Gmail's backup codes are useless to access account

Heh, same for me. (albeit only three factors, but more weren't configured)

It was firstname.lastname@gmail.com that I lost, as I was mostly using my original account with a pseudonym for anything private (was a teen when Gmail started, so didn't think twice about using a cringe username back then).

I had configured the first/last name Mail to forward everything to the pseudonym email and didn't access it again for something like a year... Then I had to respond to someone and... Well, Google never let me access it again.

I eventually gave up on it entirely and switched to a custom novelty domain on fastmail, much much later. (A portmanteau of my last/first name

1) This also happens to non-workspace (regular) gmail accounts

2) I didn't change the policy on the workspace email when I signed up for it

The point is still - why ask me to authenticate via different methods and then reject them after I've correctly authenticated? If some policy is overriding these, then you shouldn't have asked me to authenticate via those methods in the first place.

I would start looking at the networks you are using. You may be unknowingly sharing your public IP or IP block with compromised machines that are part of botnets, which makes Google (rightfully) very suspicious of logins coming from there. I would also definitely get several hardware FIDO2 security keys as Google will likely trust those more than other forms of authentication.

Yes, a lot of places don't let you remove the phone number. But Google does.

The safest option is a hardware security key because it is not vulnerable to phishing. And I expect Google to trust it above all other forms of authentication because of that. So anyone who is worried about losing access to their account should immediately buy multiple hardware security keys. You don't have to buy them from Google.

So we are at a point where just a strong password stored in memory is actually the safest option (given brute force protection)?

The safest option is straight out of 1994: Sticky notes.

Security keys can get lost or stolen. If someone breaks into your house or office, they're going after something other than a sticky note in your desk.

last time I checked (two years ago), Google Authenticator made it horribly complicated to export TOTPs managed by it. It took me an evening and many unsuccessful attempts to get my 10 or so Google Authenticator-managed TOTPs in a format that I was able to import into other open source solutions (eg Authy Authenticator Android app, KeePassX Linux application).

I don't care if things have changed, it was a shit experience. I highly suggest to stay away from the Google Authenticator lock-in danger.

Google Authenticator, like the Microsoft Authenticator, goes beyond mere TOTP and if you use that (or it's required by Google) then you need an app that can receive a push notification as part of the 2FA. This is the part that would screw up a lot of the consulting work I'm doing with client Google accounts because it would mean getting a separate installed instance of Google Authenticator for each account.

Of course, it can hold as many secrets as you want. It syncs them to only one Google account though, but that's irrelevant.

Indeed. I have a university alumni account that I haven't been able to use for some years because it is managed by Google, and they in their wisdom figured somethings was suspicious (maybe leaving the country or not logging in multiple times a day or cleaning cookies or something else that good patriots don't do).

They're asking for a phone number (so, good to know - if a hacker actually got my username and password, they could access everything Google has on me if they have a fresh phone number, I feel super protected), which I am reluctant to provide, but it still doesn't work.

As you highlight, no support.

On Gmail: https://myaccount.google.com/security -> "How you sign in to Google" -> "2-Step Verification Phone" -> trash can.

In general, no. I've wondered if legislation would be feasible though, especially given the flaws that have already been shown.

To be a person is to have a phone number capable of receiving SMS, at least according to approximately every US company.

Yeah Outlook is harsh. I was comparing it to a dedicated mail reader like Thunderbird.

Me too. I forward Outlook to Gmail.

Outlook is unusable but harmlessly so. What's worse is Microsoft 365. I simply can't find a way to configure 2FA in any kind of sensible way. Right now it's simply turned off, which makes me very nervous. Whatever I do, it is somehow overridden in other parts of their byzantine and always changing cat herd of admin sites. I'm waiting impatiently for our M365 subscription to expire so we can finally migrate off this nightmare.