I was NEVER prompted for a phone number or given a warning that I will not be able to access my account if I didnt have one. (Maybe because i already had one on the account and removed it?. Not sure). However, off and on , google would prompt me for my recovery email and I had no problem accessing my account using that.
I reached out to financial institutions where I have an account. In addition to changing the email id, I am exploring all possible means to ensure that the id of the person requesting an outbound transaction for the account is doubly verified. Unfortunately, risk management office is closed over the weekend.
1. My new Asus RT AX86U had Merlin installed on it. I disconnected this router after I started getting security alerts and switched to using the router provided by my Service provider.
2. I use firefox with cookie cleaner add-on that clears cookies the second I close the tab.
3. I have a paper copy of the account details and I am 100% sure of my recovery email. I got a Yubi key recently and plan to use that and authenticators on all my accounts.
2. Instead of that use separate firefox profiles - one exclusively of Gmail. Another for casual browsing. If you clear cookies all the time then it seems like you are logging in so many times per day. This could be a warning sign of hacked account - for google. (i.e) do not do unusual things.
3. At the end U2F is the proper solution, albeit late!
I totally agree with you. That was a mistake on my part . I had my number on the account a few months back.But my thinking was similar to what @orblivion posted below
"Because I've been warned by security conscious people never to use phone number as a 2FA because it's so insecure, and using it as a recovery option seems to create an even weaker link.". I happened to read so many articles in the recent past of SIM Swapping, that I was afraid to use my cellphone number as 2FA and removed it from my gmail account. What with Google being evil and all
> Because I've been warned by security conscious people never to use phone number
Sadly you read only one part of the warning from security conscious people. The main part is to get U2F/FIDO key or use QR-code/authenticator. The same security conscious people use Fdroid/AndOTP where you can export all your 2FA codes.
There NO reason to say if I shatter my phone. Yes, you can also print recovery codes and keep it at home.
We're not talking about 2FA, we're talking about account recovery. I do have my authenticator app set up. Can I use it to prove myself if Google thinks somebody stole my account?
Yes, I just tested it with one my accounts that has NO recovery email address/phone. ONLY U2F key.
Select forgot password; the it asks Insert U2F Key. Then recovered. Yes, it may be that if one loses U2F key in Metro it is dangerous but some risk is always there. (i.e) how many times have you lost your key in your life? If more than one per year then keep one U2F at work and one at home.
Lightning struck very close to my apartment and fried all equipment that was connected using Ethernet cable (cable modem/ router/VOIP unit, Roku). My TV was spared.
The apartment has a circuit breaker (which tripped) and I have a surge protector as well.
Did some research and read that a Surge protector with "Catastrophic Event protection" feature would have helped. This feature fries the surge protector instead of the equipment connected to it. A note from the mfr of the product I am considering buying: "most surge suppressors continue to let power through even after circuits have been damaged, leaving your equipment exposed to other damaging surges." The surge protector I have does mention that power will pass thru it, if power surge is more than what the suppressor can handle. HTH.
