Today a friend sent me an article from HackerNews title Librarian's Letter to Google Security. As someone who teaches Digital Literacy, this breaks my heart and it's a story I know well. I'll paste some quotes here:
The way Google’s two-factor authentication system is designed, sets up poor and elderly people to be locked out of their accounts again and again, and without access to their email, they lose their welfare benefits, their housing, and struggle to find work.
This elderly woman, looked to be in her 70s, might lose the roof over her head, due to being unable to log into her Google account, because she lost her old phone and with it, her phone number.
... no support line to turn to. It is a daily occurrence, ...
And you can imagine there is much more. Here is the link to the actual letter, which is hosted on Google Docs.
The good news is there is a way. A little while back I created a way to essentially make my own Google account backdoor, a backdoor known only to me. Conceptually this is somewhat similar to a port-knocking script. Do this now, before you get locked out of your account. If you're already locked out, this can't help you. Also, the idea is to set this up on the account you want to regain access to, but you can also create a secondary email just for this purpose. It's your call.
- Generate a list of one-time-use backup codes in Google Account Settings.
- Copy the list of backup codes into a Gmail Template.
- Set up a filter in Gmail that looks for a very specific string in an incoming email. Configure the filter to autoreply to the incoming email with the gmail template.
- If you are ever locked out of your account, email yourself from a throwaway with the very specific string you have chosen. Your robot-email will autoreply with the list of access codes. Voila, you have regained access to your account.
Go to your Google Account. Go to Security Settings and click 2FA. You should see an option for Backup Codes there that looks like this:
Click on it and create some backup codes.
I have edited out my backup codes here, but there are ten eight-digit numbers. You may have to enable some other form of 2FA (adding a phone number) as well to be able to generate backup codes.
Now, enable Gmail Templates.
- Open Gmail.
- At the top right, click Settings > See all settings.
- At the top, click Advanced.
- In the Templates section, select Enable.
- At the bottom, click Save Changes.
Create an email, then paste in your access codes into the email body. Do not put any recipients into the To: field. You can put whatever subject line you like.
In Gmail, click this at the top:
and a search filter panel will appear. Type in something very specific, known only to you, that would never realistically appear as a subject line to a normal email. In this example I have chosen
One giant leap for mankind.
Once you've typed your phrase into the Subject: line, click Create Filter and a new panel will pop up with some check boxes:
Check the one where it says Send Template with a drop-down box. Choose the new template you just made and click Create Filter
Now, you can test it. Use a junk email address and send an email to your Gmail email address with the very specific string as the subject line you chose. I used my work email address to test mine, and it auto-replied right away.
There is one caveat to all this: Be careful you don't use all the storage capacity of your Google account. Google has an automated policy where if you use up all your storage space, email comes to a grinding halt. So beware of that.