not enough.

[thesuitonym]

I haven't used Google Authenticator, but most authenticator apps allow you to have multiple accounts connected. It would be insane to me if Google didn't.

[firefax]

I also had my backup codes fail, which caused me to lose access to the email account I had had since I was a teenage hacker. In the Google Voice was the cell number I'd had all my life. Two decades of emails, documents, conversations, and contacts lost forever through no fault of my own.

>If there are some people from Google reading this, please, don't reach out to me offering to help.

I wouldn't worry yourself on that front, unless you are some kind of celebrity, they don't seem to care that a basic, core function of one of their most popular products can fail in a manner that totally locks people out.

The whole point of the backup codes is to facilitate account recovery, and it's really hilarious to me that a company full of allegedly elite engineers can't do one simple thing.

I point folks to 0365 for the their cloud needs nowadays -- Microsoft does this strange thing where you pay them money for services that works rather well, and office itself is streets ahead of docs. (And if you enter a code... it WORKS.)

[gblargg]

> Two decades of emails, documents, conversations, and contacts lost forever through no fault of my own.

One reason I regularly use Google's takeout feature to download all my GMail data. Only takes a minute to initiate.

[asdfasdf1]

phone numbers and email are virtually mandatory nowadays for banking, taxes, and many other things, including dealing with government bureaucracy... so why the hell is not made mandatory by law to be able to go to an email/sim phone service provider's office with your ID/passport/drivers license and be able to recover your account/number?? (allowing users to choose to provide that identification&recovery info when creating their email obviously)

[mzajc]

Google will occasionally brick my account telling me I "didn't provide enough info for Google to be sure this account is really yours". There is absolutely nothing I can do but wait for it unbrick itself after a while, all while not being able to read any mail that comes its way. Support is completely useless.

Needless to say I decided to forward all mail elsewhere. I wouldn't touch Google for work with a 3m pole.

[valrama]

> and lo, an hour after connection I get a message, that due to strange activity on my account, I need to enter code sent via sms.

It's interesting you got that message (via email?) one hour after you successfully signed in on your iphone. Are you sure it was not some phishing email or something? Also are you still logged in on that account or did you get logged out?

[adrianwaj]

Has there been any lawsuits for people such as yourself? "Can't get my mail but will get some money." There must be millions of people unhappy about the situation.

Surely, an AI can check each shut-off account, work out the identity, and then allow the claimed user to send in a picture of themselves holding some ID.... some variation on that anyway. A Gmail employee can do the final checking after voice chat, and the user could even pay for this.

They could ask questions like: Has person X ever emailed you? When did you meet that person? What's their email address?

Also, generally speaking, are voice biometrics ever used? That could work well. "Please send us a sound file of you saying _______" or call some number and speak to an automated checker. I suppose so many companies could get voiceprints by this stage of people they have recorded.

[rvnx]

It can even escalate to https://support.google.com/a/answer/1110339?hl=en

"Automatically suspended by Google systems for being at risk"

+ This is an automated message. Replies are not monitored.

https://www.linkedin.com/pulse/when-you-get-locked-out-your-...

Good luck.

[Andrew_nenakhov]

I wonder if there is a way to disable this SMS 'security' antifeature once and for all? I imagine it is a constant nightmare for people who travel abroad and do not always have connection on their number registered in their 'home' country.

[jbombadil]

+1!

Please Google let me have a normal TOTP authentication. No SMS, no "open the gmail app on this other device and tap this prompt", no mandatory Google Authenticator, etc.

[fauigerzigerk]

You can add normal TOTP and delete Google Authenticator. You can also delete SMS. What you cannot do (I think) is remove Google Prompt if you are logged into your Google account on a phone.

[ChrisArchitect]

Related/unrelated outage today:

Ask HN: GCP Outage?

https://news.ycombinator.com/item?id=44605732

[bsoles]

LinkedIn did the same thing to me after I have enabled 2FA, completely locking me out of all my devices. Then, they asked me to send a picture of my driver's license to a third-party company, who does some kind of validation I guess, to re-enable my account. God, I wish I can delete my LinkedIn account, but it is my only professional visibility to the business world.

[jonathantf2]

From all my years working in IT I've never had a good experience with the iOS/macOS mail app for either Exchange or Gmail, things break constantly. You're much better off using the proper Gmail or Outlook app.

[reaperducer]

From all my years working in IT I've never had a good experience with the iOS/macOS mail app for either Exchange or Gmail, things break constantly. You're much better off using the proper Gmail or Outlook app.

Very strange. I've been using both iOS Mail and macOS mail with my company's Microsoft Exchange server for almost a decade with zero problems.

I've also been using both iOS and macOS with Gmail on my personal account for close to 20 years across close to a dozen computers and devices, and the only problem I've ever had is when Gmail suddenly decides to let some company bypass its spam filter.

I think I use Gmail's web interface maybe two or three times a year.

[thibaut_barrere]

A bit of a sidenote but: what is a gmail alternative that really works? For instance, spam handling is worse in pretty much any alternative I've tried.

I'm interested in EU-based products first. But they need to handle spam well!

[AndersSandvik]

I recommrnd Fastmail! Switched to them like 3 years ago. They Are perfect for me. I use masker emails for my domain so i never get spam

[BoppreH]

I'm a happy user of Fastmail. It's a paid service (€5 per month) but that comes with higher standards. The webmail has been pretty good. Barely any spam to speak of (once a week?), even though I have various email addresses in public places.

[lucianbr]

Protonmail works in the sense that I can receive and send emails, it's always up when I need it. I don't know how much of the spam is not arriving or being filtered.

[delusional]

How do you defined "handling spam well"? What problem did you have with the alternatives you've tried?

[kstrauser]

I use Apple's hosted domain service, which is included in the price of Apple One we were already paying for. It's been surprisingly great since I switched my domains to it.

[paul-tharun]

mxroute is pretty good with their spam handling

[Tijdreiziger]

Soverin

[vouaobrasil]

In my opinion, the #1 way to make Gmail better is to enable forwarding. Then you don't have to deal with their ugly interface, login system, new features, weird compose window, etc....

[icedchai]

I'm one of the few that likes the gmail interface, I guess. Whenever I'm forced to use Outlook's web interface, I want to vomit.

[midnightblue]

Gmail has one killer feature which is the auto-acceptance of calendar invites. to put it better yet, it will put any and all invites and invite-looking things from emails into your Calendar. you still need to mark "yes i will attend" manually. that, as far as i am concerned, is the perfect UX for this workflow. i don't wanna have to create calendar items manually, feels very previous-century.

i tried to migrate from Workspace to iCloud but dealing with the insane OSX Calendar app which not only does not put anything into your itinerary automatically but is liable to just disappear items from the Calendar randomly, put me off so much i went right back to Workspace.

[Andrew_nenakhov]

That's actually how I use that account, but this time I decided to check how it works with the iOS mail app on new iOS beta with that liquid glass interface.

I even dug out my computer that was logged in to this account in desktop browser, and it too blocks access. Crazy.

[robertoandred]

Or just use a different email client?

[bpodgursky]

There's a button in the admin page for your workspace admin to disable extra security prompts for 10 minutes. Just ask them to help.

[Andrew_nenakhov]

it's a simple gmail.com account, not a workspace one.

[tptacek]

Since this is a work account, I think this is more between you and your IT team than it is between you and Google.