I made my Google account so secure I could lock myself out

Oh, memories!

I've had my Google / Gmail account for over 20 years now. I can't even find the original date of when I've had my account now. I remember way back, Gmail used to be invite only! And if I recall correctly, I bought a Gmail invite on eBay for something like twenty dollars. A gigabyte of storage sounded insane back then. And all of this for "free" (something something if a product is free you are the product blah blah).

I remember having a fairly secure password for all those years. And also being sure to keep the password unique to Gmail and to not use it across websites. Then two factor authentication came along around 2010. Cell phones became ubiquitous by then so it was an easy way to add an extra layer of security. Then not too long after that, authentication codes from an app added yet another layer of security. Then you have a set of "backup codes" that Google tells you to print and keep somewhere. It seemed like getting into a Google account would be like something out of Mission Impossible.

You're on your own

I also recently switched cell phone providers, though I'll admit that this particular company's customer service is truly lacking, in exchange for a fancy app to manage your plan, a very self guided onboarding experience, and a bargain basement subscription price for what is essentially the same quality of cell service as the big names. It's very much like the Gmail customer service experience. You're not going to get a lot of hand holding when things go wrong.

Password managers

I've also been using an open source password manager called Keepass. The idea is that you have a "local" file that holds all of your account usernames and passwords. For safekeeping, the file can be synced to Google Drive. Open source apps for Android and MacOS exist to open this file. In the end, you only have one password to remember. Your "master" password that opens the door to your entire password vault. Most apps allow accessing the vault with biometrics for ease of use.

Because this file isn't part of any cloud service (like Lastpass, 1password, Bitwarden, etc), you're not beholden to any subscription fees, and you're reducing a lot of risk in case these cloud providers are compromised in any way. With Keepass, it's just your password database file and your master password. The syncing to Google Drive is the only "cloud" component here. And like we said before, your Google account is secured up and down in more ways than one. At this point, aside from my "master" password, I have no other passwords remembered by heart, not even the one to access Google/Gmail.

A real problem

Which finally brings us to a dreadful thought that I recently had. What in the world was I going to do if I lost my phone? I had spent all this time making things secure, just to realize I had created a sort of circular dependency that was difficult to break.

My phone acts as the main entry point for two factor authentication. Not only for Google/Gmail itself, but also for my phone number! How do you regain access to a phone number if your phone is lost? I simply could not walk into a physical store to reclaim my phone number.

All my authentication codes are also on my phone. Any website, including cell phone providers that require 2fa, is going to ask for a code.

So if the phone is lost and not recovered, we're blocked in so many ways because of the layers of security we've applied which we thought were in our best interests:

1. We don't know our own Google password. We created a very long, random password and saved it to our password vault.

2. Our password vault lives in Google Drive. Which belongs to the Google account. The account to which we don't know the password.

3. Even if we knew the password, we don't have a phone to receive codes. Codes can arrive via text message. Or it can be retrieved in the Authenticator app. The phone is gone.

4. Backup codes are nowhere to be found. I don't keep those printed out and in my wallet or anything like that.

5. The same problems go for my cell phone account. I don't know the password. Two factor authentication is enabled there too (to prevent sim jacking among other things), so codes via text and Authenticator app cannot be retrieved.

The level of security that we've imposed on ourselves is now blocking us from gaining access to our own accounts. Losing a phone means losing access to the phone number, Authenticator codes, and our password vault.

The solution

It seems clear here that regaining access to the password vault would be critical here. Here are the additional steps I took:

1. Copy the password vault database to other safe, secure locations. We now have our .kdbx files sitting on our laptop at home, as well as a thumb drive. In an emergency, we'd retrieve this file and gain access to it with the master password that we do know by heart. Don't forget to test your backups and make sure they can be opened.

2. Copy Google's master codes to an entry in the password vault. If we regain access to a local copy of the password vault, this means that a combination of the password + backup code will get us back into the Google account.

3. Keep Authenticator codes from your cell phone provider in the password vault as well. That way you are able to access the account and could potentially download an esim to another phone in a timely manner.

Overall, I have more peace of mind with this setup now. There's more redundancy and it prevents my phone from being an end all / be all when it comes to accessing my Google and Phone accounts. Still, I'll be continuing to hold onto my phone for dear life at all times.