I think I've found an ability to quickly recover password and reset account of someone who is not using gmail.
I've been getting this message on my dummy phone. I tried to google it but I don't think it's showing up anywhere and it seems like something that is new. It has been sitting on my emergency 000 phone for the past few days without me paying much attention to it.
Image is here
Try to login to your google account using a proxy or something suspicious, but don't actually type your password in, just press "Need help". Make sure it is using https if you want to avoid your email being harvested. Alternatively it would be better to create a temporary google account with a non-gmail address. (or use your VPS)
Enter the last password you remember -> Press I don't know
Select one of the options below to reset your password: -> Choose I no longer have access to these
About your Google Account
When was the last time you were able to sign in to your Google Account? (Required) -> Type something close to today's date
When did you create your Google Account? (Required) -> Guess a few of these and you'll get in without needing to go to the next step where it asks about other tools which you may not even be using.
It will then allow you to set a new password.
Otherwise it goes to another step and asks you to put in some details about where to send the password reset information…
You won't get an email from Google that someone has tried to go through the password reset process for some odd reason, as I have this turned these notifications on and have received nothing, including the duration of my attempts on my own account using a proxy.
I'm not on any leaked databases that I know of. So, pay good attention to your android phones… Should I add a real phone number… Probably not as I can live with this phone being hacked.
Has anyone here gotten this message before? (see image above)
Let me try and explain why I brought up this issue. When you sign up you reasonably expect to be able to only recovery your account using the details you provided and not some public information or guesstimates. Worst of all it asks for easily discernible information like when someone started using youtube\other Google products which have public facing information….
I didn't even expect to find these methods of recovery. I think when we all sign up for a Google account we expect it to be more along the lines of only allowing certain bulletproof recovery methods or to basically lose that account. Not some method that is easily broken.
I do not know when these changes were implemented but it sure as heck was not like this before, with the exception being telephone support social engineering mentioned in a talk I went to recently.
Google also has this new psuedo-policy from its actions, allowing accounts to be breached and information harvested before notifying that a weird device has been used to login. There doesn't appear to be many proactive measures other than to use 2FA but I think the option to use other recovery methods such as above will exist as many lose their phones. This renders 2FA useless.
Whilst there does not appear to have been a breach on my account as of yet, or at least not noticeable using Google's security tools; I think we really need to look at how recovery takes place. Even ozbargain has better security against account recovery attacks……
I sure as hell would not recommend gmail or such be tied to an internet banking account even though it is easier when changing ISP. Remember, the breach happens before you can act, leaving you to remove the offending device from Google's portal, but the attacker has already accessed your email should you become a victim. I think the recovery methods are quite similar for Gmail accounts, but I have only tested the relevant non-gmail Google account which was showing the warning on my android device.
Lots of typos, typing on a tablet whilst in bed…. New epiphanies about my dilemma keep cropping up in my mind
I was fascinated by this so I tried it, but after the stage 'when were you last successfully able to sign in' I got a series of questions:
what is your favourite cat's name
Email addresses of up to five frequently emailed contacts
Name of four labels etc
if you continue to skip these (or enter incorrectly) it says
The information provided does not match our records. Try signing in from a location where you usually sign in (e.g., home or work) and fill out the account information again.