How to create a backdoor for your Google account so you will never* get locked out again 🔑💻

Locked out again...

Today a friend sent me an article from HackerNews title Librarian's Letter to Google Security. As someone who teaches Digital Literacy, this breaks my heart and it's a story I know well. I'll paste some quotes here:

The way Google’s two-factor authentication system is designed, sets up poor and elderly people to be locked out of their accounts again and again, and without access to their email, they lose their welfare benefits, their housing, and struggle to find work.

This elderly woman, looked to be in her 70s, might lose the roof over her head, due to being unable to log into her Google account, because she lost her old phone and with it, her phone number.

... no support line to turn to. It is a daily occurrence, ...

And you can imagine there is much more. Here is the link to the actual letter, which is hosted on Google Docs.

The light at the end of the tunnel...

The good news is there is a way. A little while back I created a way to essentially make my own Google account backdoor, a backdoor known only to me. Conceptually this is somewhat similar to a port-knocking script. Do this now, before you get locked out of your account. If you're already locked out, this can't help you. Also, the idea is to set this up on the account you want to regain access to, but you can also create a secondary email just for this purpose. It's your call.

👍 It may be helpful to understand some requisite concepts in order to set this up. The first is Google Backup Codes. Another is Gmail Templates, and the last one is Gmail Filtering.

Get to the point, dude.

For you more advanced readers, this is the tl;dr version of the steps:

1. Generate a list of one-time-use backup codes in Google Account Settings.
2. Copy the list of backup codes into a Gmail Template.
3. Set up a filter in Gmail that looks for a very specific string in an incoming email. Configure the filter to autoreply to the incoming email with the gmail template.
4. If you are ever locked out of your account, email yourself from a throwaway with the very specific string you have chosen. Your robot-email will autoreply with the list of access codes. Voila, you have regained access to your account.

The full version of the recipe:

Step 1: Generate Backup Codes

Go to your Google Account. Go to Security Settings and click 2FA. You should see an option for Backup Codes there that looks like this:
Click on it and create some backup codes.
I have edited out my backup codes here, but there are ten eight-digit numbers. You may have to enable some other form of 2FA (adding a phone number) as well to be able to generate backup codes.

Step 2: Paste into a Template

Now, enable Gmail Templates.

• Open Gmail.
• At the top right, click Settings > See all settings.
• At the top, click Advanced.
• In the Templates section, select Enable.
• At the bottom, click Save Changes.

Create an email, then paste in your access codes into the email body. Do not put any recipients into the To: field. You can put whatever subject line you like.

Click the Three Dots > Templates > Save Draft As Template > Save as New Template and you will be prompted to enter a new Template name.

Step 3: Set up a Filter with an auto-reply

In Gmail, click this at the top:
and a search filter panel will appear. Type in something very specific, known only to you, that would never realistically appear as a subject line to a normal email. In this example I have chosen

One giant leap for mankind.

But you can use whatever you want. The longer the better. I recommend something that you can easily remember; a movie quote works well.

Once you've typed your phrase into the Subject: line, click Create Filter and a new panel will pop up with some check boxes:

Check the one where it says Send Template with a drop-down box. Choose the new template you just made and click Create Filter

Now, you can test it. Use a junk email address and send an email to your Gmail email address with the very specific string as the subject line you chose. I used my work email address to test mine, and it auto-replied right away.

⚠WARNING⚠:

There is one caveat to all this: Be careful you don't use all the storage capacity of your Google account. Google has an automated policy where if you use up all your storage space, email comes to a grinding halt. So beware of that.

But that's it. Good luck out there, internet friends!