Sometimes there's luck when a site will believe a desktop web browser on an Aarch64 Linux is a mobile phone, but that's probably realized by now.

Yeah can be frustrating, I hate it when they make everything tied to my phone because I think a phone is for calls and everything else on there is really an abomination. But sometimes you have to move with the times. There were authenticator apps for a while but I haven't had to use them lately, are they still a thing?

What about gmail, outlook, icloud - don't they provide enough options for mutual security triangulation?

My problem is that email tied to a phone, a single phone can also go into recovery resulting in the same problem unless I have access to another device.

(This problem initially occurred on a cell phone)

I also am loath that a thing I never use has to be accessed often, otherwise it also goes into recovery

Apparently I'm supposed to have a recovery email if I get locked out of the phone itself but that again means multiple devices that stay certified as modern email can't just be logged into without assumably the device that is inop

This is the entire point of those recovery keys everything gives you went you setup 2FA.

You know the things they tell you these are important, don't lose them and everything just ignores them? Print them out, toss them into a password manager, etc. Those are onetime use codes that will work as 2FA to get you in to an account. Once in get things fixed and then generate new recovery codes.

SScorpio wrote on Today, 13:06:

This is the entire point of those recovery keys everything gives you went you setup 2FA.

You know the things they tell you these are important, don't lose them and everything just ignores them? Print them out, toss them into a password manager, etc. Those are onetime use codes that will work as 2FA to get you in to an account. Once in get things fixed and then generate new recovery codes.

The third party email I had forever did not have that option

This android was mostly setup in store before I left, so will see what happens when I finish setup or if it's possible to generate new recovery if past that point. My experience is that my emails as of the last year seem to want almost constant access to codes sent to a recovery email and won't accept the other options available.

Using an e-mail account hosted by one's ISP as a recovery e-mail might be an option, if one's ISP still offers those. My current one offers online and over the phone password reset options.

Granted, one needs to keep that up to date if one changes ISPs often and one needs to trust the ISP and their adherence to sane security policies.

Another option is getting one's own domain and e-mail. More expensive and more complex to set up and manage, but that is the cost of having more control.

rmay635703 wrote on Today, 13:15:

The third party email I had forever did not have that option

This android was mostly setup in store before I left, so will see what happens when I finish setup or if it's possible to generate new recovery if past that point. My experience is that my emails as of the last year seem to want almost constant access to codes sent to a recovery email and won't accept the other options available.

Use the Gmail app, once your account is associated with the phone there's no 2FA to access your account needed. Stop accessing email through a web browser, there's no reason to.

You don't get send prompts for 2FA codes when trying to read or send emails from the app.

I much preferred the secret key token generating authenticator approach. I guess it means you still have another password but it's a 512 bit plus secret key that the codes are generated from. Anyway using open algorithms you could get an authenticator app that ran on anything. So you could have gauth implementation on PDA, desktop any OS, your "live" phone or an offline old phone.

However, almost nobody uses that any more, only give you text or email options, grrrr.

I did have a "go around" the other year when a service changed their security while my account was in a sleep mode state due to not logging in for a couple of months. Thus the one time use codes I had didn't work. Luckily it was one that had brick and mortar branches so could turn up there with ID and get it reset.

A lot of places though seem to be forcing the whole thing onto phone with no regard for the "what if I have my phone stolen, destroyed or lost?" problem. If you make me have the app, then the 2FA is text, then with my phone in hand a thief has BOTH THINGS. Also a huge pain in the butt when phone is discharged or not getting service or wifi connection. I am insisting on keeping physical SIM at least so if phone gets broke, dunked, etc there is a higher chance that SIM is okay and I can swap out to another phone.

I have a current irritation that two apps which I may likely need when out of the house, and I had to use long complex passwords for, keep expiring their logins when I am out of the house. .. and of course I neither remember the password or carry the damn thing around with me 24/7

Anyway, yeah I have to bat things around between 3 emails and I can certainly see how the problem can occur, I am not totally sure what my "circuit breaker" is if I get a re-auth loop like that one. Seems like though, you pick things for one reason, then that reason goes away and you're locked in anyway. i.e. your new email doesn't require it right now, but next month, no choice.

Maybe in a pocket diary or on a wall calendar though, every 3 or 6 months put a note to log into things to keep them fresh. Or get an Atari Portfolio with a DOS agenda app 🤣

2FA is a scam masquerading as security. The problem will get worse and worse (by design), until it affects enough people then it will be time to roll out the "solution." You can imagine what the "solution" will be.

In the meantime, get a real email account that you access via imap/pop/smtp instead of web-based email. Then you won't get randomly locked out. Downside is that it costs a few bucks, instead of being supported by ads/spyware.

(And if you need a workaround for text message 2FA rituals, maybe you can get one of those $5/month phone numbers from Rob Braxman)

darry wrote on Today, 13:51:

Using an e-mail account hosted by one's ISP as a recovery e-mail might be an option, if one's ISP still offers those. My current one offers online and over the phone password reset options.

Granted, one needs to keep that up to date if one changes ISPs often and one needs to trust the ISP and their adherence to sane security policies.

Another option is getting one's own domain and e-mail. More expensive and more complex to set up and manage, but that is the cost of having more control.

The only 2 real isps available in this area wound down email service sadly, considering the environment we are in having human technical support to unlock email is a must.

The guy selling T-Mobile had lost his Gmail access despite still having the original phone and using it.
It was a big problem for him and now his backup recovery is his x wife because he doesn't have anyone else.

For me keeping an active private email was never a problem from a kid onward until the last year and a half, everything just keeps getting trashed and inaccessible. As critical as email is being made it's unfortunate that it's a single use disposable garbage tier now.