Google's Password Recovery Scheme

So I have a Google [1]account (my Mom's) that get used periodically. She might go a fair while between uses. She signs in on the tablet, looks at emails, and that's it. The sign in may be in the form of a remembered login.

Meanwhile, somehow, the password I configured for this account no longer works. It could have been hacked, she could have changed it without recalling, or I may have long ago and never needed admin access and botched the task of updating my own records.

Thus I try Google password recovery. I have in hand:

• the first password of the account
• the account creation date 
• someone she emailed (probably one of the only ones): my own email address
• the answer to her secret question
• the recovery address (no longer accessible to me)

What I didn't have:

• The last access date (she won't remember and I may never have known)
• Other Google apps - she only uses Email
• Other people she has mailed (I think she only sent to me)
• Labels (I have no idea if I or mom ever created any)

And what happens? Google tells me this information does not match their records. They don't say 'not sufficiently complete' or 'because the user doesn't use our other apps, happens to forget the last time she logged in for email, and doesn't mail many people or use labels, there just ISN'T enough information to allow you access'. They just say my info doesn't match their records which I believe is inaccurate. 

The Magic of The Phone Number

Google seems to believe that the phone number is more secure than other means because it involves possession of a physical token (your phone). 

That does introduce a physical factor so it does make things in some senses a bit harder than security questions (although it should be possible to make these un-guessable) and passwords.

HOWEVER...... there is a huge issue with how most people and apps operate on phones. IF some ne'er-do-well steals the average phone and can get in (they get in while it is unlocked or someone is using a swipe pattern that shows up in finger-grease on the screen), then they are into your mail account and via it, your whole Google world. THEY OWN YOU. 

Even though they haven't entered a password (the Gmail app remembers it), they have email access. if you aren't using that app and go into Gmail by web, if they see that you've got calendar entries in calendar app, they know you have a Gmail account. They can then use that knowledge plus the magical superpower of having your phone in their hand to order a reset and hijack your Gmail account. 

Note, this scenario can work regardless of them never knowing your Gmail password. If they have your phone, they can reset the login (and then the phone number). 

How's that more secure again? It is more secure 90%+ of the time and WAY LESS secure in that other few percent where someone lifts your phone if they can get in.

 Lesson: NEVER let your phone get stolen and NEVER have it unlocked or locked with a swipe pattern. 

Footnote: Apparently Google is more powerful than I think. Google shows up fine in blogger's spell checking, but google (a word long before Google) does not....