Security News Google’s New “selfie video” Identity Verification Feature to Gain Access to Locked Accounts

[Brownie2019]

Content source

https://cybersecuritynews.com/google-adds-selfie-video-feature/

Google has introduced a new identity verification feature called “selfie video” designed to help users regain access to locked accounts, marking a significant step in account recovery and authentication security.

The feature aims to provide an additional sign-in method, especially useful when users lose access to their primary authentication devices.

Announced by John Gronberg, Director of Product Management, and Claire Forszt, Product Manager for Google Identity and Engagement, the feature strengthens account recovery workflows while maintaining a strong focus on privacy and user control.

Google accounts often contain highly sensitive data, including emails, documents, and personal media. Losing access to such accounts can lead to operational disruptions and potential security risks.

The newly introduced selfie video feature offers an alternative recovery path when traditional methods such as two-factor authentication (2FA), recovery emails, or trusted devices are unavailable.

Full Story:

https://cybersecuritynews.com/google-adds-selfie-video-feature/

 

[Bot]

Full Story:

https://cybersecuritynews.com/google-adds-selfie-video-feature/

Important limitations

The article describes a Google account-recovery feature, but its availability and exact requirements may depend on account type, region, rollout status, and Google’s risk assessment. I cannot independently verify from the information provided that it is available to all Google users, so the article should not be treated as confirmation of universal availability.

A selfie-video check can provide an additional recovery signal, but it also introduces privacy and identity-theft considerations:

• Use the feature only when it appears inside an official Google sign-in or account-recovery page, such as Sign in - Google Accounts. Do not follow recovery links received through unsolicited emails, messages, or advertisements.
• Google should explain how the recording is processed, retained, and deleted before submission. Review that information carefully.
• Do not send a selfie video directly to anyone claiming to be Google support. Google generally does not require users to provide account-recovery media through unofficial contacts.
• Keep recovery email addresses, phone numbers, passkeys, and trusted devices current. A selfie-video option should be considered a fallback, not a replacement for strong authentication.
• If the feature is unavailable, use Google’s official recovery page at Sign in - Google Accounts rather than third-party “account recovery” services.

Account recovery checks are not guaranteed to restore access, and a video selfie should not be assumed to be a completely secure substitute for 2FA or passkeys. The safest approach is to verify the feature through Google’s official documentation and use it only from an authenticated Google domain.

 

[Wrecker4923]

The video is used strictly for authentication purposes unless users opt in for additional uses.

And of course, if governments subpoena the info, or if the agents within the company retrieve it. If the company decides it's a non-content material, then the subpoena probably wouldn't even have judicial oversight.

Google has a lot of options you can set up for authentication, but they sometimes let them be used in unpredictable ways, so there’s no real way to know what you’ll be able to use when you need to authenticate. For example, I recently reset my computer and added a new passkey from the reset computer. When I tried to log in with the passkey, they prompted for 2FA (which usually doesn’t happen) via a Google prompt, with all my other set options unavailable. If I’d failed to authenticate (for a bunch of reasons, including delayed notifications for the Google prompt), they could conceivably have decided to lock me out of my account.

It’s probably better to mitigate by making sure that if you get locked out of accounts with monolithic corporations, the event isn’t catastrophic.

 

[Zero Knowledge]

You know it's been so long since I entered passwords thanks to KeePass & Bitwarden I've forgotten them and I could remember a random 64multicharacter password.