Juha Saarinen: Keeping your phone secure, the Google way

When I tried to remove my Google account in Android Settings, I ran into this dialog. Screenshot / Juha Saarinen.

It was time to return a review Android phone, and I did the usual things before sending it back: encrypted the storage, and a factory reset, thinking that would clear my settings on the device.

The factory reset seemed to have done just that: I got the select your language screen after the phone rebooted, and then the pick Wi-Fi screen, so off the device went.

To my surprise, the vendor sent an email saying the device still has my Google Account on it so could I please remove it and reset the device again?

The phone was returned, and sure enough: a few screens on from the Wi-Fi selection page, there was my Google Account. As the device had been reset, it needed the credentials for the last Google Account that had been synced on it.

That's the Device Protection security feature in the newest version of Android kicking in, and it was the start of much head-scratching because when I tried to remove my Google account in Android Settings, I ran into this dialog:

A simple factory reset does not remove Google Accounts however. Nor will a hard reset from the Android startup screen (press Volume Up and Power at the same time, and select Wipe Device/Factory Reset).

Removing the device from your Google Account web page, or trying to erase it with the Android Device Manager (again over the web) did nothing. Well, the phone forgot the Google Account password, but that's it.

When I tried to remove my Google account in Android Settings, I ran into this dialog. Screenshot / Juha Saarinen.

Apparently, even reflashing with new firmware won't remove Google accounts, although as I couldn't find a suitable ROM for the device in question, I wasn't able to try this.

Google's Australia office offered no clue, but by piecing together information from the vendor and on the XDA Developers web forum, I got there in the end.

If you're stuck trying to clear a Google account from a new Android phone, try this:

Factory reset and let the device reboot.

Pick the system language, and sign in again with your Google Account - you may have to connect to a WiFi access point first.

Make sure you don't restore from a device backup, and set up the phone as a new device. Don't enable any security or authentication features, despite the dire warnings about the consequences of not doing so.

Once you see the Android interface, it should now be possible to remove the Google Account in Settings. On my device, the Google Account had a different look icon to earlier.

Another factory reset and reboot (make sure you erase the internal storage too) and the Google Account should now be gone and the phone is now ready for someone else to use.
Phew.

If you've forgotten your Google Account password and haven't set up a way to recover it, for instance through SMS, that seems to be it: the phone's basically bricked and unusable.

If you've forgotten your Google Account password and haven't set up a way to recover it, for instance through SMS, that seems to be it: the phone's basically bricked and unusable. Make sure you enable alternative password recovery methods for your Google Account, in other words.

Android Device Protection is triggered by setting the screen lock and associating a Google Account with the device. You can read more about it on Google's support site.

If your device has Developer Options enabled, you can apparently disable Device Protection by selecting OEM Unlocking which is easier than the double factory reset method above.I couldn't do that on my review device.

I'm in two minds about Device Protection.

Yes, it does add a further layer of security: if your phone's stolen, a simple device reset won't make it reusable.

On the other hand, there was no indication when I factory reset the phone that it would not wipe all my information from the device, including the Google Account.

The phone said this would happen, but I returned a device with my Google Account on it. I don't want to do that, even though the account name isn't displayed, Google.

When I reset a device to wipe my account off it, that's exactly what should happen.

If it doesn't happen, I should be told.

Also, if I couldn't get the phone back, I'd feel much happier if I can log into my Google Account on the web, and erase it from there as it says I should be able to.

I'd rather have the added security of Device Protection than not, but Google... did you have to make it this clumsy and non-obvious to use?