Google removed my Yubikeys from a Google account 'just to be safe'
google has some of the most inane 'security' measures. one thing it completely doesn't understand is VPNs (despite offering a vpn service itself), failing your login every time you try to enter from a different "location". (despite the device/browser matching, or whatever else there might be.) and "verification option" that is offered is a phone number code, which is offered anyway, even when there's no phone number saved on the account. how is that supposed to work and 'verify' anything (what, can someone having credentials just enter any random phone number to 'verify' and get in?), is unbeknownst to me. it also uses 'additional email address' as a 'verification method' (you could send a code there, or just enter that address), but then again, i don't see how really 'protective' that is, particularly when somebody could just enter anything there. truly, what is the point in that charade, over a regular password. the other thing is how it will not let you add 2fa without setting a phone prompt or phone number first. that is just idiotic. it will refuse to give you this way of security (while it may not be all that great, at least it's definitely something), and pester you for extra emails and numbers. the way that google will seemingly refuse to trust passwords for what they are is just wild and annoying to me.<p>and it seems like it has 'ramped up' its paranoia recently, cause just in the last week, I got forced to change a password on one account over 'suspicious login' (me logging in through the same browser over vpn, and this is while the account has 2fa on), and got a "critical security alert" over a log in from a new browser. "Suspicious attempt to sign in with your password". Yeah, that's just me, google.