Here is the issue. When I go to my google account on my computer. I go to setup 2FA. Now for some reason, I'm already logged into my account on my computer. Now it's asking me to login onto my phone. I should be able to get a 2FA code from my computer to put into my google authenticator. I would have to log out of my computer account. What's the point of having to login into my google account from my computer. If it asks me to login into my phone. I'm confused.
I want to get my code to protect my google account. And then on my smart phone that I don't have it connected to the internet. I want to add that code to the authenticator so I can use 2FA to protect my account. Am I doing something wrong here? Or is google making this extra complicated? The google authenticator says to Scan a QR code or Enter a setup key. I know it seems I should be posting this issue some where else, but I'm not getting a support there. And I know you guys use phones a lot and have experience with phones. Do you have this issue with google authenticator? Because the google authenticator app itself doesn't say anything about signing in. In the first place. It just says Setup your first account. And if I'm logged into my computer on google. Why have that option if they don't want you to do it from there in the first place. And there google authenticator says nothing about logging in.
And I'm sorry for posting this here if it's a bad place to post. I have been searching for a while to fix this issue. I even posted on the google community. Reddit is also not working correctly were they don't let me post in the right community. They tell me to post else where. Where it's all a mess and not under the right topic. So I have been not getting and finding an answer to what is going on here.
When I researched the issue I found something about back up codes.
I get to this part
At the top, tap Security.
Under "Signing in to Google," tap 2-Step Verification. You may need to sign in.
Under "Backup codes," tap Continue .
There is no backup codes options. I even go to more option, and there is no back up codes option. I'm assuming I'm going to get a backup code on my desktop computer to enter into my google authenticator. But I'm not finding it? What is going on here? Is there a way to get that code?
Related
I privately host a site for my family that uses the Google Spreadsheets API (readonly). I received an email from google looking to "Remove risky access to your data". My site is listed with a warning:
I've gone through the verification process (filling out this form: https://support.google.com/code/contact/oauth_app_verification) but got the response that if the site is used privately "you don't need to go through the verification process". They state this in their FAQ also: OAuth Developer Verification Form FAQ.
However, the site still shows a warning in Google's security check-up. I can ignore this but I think other family members will be worried unnecessarily OR ignore future warnings about other apps assuming it's the family one they normally ignore.
Is there a way to verify myself as a developer of a private site or mark the access as trusted so the warning doesn't recur?
I ended up making my site public and going through the usual verification process.
Not really an answer, but rather to flag that this is an issue my dilemma as well. Although I run time-based Google Script within an organization. I've contacted folks at the Google Cloud Platform and they have opened a case. However, here is something interesting I've stumbled across just now. Go to your Google account and do Security Checkup
After the checkup your screen might be showing something like this
Try clicking "Dismiss" to prevent Google from removing your app.
I'm just testing it myself and if in an hour (that's how long it usually takes Google to remove your own script from the list of self-authorized apps with access to account info) Google won't remove it, I guess it would work for me!
I got an problem after i create and APIs on Google Developer Console and enable the GCM service,
but i want to add an server key at Credential next to APIs on left hand menu.
But it show me You do not have sufficient permissions to view this page.
Below are the image:
Is that any config i need to add?
I did follow what You do not have sufficient permissions to view this page to clear cache and use incognito mode to login, but still not work.
EDIT
Some time i relogin it work back, when i click to another side and click back it show the error again, and my solution is go to Credential than use top right corner account to logout and relogin , let it redirect you back to Credential, than it work. So is there any solution to fixed it permanently without relogin?
Thanks
It because of you have logged in multiple devices. so u have to log out from all devices. to do this go to gmail.com and log in using your email and password. and scroll down . you can see Details link . Click that link.
it will open new window. there u click
Sign out all other web sessions. than clear history. than do login and try . it will open without showing error.
I got the same problem. After following the below steps it got solved. This may help you as well.
Click on Apis under Api & auth
Click on "Google Play Game Services".
Enable the service.
Optional: enable "Google Play Developer API" as well. Most of the time it will enable by default.
I am facing the same issues.
Try using another browser like firefox - sometimes it works.
but after awhile, same error pops up.
Having the same issue as with you regardless what api i enable.. have tried all the suggestion posted earlier. but none of them worked, but when i tried to change my i.p.. using a vpn. and tried to access it.it worked, i can create or view my api now,tested it with other gmail account to confirm and started from scratch. to my surprise i didnt encounter that issue im having for hours.. no idea why my i.p is being rejected when accessing the credentials area..
