So far not a problem, but the email you get back after sending the password reset request contains a link to a page that allows you to cancel the request (not sure the genius who had this idea). Now that the email is hacked, the hacker can read the emails and click to cancel the recovery process. And the vicious cycle continues.
What to do?
Calling someone a "product" is a great way to make a flippant jab at a company but as far as a product is something a company produces, it's just not the case.
Google, like these other companies, produces useful (to many at least) services. The way they make money on this is by selling ad space or access to my eyeballs and earholes. So to claim that users are simply "product" is misleading at best. Their "product" for me is webmail, search, navigation, and file hosting. Their "product" for other companies is space where they can reach potential customers.
So in this sense, like countless other media and information companies, access is one of their products and information services make up their other products.
To sell to advertisers Google has to get people to use its search engine and other products. To do that it has to treat users like customers in that it would rather have them be happy than not happy, at least unless it costs them too much. This is precisely the relationship that other businesses have with their traditional, simple customers.
It is not difficult to do without them.
Asking for help on HN or Reddit works sometimes, but if your business (or personal life for that matter) relies on their services you should really work towards being able to do without them.
edit: just remembered they have a referral system, should you be interested: http://www.fastmail.com/?STKI=13352501
However, I'm using an IMAP box on Gandi.net and a domain purchased elsewhere and that is it. I refuse to use any services tied to a single company any more.
This change has given me a lot of headspace for other things.
It also comes with 10 minute turnaround time on phone support. You get a little popup asking if everything is okay and if you want to receive a call for support when you login to the admin interface.
I've been quite happy with it for the last three months.
I'm hoping you'll say no, because my feeling of security comes from the fact I've enabled TSV.
Get a U2F key. They work with Google accounts and provide much better protection against phishing (the phishing site does not have the key handle and cannot initiate the challenge-response as a result):
https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...
Sure it does. TOTP codes are only good for X seconds and most phishing scammers merely collect the information to use much later (I have seen the source behind the actual phishing sites).
I have yet to hear of a story of someone's account being compromised while using TOTP (knock on wood).
But seriously though - companies like Google, Facebook, Gandi, Dropbox, and Microsoft all use TOTP. So I would wager that TOTP is pretty safe to use.
Upvoted you but...
A company offers a free service. "Your aunt" does know know or understand the need for "two step verification" nor do almost certainly a large percentage of people using gmail.
This idea that companies resolve themselves of all responsibility to provide reasonable customer support for a free product with such wide adoption is ridiculous. Google derives benefit from the relationship regardless of the fact that the service is free.
... and stories such as this are the consequence we shall have for taking the Libertarian solution. Not that I disagree with the solution taken! I just have a hard time swallowing the argument that it's always the provider's responsibility to account for total user ignorance at all times. A solution has been provided for this attack vector, and if the end-user chooses not to use it then perhaps at some point the onus is on the end-user.
(Or perhaps Google should just make 2FA mandatory for everyone, "your aunt" included).
I wonder more and more if we need to make it mandatory in some form, but maybe more formal. Like you can use your phone, but also here is a plastic, officially-sealed set of codes we'll mail to you at a verified address just in case.
This is why you end up fixing your aunts printer. And why you have a more secure e-mail account than her. And why you can handle backing up your photos.... etc
It's not Google's fault entirely.
The first step would be to edit the title of your submission to begin with "Ask HN: hacked Google account, what to do?", since you're asking a question.
"Google hacked account" means, to an English speaker, that Google perpetrated hacking against some account somewhere (subject-verb-object, right?) E.g. Google people gained access to your bank account. I.e. your current submission title is clickbait.
The current title is ambiguous at best; just plain misleading/sensational at worse - especially now reading that this is really about just one person losing access to their Gmail.
_____
EDIT: In case the title does get changed, the original title that I'm looking at right now is "Google hacked account". This is what I woke up to this morning --- http://i.imgur.com/vWJ41ck.png
The prospects for the rest of us are fairly bleak.
Mostly because if changing ownership of a Gmail account were as simple as "Post to Hacker News and complain," it'd be an obvious and exploitable security gap.
"White House Gov Account Hacked, Please Help"
However, us normal plebes should be able to get some competent human on the phone and talk to him about what's going on.
I'd hop through lots of hoops to recover my google account, but without getting a human's attention I can't do anything.
I don't expect it to be easy to change ownership of an account - but there has to be a secure process that one can follow in the event. I'd be happy to pay for it. It's the fear that if the worst happened you would quite simply be unable to contact anyone that concerns me
Unfortunately, it's a tough situation since for all Google or we know you could be the hacker trying to get into the account and hard for them to verify who you are, since if the hacker was able to steal person's phone to bypass 2 factor authentication, they may also have access to a copy of your drivers license or ID to send to google in an attempt to verify they are you.
