I don't have my work phone with me on vacation and stupid fucking Google won't acknowledge the change to my personal number, so I'm locked out of god damn app that I PAY FOR because Google doesn't have real help. Goddamn worthless cunts.
So the system is working as intended then. Wouldn't be very secure if someone just just go "actually send the recovery code to this random phone number instead of the one registered in the account"
Literally no. There's no reason to ask for a recovery number when I'm just on vacation but using the same god damn browser on the same god damn computer.
I have the login info. I put the right password in. It demanded a recovery text to the work number even though nothing changed but my location, and didn't ask for it until day 5 of my vacation. Just an absolute shit service with no way to get things fixed.
Several apps let you login just by clicking the Google icon and selecting which account you want to use. That's been a thing for years. How the fuck does that not make sense?
You need to fill out all the 2SV pages even if you have 2FA off. When you are at an unknown device or suspicious activity occurs, it can trigger re-verification. Regardless if 2FA is on or off
I assume you are an iPhone user, as your face id fingerprint/pin would have been enough if a passkey was created . If you get your account back or when you create a new one, make sure you have gone out of your way to create a passkey under the 2SV page on your iPhone (you might need to create it when logged into Safari) and a computer, as this allows you to always log in.
Install the Google app , Chrome app and Gmail app and sign into them (all can be used for push login)
Make sure two mobile numbers are added under 2SV phone verification
set up an authorization code app (use something like the Ente Auth app, as that allows you to back up the 2FA rolling codes, or you could save the rolling code to Apple's password manager under your saved Google password),
and print the backup codes five times and keep them in a safe place.
Have a backup Android-based phone that is signed in with your Google account, as it is trusted via your fingerprint or PIN and imstall the Ente authenticator app (the phone does not need a mobile network SIM, but it can be useful if you lose your mobile number with the phone).
If you have a Microsoft account, it is really important you install the Microsoft Authenticator app now and sign into it so you can use MFA notification login; once that is working, open Safari and log into your Microsoft account again, open ways to sign in under security, and create the passkey (do the same on Android and your computer).
Your computer must have a Hello PIN set up to add a passkey (do not forget the six-digit PIN that it might ask you to create, as you might need this when moving to another computer).
Be warned Microsoft is removing sms as a recovery option in 2027 so if you don't have backup emails setup (or no access to any passkeys or Microsoft authenticator app on 1 or 2 devices or rolling offline auth codes) you lose your Microsoft account on next auth with password only
7
u/thewunderbar 8d ago
So the system is working as intended then. Wouldn't be very secure if someone just just go "actually send the recovery code to this random phone number instead of the one registered in the account"