This may be the most inflammatory title I've written for a blog post, but it's true in its own self-inflicted way. I want to delete my Google accounts and remove my information from their hands. Unfortunately, I once used passkeys for both of my accounts that I no longer have access to. These were stored in Bitwarden, which I deleted then re-made in Proton Pass. Recently, I've migrated away from Proton in favor of Bitwarden and Startmail. In short, I lost the passkeys.
And yet, for some reason, the way Google has designed the recovery process does not remove the passkey from the account. I've done the recovery process with my password and the passkey is still associated with the account, but it still asks me for the passkey to change any setting. How was this not noticed by any of the UI designers or security practitioners at Google? How am I supposed to change anything about my accounts? In this case, how am I suppose to delete them?
I guess in this day and age, you don't get a choice any more. You're going to have an account with Google or Apple or Microsoft or Meta, and you're going to like it.
To be fair, it is my fault for not properly taking care of the passkeys. If I had removed them from my Google accounts first before deleting them from Proton, I could have avoided this whole scenario. On the flip side, every single other website I've gone through this process with allowed me to use some other 2FA method which I had configured to remove an old passkey, or better yet, just asked me for my password! Google doesn't let you use any other method except the passkey to remove a passkey!
The biggest tease of this whole thing is that when you try to change a setting while having a passkey configured, there's a "try another way" button in the corner; however, when I press it, I'm only presented with one option: passkey. I have a phone number on both accounts. I know the password to both accounts. Somehow, the only way I'm allowed to authenticate myself is with the orphaned passkey.
You can't even find an answer to this on the Google end user help forums. I made a post describing this issue and have received 0 responses to this day. Others have even posted about the exact same problem, and if there are responses, none of them are helpful. They only ever lead to the same account recovery process that solves nothing. It's incredibly pathetic when you realize that this is all coming from a company bigger than our minds can comprehend, and smaller websites have implemented this process far better (like Porkbun).
This is exactly why I want to stop using Google products - any company, for that matter, that tries to lock you into their ecosystem and make you their product instead of a customer. Valve is a big company that has a similar ecosystem mindset to Google, which is unfortunate, but they do not "lock" you into that ecosystem. Valve works on and supports other open-source projects. All their devices can be changed, configured, or modded. Most importantly, they let you use other forms of authentication outside of their proprietary Steam Guard.
Passkeys aren't even proprietary. They were supposed to be a safer, more convenient alternative to passwords. At one point I loved the idea. I set up a passkey with any website that offered one. This situation has made me realize that passkeys are not worth it. They take away the power of the individual and hand it to whoever issues the passkey. So please heed my warning dear reader and stop using passkeys. At the very least, don't use them with Google.