While far from ideal, assuming you don't have a close friend to contact google for you via their google apps admin account, you could create a new trial google admin account and then contact google through that mentioning your situation of your other account. While they will still have to find a way to verify who you are at least you'll reach a real person.
I did create another account, they still send the link to cancel the request to the original account!!!
My mistake was that I didn't enable 2 factor authentication.
Honestly I'm not sure what Google can do here that (a) doesn't require them to now individually support users ($$$) or (b) doesn't open them up to thousands of erroneous claims.
http://www.zdnet.com/article/invasive-phone-tracking-new-ss7...
SMS-based 2FA is really "security through obscurity". It's "good enough" (generously said) if you happen to not piss anyone off or be someone's target. Otherwise, not so much. I don't think enabling SMS-based 2FA will pose any problem for China to hack back into OPM for instance, and yet I think that's one of their "fixes" right now.
Google's Authenticator is also useless as now Gmail allows you to bypass the Authenticator when you can't authenticate with it for whatever reason, and go straight to using SMS 2FA instead, which brings us back to point one.
Did you set the recovery email the same as the main email? Cause I only get password reset to the recovery email.
If you used the same address for recovery email, then it defeats the whole purpose
I actually just tried it on an account I own, and it does not send the email to both addresses, only to the recovery email address.
If that is really happening to you, that sounds like a bug to me.
Going to this URL logs you out on Gmail: https://accounts.google.com/Logout?service=mail&continue=htt...
This might not work, but it's probably worth a try.
Knowledge about items on the inbox/address book
Location of devices used to access the account
Knowledge of past passwords
Not sending password reset emails to secondary emails that have just been added
I've had more than one job that uses gmail in the office, including my current one. My boss's account is presumably authenticated and if I bugged him he would vouch for my identity.
I have correspondence with a bunch of people in my google account going back years. I could bug any number of them to vouch for me.
I've had, in the past, a few work accounts that used google, that mad my picture associated with it. I can do a google hangout to show that that is still my face.
I have a driver's license with my real name on it, which matches my google account.
I control the phone number associated with my google account.
. . . A hacker could compromise one or two of those, but it would be hard for him to get a majority of them, even if he had my phone and email in his control.
On the other hand, it is a free service. If you'd have the business subscription, they do have a helpdesk you can contact by phone: https://www.google.com/work/apps/business/support/
Email is the most sought after account. All the password reset requests to your Bank, Twitter, Facebook, etc. are delivered to your email account. So when someone steals your email account, they've stolen all the others too. Go change those accounts to use your new email (if you can).
Yeah, and the cancel request was a total stroke of genius!
It may not be enough to run a password update before they act on the email. It also may not be physically possible if they have a script watching for such emails from Google and cancelling the request immediately, you'd then need to set up a faster method and/or receive the email before they did.
I believe i can help.
It's equally likely that you are trying to hack someone else's account as trying to recover your own. There's nothing wrong with the password reset process.
However, isn't there a process for when you suspect your account has been compromised? Have you even tried that? Are you even sure that your account has been compromised, or you just can't remember your password?
I like that us hackers are happy to help, and happy to commiserate with the failings of big corporations, but I think it's worthwhile to be a bit sceptical.
Edit: I'll add that the claim that the reset requests are going to the original account and being cancelled is fishy. We have verification in this thread that this in fact does not happen, and presumably the OP can't access the account to make a truthful counter claim.
The key for me was providing sufficient proof that the account really was mine and really had been hacked. I gave them as much information as I could remember/check:
* some contact names
* some tag names
* some recent thread subjects/recipients
* name of the person who first invited me to GMail back in the day
* details of any labs settings, theme etc
* mailing list subscriptions
I wish I could remember the email address I used to get in touch with them but, as I said, this was years ago now. I definitely found it somewhere publicly available, albeit buried somewhat.
HTH
This is like an alternative to two-factor communication. It can only be defeated by someone actually hacking your account and then convincing 3-4 of your close friends to send him the keys to your account when you start the dispute.
I'm a big fan of using information obtained easily and casually in the course of doing something productive (like often emailing someone) for good purposes.
PS: I have disclosed it publicly on this date so no patenting! :-)
I suggest, for the future: 1) use two factor authorization 2) use a separate email service because email is so important that you need the best support, etc. that you can get (I use Fastmail) 3) periodically download your Google data so if you ever need to set up a new Google account, you have some of your old context
I do still use GMail, but as a backup email.
I am going to start teaching free Internet security and privacy classes at my local library so I have been thinking a lot about these issues. Google, Facebook, Twitter, etc. provide really nice services, but it is important to consider privacy issues and have a plan for using these "free" services.
Additionally, you have to track every change with a timestamp so that you can invalid everything that came AFTER the change you just reset. That will prevent a hacker from being able to screw with the account because the original email address will also be able to cancel future changes, no matter how many times the perpetrator did it.
My best guess: malware on the forum OR they exploited a vuln on Gmail.com similar to how hotmail.com & yahoo.com used to be very very vulnerable..