What is the safest Google account recovery option?

Question

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app.

I want to set up a recovery option, and I have two choices:

• Phone number: I've read about attackers abusing phone companies' customer services to compromise the phone number of victims. It's hard for me to trust my phone company with all of my online accounts, given that they have the reputation not to take security seriously,
• Another email address: this seems to be the safest option, but it's pretty obvious that I should not set up 2FA on this account, which would reduce the security of my main account to a simple password, which was exactly what 2FA should avoid!

My idea is to create an email address that has no link to my main Google account, with a very strong password (like in 256-bits crypto-secure-RNG strong password), and to store its password securely. Is it really more secure than an account without 2FA?

Answer 1

The most secure option is to buy two U2F devices (about $20 USD each), register both, and put one in a safe deposit box.

SMS can be redirected to voicemail (with easy password brute forcing), and is susceptible to phishing

TOTP is safer but is still susceptible to phishing

U2F is not susceptible to phishing

You have to provide your phone number first with Google, but you can remove it after having setup the 2 U2F devices. You also need to use Chrome, or a Firefox extension

Answer 2

There are different risks to assess in a recovery situation:

First you have the backup codes WoJ told you in the comments. You should print out them and store in either your PC or somewhere else like your wallet (better in both!). If these codes are lost it's not a "big deal" because those don't guarantee direct access to the account, first you need to know the password.

Secondly, how likely and realistic do you think it is that someone would be able to spoof your identity to your phone provider so that he can receive SMS in another device which doesn't have your SIM card? Very low chance IMO, so it's a safe bet as well.

Thirdly, about your idea, it is rather bad. Why create some sort of UD)P(AS/P)BY AGOS&b8f7f67s9apf password that you need to store somewhere instead of creating some simple length password? https://xkcd.com/936/ never gets old. Unlike the backup codes, if this password is retrieved then you would have lost your account, as it grants direct access to the second email.