Ask HN: Is Google security really this stupid?

This was very surprising to me - its not my main account, which has 2-factor security for a long time, but a 6 character, alternative email, from 2006. Those you created to sign up on dubious websites. I'm from Brazil and mostly use english. I never went to Vietnam.

I just woke up with a bunch of emails from Google saying that (I only received because that account still had forwarding to my main address):

- New chrome sign in from Vietnam

- Your password changed

- Your security question was deleted

- Your recovery email address changed

- "Lansiran keamanan untuk akun Google yang tertaut" (suspicious activity)

So, probably this guy got my password from an unsafe website (I'm not even sure about the password as I only used as a forwarding email to my main email).

What really surprised me is that:

- all recovery is based on things the attacker already changed

- Google, a company that makes self driving cars, seems to use zero AI to detect fraudulent behavior? They don't even seem to consider the variable "time" to recover the account? Come on guys, I'd have to use my security email from before the time I was hacked, not the current one! Don't you have a list of my last security emails?

- Google has my every location since I had an Android phone (almost 10 years?), Google knows where I live and work. Google parses emails from airlines for a few years now - I really expect they to use this information if my main account ever is hacked, eg, "this guy didn't buy a ticket and is logging from Vietnam now?"

- You can't prove that an account is yours by alternative methods such as:

a) I have thousands of emails from the hacked account in my main account. Just ask me to list one of those.

b) My main account is/was a forwarding address for the hacked account !!1!

- Also you can't really fill a simple form, to say that the account was hacked. The account recovery just ends in "Could not verify this was your email".

Of course, I don't care about that Google account - I only worry that its an entry point for hacking another services that are important. I'm a little scared that now he is the only person (other than Google) that knows that "fake account" and my main account are the same person.

Anyway, very frustrating. If this was on my main email, and it was a money grabbing scam, I'd probably be tempted to pay it, because otherwise I would be utterly f*ed.