2

I have a question about Google account recovery phone. The succinct question is, is it best to have the Google recovery phone set to my single Android device or to use another mobile (non-Google) phone?

I have a single Android 13 phone, which has my primary phone number and my primary email account (Google) on it. I have a recovery email set to another non-Google email account not immediately accessible on the phone. I am wondering if I should use another phone number as the Google recovery phone.

If I lose my phone with the phone locked, then I am not concerned much because the SIM is locked, the phone PIN is long, messages don't show contents on the notification screen, and I think I'll have time to recover.

If I get robbed and am forced to hand over the device PIN, then they can use my phone to totally change stuff on my Google account, as it is my recovery phone, and Google prompt is the default 2FA for Google account.

On the other hand, Google says that the recovery phone should:

  1. be able to receive SMS,
  2. I should use it regularly, and
  3. I should have it with me all the time.

If I use an extra recovery phone, 1 & 2 are possible, 2 at least on a daily basis, but 3 sounds tough.

What do you do? What is the best practice in regard to Google recovery phone number?

Thanks.

1 Answer 1

0

Since nobody has taken a crack, I thought I might, in hope that it will benefit people who ask a similar/related kind of question, or it would further stimulate discussions.

The short answer is yes, you will have the best chance of recovering your Google account from a hacker/phone robber if you have a recovery email and a recovery phone number that is not associated (not on, cannot be access, etc.) with your stolen Android device.

The answer above is based on parts of Google recovery workflow, information that Google has published (https://support.google.com/accounts/answer/7299973?hl=en), and speculations. Why speculations? Because it appears that the recovery workflow is fairly complex and is not fully documented, and I haven't tested all the possible paths in the workflow.

Observations on Google recovery work flow / securing the device remotely:

  1. "Secure device" in the find Android webpage does lock the device by PIN immediately when the device responds. You can do this silently by not giving the webpage a text or a phone number, and silencing the "Find device" notification of Google play beforehand. Or you can make the lock obvious by giving it a text and a phone number (which will allow the person with the phone to call you at the number with the phone).

  2. "Secure device" doesn't remove the default 2FA Google prompt authentication immediately (I didn't test how long it took), and more importantly it didn't remove the forced Google account passkey on the device immediately: it took approximate 5 minutes once the device locks.

  3. If the person still can respond to the Google prompt and the recovery phone is the device itself, the person will be able to take over your Google account, but you need both factors for this.

  4. If the person has your PIN, they also have your Google passkey, and they will be able to take over your Google account without other factors beyond having your phone.

  5. So, even if you have "secured" your device, there is a windows (in my case, 5 minutes) that the person will be able to screen-shot, change your account information enough (change password, remove/add passkeys, remove/change TOTP authenticator) that a) you will be seriously hampered trying to recover your account b) [speculation] they might be able to recover the account with the recovery phone and the information associated with your account that they have downloaded or changed, even after you have "recovered" your account.

  6. On all the recovery workflow I tried, Google always asked for 2 various pieces of information, never one. The information I got asked were code sent to the recovery phone, code sent to Google email, code sent to the recovery email, TOTP authenticator code, and 2FA recovery code.

  7. The surest pieces of information that the person cannot change associated with your Google accounts are a) recovery phone b) recovery email and c) your previous passwords. Recovery phone and email are shown on the account and can be changed, but Google "promises" that even after changes, the old ones will be usable for a week. Previous passwords are not shown.

  8. Google advises that to be able to recover your account, you should have your recovery phone, recovery email, and 2FA backup codes, although the UI doesn't enforce that your phone number mustn't be the same as your primary/single Google phone. Does it allow the same Google email and the recovery email? I don't know since I didn't test, and mine has always been different.

  9. Your 2FA backup recovery codes can be regenerated. It's unclear if the old ones would still work. It doesn't make sense that they do, but who knows.

  10. Remember that if they have your PIN and your phone, they virtually have biometrics to prove to the different apps on your phone. Unless you uses PIN/password based authentication to lock your TOTP authenticator, they might have your TOTP codes/secrets as well.

So, you should have a recovery phone number and a recovery email that cannot be accessed on your Google Android device. If you only use those for recovery and such, and their accesses are not stolen along with your phone and PIN, then you will always have 2 factors to definitely prove to Google it's you.

If someone steals your phone with PIN, you want to wipe it remotely, disabling/recovering the primary phone number as needed, and check/reset the security of your account (password, 2FA, passkeys, email settings, app access, etc.) Heck, you may want to do this even before reporting to the authority.

As far as Google recommendations that:

  1. the phone should be used regularly
  2. the phone should be with you
  3. the phone should exclusively belong to you

You want a regular use to make sure that it still works. The phone should be with your because you only have a week to recover your account with the phone if the hacker changes your recovery number. The phone should exclusively belong to you because of security and because Google most likely sends account update notifications to it, so it would be annoying for someone else.

Having your passkeys protected by the two factors (having the phone and knowing the PIN) seems bad to me. I wouldn't leave Google passkey on my phone if I have the choice. This problem will be the same for other passkeys you let Android platform protect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .