Despite Google boasting of hiring the best engineers. Their system give us mortals hope that our applications are not so bad after all.
Let me explain the pain I am going through to recover my hacked gmail account.
First, there is no way to talk to someone, their responses are canned, and to top it off, they send you to a link to submit a password request.<p>So far not a problem, but the email you get back after sending the password reset request contains a link to a page that allows you to cancel the request (not sure the genius who had this idea).
Now that the email is hacked, the hacker can read the emails and click to cancel the recovery process. And the vicious cycle continues.<p>What to do?
Try posting to Hacker News in the hope someone with some authority deigns to intervene. It helps if you a high-profile blogger or known industry luminary.<p>The prospects for the rest of us are fairly bleak.
If they are automatically clicking these links you may be able to spoof an E-mail that looks similar to the password reset request but have the cancel link actually log them out.<p>Going to this URL logs you out on Gmail:
<a href="https://accounts.google.com/Logout?service=mail&continue=https://mail.google.com/mail&hl=en" rel="nofollow">https://accounts.google.com/Logout?service=mail&continue=htt...</a><p>This might not work, but it's probably worth a try.
If your account is part of Google Apps for Education, or some other managed Google Apps account, you should contact your Google Apps admin. If it's just a normal Google account, I'm not sure there's much more that you can do.<p>Email is the most sought after account. All the password reset requests to your Bank, Twitter, Facebook, etc. are delivered to your email account. So when someone steals your email account, they've stolen all the others too. Go change those accounts to use your new email (if you can).
I agree that Google's help services are lacking. I never got my account back years ago. But this sounds fishy to me.<p>It's equally likely that you are trying to <i>hack</i> someone else's account as trying to recover your own. There's nothing wrong with the password reset process.<p>However, isn't there a process for when you suspect your account has been compromised? Have you even tried that? Are you even sure that your account has been compromised, or you just can't remember your password?<p>I like that us hackers are happy to help, and happy to commiserate with the failings of big corporations, but I think it's worthwhile to be a bit sceptical.<p>Edit: I'll add that the claim that the reset requests are going to the original account and being cancelled is fishy. We have verification in this thread that this in fact does <i>not</i> happen, and presumably the OP can't access the account to make a truthful counter claim.
> So far not a problem, but the email you get back after sending the password reset request contains a link to a page that allows you to cancel the request (not sure the genius who had this idea)<p>Did you set the recovery email the same as the main email? Cause I only get password reset to the recovery email.<p>If you used the same address for recovery email, then it defeats the whole purpose
Would be interested in knowing how they bypassed 2 factor authentication, assuming you had that enabled.<p>Unfortunately, it's a tough situation since for all Google or we know you could be the hacker trying to get into the account and hard for them to verify who you are, since if the hacker was able to steal person's phone to bypass 2 factor authentication, they may also have access to a copy of your drivers license or ID to send to google in an attempt to verify they are you.<p>While far from ideal, assuming you don't have a close friend to contact google for you via their google apps admin account, you could create a new trial google admin account and then contact google through that mentioning your situation of your other account. While they will still have to find a way to verify who you are at least you'll reach a real person.
Someone hacked and deleted my gmail account back in 2008. And I wasn't able to create another with same name. It was like my life that time coz I had all my personal backups as mails in that one. Since then I keep a copy in my harddrive as well even when I have cloud account.
Unfortunately (because their services are quite good) google has no support staff. This is well known, and you should take it into account when using the services they offer.<p>It is not difficult to do without them.<p>Asking for help on HN or Reddit works sometimes, but if your business (or personal life for that matter) relies on their services you should really work towards being able to do without them.
This actually happened to me a few years back and, eventually, they were very helpful.<p>The key for me was providing sufficient proof that the account really was mine and really had been hacked. I gave them as much information as I could remember/check:<p>* some contact names<p>* some tag names<p>* some recent thread subjects/recipients<p>* name of the person who first invited me to GMail back in the day<p>* details of any labs settings, theme etc<p>* mailing list subscriptions<p>I wish I could remember the email address I used to get in touch with them but, as I said, this was years ago now. I definitely found it somewhere publicly available, albeit buried somewhat.<p>HTH
Hm, I'd try timing the request so that it's the middle of the night wherever the thief lives. Try once assuming that he lives in America, once assuming Eastern Europe.
