Gmail's backup codes are useless to access account
86 Andrew_nenakhov 83 7/18/2025, 4:32:55 PM
Ok, I have a work account on Gmail. Having the experience of being locked out of Gmail previously (endless loop of "You are entering the correct password but we're not sure that it is you, try again later"), I created a 2fa via Google Authenticator and set up Backup Codes and thought I'm safe from them asking me to sign in on another device or enter sms code (I don't carry that phone with me).
So, one sunny day I decided to add standard iOS mail app to this account, and lo, an hour after connection I get a message, that due to strange activity on my account, I need to enter code sent via sms.
Ok, I don't have that phone with me, so I try to log in with Authenticator, and no, no good: 'we are not sure that it is you, enter code sent to sms'. Ok, I dig backup codes, enter them, and still get 'we are not sure what it is you' message.
What's even the point of allowing to set up Authenticator or Backup Codes if they don't do anything?
If there are some people from Google reading this, please, don't reach out to me offering to help. Just change this dumb system.
More than once, I was in a different country and tried logging into a workspace gmail account. Google flags it as a strange activity (fair enough) and needs to authenticate me. It asks me to enter the complete address for my recovery email (I do this), it sends me a code to use for sign in (I do this) but it still refuses to sign me and says it can't authenticate me. It says I need to sign in from a location that I've signed in from before.
So, for the period that I was out of the country, I couldn't access my email. This happened each time I'm in a new country. My only work around was to sign in to my email (on my laptop) before traveling and not sign out (for security reasons, I don't like to do this).
Something similar happened when I used a new laptop.
I just don't understand this. What then is the point of having recovery email and phone number if you won't use them?
It was firstname.lastname@gmail.com that I lost, as I was mostly using my original account with a pseudonym for anything private (was a teen when Gmail started, so didn't think twice about using a cringe username back then).
I had configured the first/last name Mail to forward everything to the pseudonym email and didn't access it again for something like a year... Then I had to respond to someone and... Well, Google never let me access it again.
I eventually gave up on it entirely and switched to a custom novelty domain on fastmail, much much later. (A portmanteau of my last/first name
2) I didn't change the policy on the workspace email when I signed up for it
The point is still - why ask me to authenticate via different methods and then reject them after I've correctly authenticated? If some policy is overriding these, then you shouldn't have asked me to authenticate via those methods in the first place.
But then I thought- what if I just try that password to login. And it worked.
So when I thought I had forgotten my password, gmail prompted me for a piece of information that I got correct, and then wouldn't accept it.
I also have another email account that forwards all mail to my main account, but I've definitely forgotten that password, and I have no way to actually get back into that account, even though I've tried. I guess it just forwards mail forever.
Probably not forever:
https://www.npr.org/2023/11/27/1215285876/google-inactive-ac...
Then, after 2 months, I tried logging in and suddenly it worked.
A few hardware security keys will probably prevent this problem for you. I'm wondering why you didn't consider getting them after you had login problems before.
I use a seriously backed up password manager that I have means to access from anywhere, and the only thing I have to worry is that I'd forget my really complex password to access it, because it is unfeasible that I'll lose all my devices where it is backed up and also an off-site backup of it.
With hardware keys, however, I constantly have to worry to keep them with me or in a safe place and not to lose them.
(my position is partially rooted in the fact that I happen to live in a country where you can easily have all your material possessions forcibly taken from you)
If you lose your hardware keys, you still have your other 2 factor options, so you are no worse off than your current situation.
The safest option is straight out of 1994: Sticky notes.
Security keys can get lost or stolen. If someone breaks into your house or office, they're going after something other than a sticky note in your desk.
It's interesting you got that message (via email?) one hour after you successfully signed in on your iphone. Are you sure it was not some phishing email or something? Also are you still logged in on that account or did you get logged out?
The point of my rant was that with modern day Google, TOTP authentication is not enough.
I don't care if things have changed, it was a shit experience. I highly suggest to stay away from the Google Authenticator lock-in danger.
By the way I'm pretty sure the prompts work with as many Google/Workspace accounts as you want.
Please Google let me have a normal TOTP authentication. No SMS, no "open the gmail app on this other device and tap this prompt", no mandatory Google Authenticator, etc.
Needless to say I decided to forward all mail elsewhere. I wouldn't touch Google for work with a 3m pole.
"Automatically suspended by Google systems for being at risk"
+ This is an automated message. Replies are not monitored.
https://www.linkedin.com/pulse/when-you-get-locked-out-your-...
Good luck.
They're asking for a phone number (so, good to know - if a hacker actually got my username and password, they could access everything Google has on me if they have a fresh phone number, I feel super protected), which I am reluctant to provide, but it still doesn't work.
As you highlight, no support.
In general, no. I've wondered if legislation would be feasible though, especially given the flaws that have already been shown.
Outlook is unusable but harmlessly so. What's worse is Microsoft 365. I simply can't find a way to configure 2FA in any kind of sensible way. Right now it's simply turned off, which makes me very nervous. Whatever I do, it is somehow overridden in other parts of their byzantine and always changing cat herd of admin sites. I'm waiting impatiently for our M365 subscription to expire so we can finally migrate off this nightmare.
i tried to migrate from Workspace to iCloud but dealing with the insane OSX Calendar app which not only does not put anything into your itinerary automatically but is liable to just disappear items from the Calendar randomly, put me off so much i went right back to Workspace.
I even dug out my computer that was logged in to this account in desktop browser, and it too blocks access. Crazy.
Very strange. I've been using both iOS Mail and macOS mail with my company's Microsoft Exchange server for almost a decade with zero problems.
I've also been using both iOS and macOS with Gmail on my personal account for close to 20 years across close to a dozen computers and devices, and the only problem I've ever had is when Gmail suddenly decides to let some company bypass its spam filter.
I think I use Gmail's web interface maybe two or three times a year.
One particular well documented issue that first cropped up about 5 years ago that I still see to this day is the spam of calendar invite acceptance e-mails (so much spam that the user gets outbound blocked). Only happens if the user accepts a calendar invite using the iOS calendar client, MS couldn't identify an issue and Apple didn't wanna hear about it.
I'm interested in EU-based products first. But they need to handle spam well!
Ask HN: GCP Outage?
https://news.ycombinator.com/item?id=44605732
Losing that account is a big risk for your work, paying Google Workspace is an investment in your case.
In this case, the user has already authenticated with three factors(!). Framing potential VPN use as "suspicious" normalizes a more locked down, surveilled web with fewer rights for humans. We shouldn't be pushing that direction.
Also, just to point it out, logging in at all is a bit suspicious. Normal users rarely do it. You authenticate to Google on your mobile and that's it, you never do it again.
All lot of these other comments are talking about policy and principals but I am just trying to help the OP by taking their question at face value. Their goal seems to be to login to Gmail.
Although maybe you didn't mean to make such a strong statement.
Why wouldn't a 2-factor or a recovery email sent to another address be enough to refute this?
If you can hack someone's device, it's not that much more difficult to tunnel the connection through a residential VPN. If you can't hack their device, then you can't get 2-factor codes or access their other accounts.
Not only is the email protocol (SMTP) an unreliable transport now due to spam filtering, but the actual login interface (IMAP) is also unreliable! Not that this will actually accomplish anything. Spear phishing and spam campaigns seem to be ever-present.