The browser "back" button for the website is broken...
Even with 2FA, Google accounts can be hacked with just a phone number
31–40 of 128 posts
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#32This is why I always recommend against using SMS-based 2-factor. Without even doing any serious research, it seemed pretty obvious to me from day one that at the very least someone like NSA/FBI could forge your number somehow with or without the carrier's help, but there's also the potential for other attackers to do it, too. Call forwarding didn't even cross my mind, but it just goes to show how ridiculously broken…
> Ideally what I'd want is an NFC ring or a smart band/watch that can use FIDO's U2F or a similar protocol that works through NFC
I've got my eyes on a Yubikey NEO for just this kind of use: https://www.yubico.com/products/yubikey-hardware/yubikey-neo...
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#33Interesting, so adding 2FA actually decreased security... Well shit. Interesting case that shows just how unpredictable such things can be. As far as I understand, though, 2FA increased the attack surface in this case. A web interface itself still remains impenetrable, doesn't it (know your hard-to-guess password and you should be fine)? Mobile provider was the weakest link and any system is as secure as its weakest…
It's similar to security questions in that way. If you answer them truthfully, then they can be used to attack you.
You should have the same answer for all security questions and it should be an easy to remember pass phrase about the service
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#34This is why I always recommend against using SMS-based 2-factor. Without even doing any serious research, it seemed pretty obvious to me from day one that at the very least someone like NSA/FBI could forge your number somehow with or without the carrier's help, but there's also the potential for other attackers to do it, too. Call forwarding didn't even cross my mind, but it just goes to show how ridiculously broken…
Did you consider the Yubikey neo, a FIDO U2F NFC/Mifare keyring + usb keyboard? it pretty much does that.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#35Earlier quoted context omitted.
After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?
Backup codes.
I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too?
Mind you, it's probably the best idea.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#36Earlier quoted context omitted.
Backup codes.
I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too? Mind you, it's probably the best idea.
Simply stealing your phone isn't enough. They also need to know your password change 2-step settings.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#37Earlier quoted context omitted.
After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?
Also other trusted devices can bypass 2factor. Less secure, of course, but my desktop and laptop bypass two factor.
Bypass 2-step to access your account but they can't change your Google password.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#38What strikes me most in these stories, is how you always have to find some higher ranking company employee through personal connections in order to get a tiny possibility to take your account back.
These companies build on their users but, when their users need them, they betray them.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#39Earlier quoted context omitted.
Also other trusted devices can bypass 2factor. Less secure, of course, but my desktop and laptop bypass two factor.
Bypass 2-step to access your account but they can't change your Google password.
I responded to a comment about, "what is your plan for continuing to use your account if your phone is stolen?"
Did you downvote and responded to a thread incorrectly?
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#40This is a good reminder that your phone may not be as secure as you think. In many countries governments are able to get access or ask for this type of change to be made from the national telco's.
The reactions you can take at the moment are to use a mobile App, (or preferably a security key!) rather than SMS backup, and if You're feeling especially uncharitable to your phone company, change the backup number google makes you enter to a google voice number rather than that of your actual phone - creating a circular situation where it can't really be used as a method for account recovery / hijacking.