The right way for these companies to restore your account would be several of the contacts you've added long ago to verify that it is indeed you, in some way a machine can use, such as you signing in with your OLD credentials (which are kept around), filling out a form with their contact details (which were in the addressbook on the service and to which you have sent at least a few emails long ago) and them forwarding you the generated keys to your email by some method they choose to reach you -- only by collecting 4 or 5 of these keys could anyone unlock the account. Presumably you choose the people to whom you've reached out another way and explained how to tell you the code to activate your email.<p>This is like an alternative to two-factor communication. It can only be defeated by someone actually hacking your account and then convincing 3-4 of your close friends to send him the keys to your account when you start the dispute.<p>I'm a big fan of using information obtained easily and casually in the course of doing something productive (like often emailing someone) for good purposes.<p>PS: I have disclosed it publicly on this date so no patenting! :-)
Google provides some great services, but support is lacking.<p>I suggest, for the future: 1) use two factor authorization 2) use a separate email service because email is so important that you need the best support, etc. that you can get (I use Fastmail) 3) periodically download your Google data so if you ever need to set up a new Google account, you have some of your old context<p>I do still use GMail, but as a backup email.<p>I am going to start teaching free Internet security and privacy classes at my local library so I have been thinking a lot about these issues. Google, Facebook, Twitter, etc. provide really nice services, but it is important to consider privacy issues and have a plan for using these "free" services.
If they're going to have cancel password change requests they also have to have cancel change of alternative email requests. That's the first thing a hacker changes.<p>Additionally, you have to track every change with a timestamp so that you can invalid everything that came AFTER the change you just reset. That will prevent a hacker from being able to screw with the account because the original email address will also be able to cancel future changes, no matter how many times the perpetrator did it.
Google sends the recovery information related emails on the recovery email address. So they won't be going to the account that is not accessible to you (I prefer to say that instead of hacked). And the link to cancel the request is indeed a good idea, because if someone else submits a password reset request, then you must be able to cancel it because you did not initiate it. Otherwise, you will end up losing your account to the real initiator of the request.
Adding to discussion: once I tried changing a corworker's gmail password just for fun (he was right beside me and doubted that I could) by just providing few ordinary information I knew about him (e-mail lists we were both subscribed to, e-mail from our boss, other coworkers, etc).
Well, I was able to change his password to a completely new one. Very concerning, not sure if it still remains that easy.
A while back, I was chatting with someone on gTalk who I had pissed off in a forum. The next time I tried to sign in, my password has changed. I had to do the reset.. when I signed back in, no signs of foreign IP access was there.<p>My best guess: malware on the forum OR they exploited a vuln on Gmail.com similar to how hotmail.com & yahoo.com used to be very very vulnerable..
You can try here.
<a href="https://productforums.google.com/forum/#!forum/gmail" rel="nofollow">https://productforums.google.com/forum/#!forum/gmail</a>
I would see if you can upgrade your gmail to a paid account and then contact their support. Free accounts get very little attention but paid accounts will get you to a real person eventually.
I guess you just need to be faster than the person who hacked your account. Just before the cancel link is clicked you gotta make your move.<p>Yeah, and the cancel request was a total stroke of genius!
