3

Assume that I will never, ever, forget my (in this case, Google) account password.

With that in mind, is there any benefit whatsoever to setting up a recovery email/phone/etc.?

Or are all of these services only useful in the case of a forgotten password?

3

TL; DR

It's a really good idea to have these set.


In addition to recovery options, they can also be used for setting up 2Factor authentication or other types of verification as well as a backup spot for notifications about "New Sign-in from XXX". To help detect unauthorized activity.

Additionally, consider the case where someone tries to brute force your login and locks you out of your account. You may need the recovery email to get back in. Without recovery options set, an attacker may also be able to get in to your account through the forgot password process since you have no backup accounts for Google to bail you out with.

  • Thanks for the answer. However, I have some counterpoints: (1) 2FA is via SMS or an app, and I'm using the latter (so why have a recovery email?); (2) this is my main email address, meaning that the very fact that I can't log in would be my first notification of unauthorized activity, rather than any other email account -- in fact currently they all forward to this one anyway; I never check them directly. (3) I don't understand the brute force thing; can't they already use the forgotten password process anyway? – Mehrdad Oct 21 '16 at 5:32
  • 1
    1) i see your point 2) if someone logs into your account (without locking it) you still get notifications that this has happened, you would know something is wrong if you get an email saying someone logged in from China when you are in Spain.. 3) if i try to guess your password, after 10 attempts your account locks and needs you to reset your password, the only way you can do this is via external accounts – Topher Brink Oct 21 '16 at 8:51
  • Thx @TopherBrink, exactly what I would have said -with the addition that the recovery account shouldn't forward back to the account it's being designated a recovery account for... for obvious reasons. A successful compromise of the primary account would allow the notifications (in point 2 above ^) to be deleted by the attacker. – HashHazard Oct 21 '16 at 13:46
  • @Mehrdad regarding point 1 above ^, if they already have your number for OTP SMS, what's the harm in also having it for a recovery option? – HashHazard Oct 21 '16 at 13:48
  • @Hollowprox: (2) I thought e.g. Gmail sends you notifications even on the main account if you're logging in from your usual location? Am I wrong? Does the main account get no notifications? (3) here's what I'm not getting though: if the other recovery mechanisms are sufficient for the attacker, then he could just try them before wasting 10 attempts at the password. And if they aren't, then they still aren't sufficient even if he can attempt them after the 10 tries. So what's the point? What did he gain here? Seems like nothing to me... – Mehrdad Oct 21 '16 at 14:56
3

Someone could hack your account and change your password but not your recovery info (perhaps because the service enforces a delay between changing the password and changing recovery info). Then you could use the recovery method to recover your account.

  • Do you know of any major email service providers that impose such a delay? – Mehrdad Oct 21 '16 at 5:28
  • Also, specifically, is Google one of them? – Mehrdad Oct 21 '16 at 15:00
  • @Mehrdad I've seen this behavior before but I don't remember where (could've been Google, could've been somewhere else). I don't know specifically about Google. – drewbenn Oct 21 '16 at 15:32
0

After reading you comments, I see one flaw: if you are logging into the e-mail with your password and using the OTP authenticator on the same phone, and that phone was compromised, then the advantage of the OTP authenticator is redundant.

But to answer your original question: it seems recovery options do not increase security unless you got hacked.

And if you were actually hacked and you want to plan for that, if the other answer about recovery questions being delayed after a password change is true (which seems plausible but you must test first) then I'd bet that a recovery phone number would be a better bet than a recovery e-mail. I'd bet this simply because the avenues for hijacking a phone number would be very different to the avenues for hijacking an e-mail, which basically just means more work, and more time, and security is mostly a question of time. Again, you'd want this phone number on a separate phone, but you'd have to check this number frequently to ensure it was still active, and hadn't been cancelled and reposted by your carrier - or even moved to an account on a different carrier - at a hacker's request.

So in conclusion - adding a mobile number introduces a new point of failure for you getting hacked, but, simultaneously, may reduce the damage done if you are hacked. Seems quite a double edged sword !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.