3

Today I realized that by just knowing the phone PIN it is possible to reset the Google account password... doesn't matter what 2FA/Backup codes you configured.

For example, you can go under the account's security settings, click to change the password, speicify that you forgot the password. Then you can specify access via Screen unlock, where you can use the PIN to reset the google password.

Question:

Is it possible to remove the "access via screen unlock" from that setting?

Resetting the google account password should, IMHO, always require:

  • either the password itself
  • or a backup code

Is it possible to achieve this? If I forgot my password I want to be kept out until I manage to retrieve one of my backup codes.

Is the only """solution""" to ditch PINs and use strong password for screen unlock?

Why would a credential for a physical device be enough to reset the credential of the google account itself? I don't want these to be linked. This sounds like a huge security issue to me. I always assumed that there would NOT be an option to use the screen unlock via PIN/fingerprint to reset the google password.

Maybe I could understand if someone does not have backup codes, but if I have backup codes available, IMHO, they should be the only backup method to reset the password. So is it possible?

3
  • I think there's nothing you could do except for adding a 2FA. OR you can create emails on a separate device/incognito and then login on your phone. Because the device on which the accounts are created are considered the owners and it's always possible to reset from it (except if u try want to edit some source codes, took a look at your stackoverflow, it's great :) OR you can reset your device, I think that creates a new login session but google stores the device id so I'm not exactly sure if they let you reset still. Also if someone has your pswd there's many things he could do apart from that
    – 44yu5h
    Mar 1, 2023 at 17:17
  • @Aayush adding 2FA does NOT prevent this exploit. When you are asked for 2FA there is an option for "tapping yes on your phone" which an attacker having your phone and knowing your PIN can access. Therefore knowing the PIN means you can bypass any sort of 2FA even if it is set to something that is not that device. Right now the only mitigation seems to use a strong & long password for screen unlock as to reduce the risk of shoulder surfing... except everyone has a camera in their hands, and a short recording of typing a password can be easily achieved no matter the strength of the password
    – Bakuriu
    Mar 1, 2023 at 17:50
  • I'm specifically thinking at the scenario (which is happening in real life right now) where people are out drinking in a pub or something, during the evening they will unlock their phones multiple times, sometimes the OS will ask for the PIN/PAssword instead of fingerprint/FaceID, you leave the phone on the table 1 minute while talking/going to the bathroom and someone snatches it... in a matter of 60 seconds you can be 100% logged out of everything and they may access all credentials stored in Google's password manager, which probably means access to bank accounts.
    – Bakuriu
    Mar 1, 2023 at 17:54

0

You must log in to answer this question.

Browse other questions tagged .