I'm assuming you've tried this: <a href="https://support.google.com/mail/answer/50270?hl=en&ref_topic=3406179" rel="nofollow">https://support.google.com/mail/answer/50270?hl=en&ref_topic...</a>.<p>On the other hand, it is a free service. If you'd have the business subscription, they do have a helpdesk you can contact by phone: <a href="https://www.google.com/work/apps/business/support/" rel="nofollow">https://www.google.com/work/apps/business/support/</a>
<a href="https://www.emniyetevdenevenakliyat.com" rel="nofollow">https://www.emniyetevdenevenakliyat.com</a>
<a href="https://www.kayserievdeneve-nakliyat.com" rel="nofollow">https://www.kayserievdeneve-nakliyat.com</a>
<a href="https://www.kayserievdenevenakliyeciler.net" rel="nofollow">https://www.kayserievdenevenakliyeciler.net</a>
<a href="https://www.kayseri-evdenevenakliyat.net" rel="nofollow">https://www.kayseri-evdenevenakliyat.net</a>
Eşyalarınızın büyük olması asansörlü taşınma için engel teşkil etmez.Binanız pimapen pencere olduğu müddetçe eşya büyüklüğü önemsiz kalır.Çünkü pimapen pencereleri tamamen söküyoruz.
Bir şehirden öteki bir şehre nakliyat işleriniz olduğunda size nakliyat için bir zaman veririz ve bu süre içinde nakliyat işleriniz tamamlanmış olur. şehirler arası taşımacılıkta kayseri evden eve Nakliyat kalitesini yaşamak için çok sayıda seçeneğiniz var. Taşınacak eşyanın cinsi büyüklüğü ne olursa olsun Türkiye’nin bütün illerine hizmet vermekteyiz…
Eşya taşıttırmak isteyen müşterilerimize sunduğumuz hizmetler arasında asansörlü eşya taşımacılığı yanı sıra anahtar teslim evden eve taşımada sunuyoruz.
Firmamız kayseri melikgazi de ofisimiz kayseri ve tum turkiye evden eve nakliyat bizim işimiz Asansörlü kayseri evden eve nakliyat hizmeti şimdilerde moda olup en iyi ve kaliteli taşınma için mükemmel çözüm.Kayseri evden eve nakliyat firma elemanları olarak hizmet veren arkadaşlarımız asansör ile yapılan işlerin daha kaliteli ve güvenilir olduğunu bizimle paylaştıktan sonra artık işlerimi bu kalitede olacaktır.
<a href="https://www.nevsehirevdenevenakliye.com" rel="nofollow">https://www.nevsehirevdenevenakliye.com</a>
<a href="https://www.aksarayevdenevenakliyat.biz" rel="nofollow">https://www.aksarayevdenevenakliyat.biz</a>
<a href="https://www.evdenevenakliyatc.net" rel="nofollow">https://www.evdenevenakliyatc.net</a>
<a href="https://www.kayserievdenevenakliyat.biz" rel="nofollow">https://www.kayserievdenevenakliyat.biz</a>
<a href="https://www.hizmetevdeneve.com" rel="nofollow">https://www.hizmetevdeneve.com</a>
<a href="https://www.kayserievdenevenakliye.net" rel="nofollow">https://www.kayserievdenevenakliye.net</a>
<a href="http://nigdeevdeneve-nakliyat.com/" rel="nofollow">http://nigdeevdeneve-nakliyat.com/</a>
<a href="https://www.sivasevdenevenakliyat.biz" rel="nofollow">https://www.sivasevdenevenakliyat.biz</a>
<a href="https://www.yozgatevdeneve-nakliyat.com" rel="nofollow">https://www.yozgatevdeneve-nakliyat.com</a>
<a href="http://www.evdenevenakliyatciler.net/" rel="nofollow">http://www.evdenevenakliyatciler.net/</a>
if you get your account back i would look at setting up 2-Step Verification <a href="https://support.google.com/accounts/answer/180744?hl=en" rel="nofollow">https://support.google.com/accounts/answer/180744?hl=en</a>
> <i>What to do?</i><p>The first step would be to edit the title of your submission to begin with "Ask HN: hacked Google account, what to do?", since you're asking a question.<p>"Google hacked account" means, to an English speaker, that Google perpetrated hacking against some account somewhere (subject-verb-object, right?) E.g. Google people gained access to your bank account. I.e. your current submission title is clickbait.