I've resolve my issue, it's about the ISP you are using. I tried 3 ISP's and 1 of them got a success all the time, I don't have any permission error.
I have spent the last couple of nights bashing my head against the wall amongst a see of conflicting out of date documentation and semi-helpful blog posts that were/are appropriate to what I am trying to do.
Essentially I want to write a wee personal app do download my images from PicasaWeb/Google+ and store them on my local hard disk.
I have managed to do the following:
Figured out the GData API for the appropriate request to get private album data (works fine in my 'google-logged-in' chrome browser)
Got the correct private data back from my GData URL with the token generated by the OAuth playground.
Managed to get an OAuth2 token back from https://www.googleapis.com/oauth2/v3/token using JWT.
However - when I try my access token I generate myself I get back a forbidden response with the message 'Not authorized to view access private'.
I am pretty stumped - my only guess is that my service account configured in google developers console doesn't actually have access to my personal google stuff like google+ photos. When I look in there I can see the OAuth playground has access. How do I give my app access - and do I need to in this scenario?
Thanks in advance,
Robert
"my only guess is that my service account configured in google developers console doesn't actually have access to my personal google stuff".
Totally correct.
I guess I see 2-3 questions per month on SO where people have made the false assumption that a Service Account is some kind of proxy to their Google Account. It isn't. It's a completely new and independent account.
The two approaches you can take are:-
Share the items to the Service Account so it has permission to access them.
Give your app direct access to your Picassa account. See How do I authorise an app (web or installed) without user intervention? (canonical ?) for the steps involved.
I've recently been doing a bit of web development so I've been thinking more about authentication and stuff. On Netflix I noticed there is an extra option on the Account page to de-authorize other devices. My girlfriend changed her password but I was still able to use it without re-entering the password till she logged out other devices.
So my question is how does authentication for Netflix work if it doesn't have to locally store your password?
Netflix uses a version of Open autentication to allow a device to access an account. Once the device has been authorized it will then have access to that account until its has been deautorized.
Chaning password doesnt matter becouse the device has autorization already probably in the form of a refresh token stored someplace. So its not storing a password its storing an autorization token of some kind.
Lets use facebook as an example: (response to comment below)
https://www.facebook.com/settings?tab=applications
This shows a list of all the crap I have loged in to using my facebook account. Now I have probably changed my facebook password sevral times it wont matter I will still have access. Some of these are mobil apps i have installed on my cellphone at one time or another. Even if i dont use them they still have access.
This doesn't technically answer the question, but is related and, I think, helpful:
You can forcefully invalidate the previously-validated tokens for other devices by going to https://www.netflix.com/ManageDevices - as soon as you go to the page it will ask if you want to sign out other devices.
(from "Someone is using my Netflix account without my permission" at https://help.netflix.com/en/node/18)
GMail can used as a SMTP server. I've written the code that does it. But as we all know GMail may occasionally authenticate using captcha (image verification as they call it). The same thing may be the cause to reject SMTP authentication.
As I've seen google shows image verification when you try to log-in for the first time from some machine. All consecutive log-ins from the same machine (to the same account) use regular login. I'm a bit afraid this captcha may also come up again for some other reasons that I can't control.
So. Is it possible to still authenticate when special measures are needed? And how?
I should also mention that logging in from the machine via web browser also enables programmatic SMTP authentication.
Try:
http://www.google.com/accounts/DisplayUnlockCaptcha
Or for Google Apps for your domain:
https://www.google.com/a/yourdomain.com/UnlockCaptcha
I can bet it's an IP based solution, so if your app if deployed somewhere else, It doesn't help.
Google doesn't seem to be particularly clear about what prompts them to block a user's account until he has successfully entered a captcha phrase. However, it's likely that this is a mechanism which is triggered when Google sees what it considers to be unusual or suspicious activity associated with your account. As a result, I would expect it to be unlikely that they will supply an option to opt out of a mechanism which is protecting both them and you, although others are welcome to find evidence to the contrary.
Various discussions of when and how this happens throw up some suggestions which you might like to try to see if they help, such as choosing a stronger password or simply changing your password. Good luck!
IMHO The right way to do this, without implementing the user consent workflow or "hacking your account's security settings", is obtaining a refresh token with the Google OAuth2.0 Playground for Offline Access. After that, you can authenticate using the OAuth 2.0 API.
I got it working after reading Nodemailer/Gmail - What exactly is a refresh token and how do I get one?