Immediately called my mobile carrier and asked them to disabled the ability to add/change call forwarding.
Even with 2FA, Google accounts can be hacked with just a phone number
91–100 of 128 posts
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#92Earlier quoted context omitted.
I feel bad for the telcos (and other agencies that try to keep our private info). I called up my ISP a few months back and was presented with a variety of security questions that I couldn't provide the answer to. I certainly didn't know the 4 digit passcode I created 2+ years ago and I haven't used since. My fist couple guesses on my favorite movie were wrong. It was only after my second guess of my best friend durin…
A mobile carrier's identity verification could be augmented by asking questions about who you called recently. Remote identity verification over the internet is not solved perfectly, but FIDO's U2F is pretty good. Hardware tokens cost money which most people won't buy, which is one problem. To prevent getting locked out you have to buy (and the service has to support) multiple hardware tokens, but that protects again…
"A mobile carrier's identity verification could be augmented by asking questions about who you called recently."
Except that could be socially engineered pretty easily.
Plus, if your phone dies, you're in for a major inconvenience, because no one remembers actual phone numbers any more. I remember the number I had as a kid, but nowadays, even though my mom lives in the same place, I reach her only through VoIP or cell, and both those numbers are stored on my phone, not in my head.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#93Earlier quoted context omitted.
I feel bad for the telcos (and other agencies that try to keep our private info). I called up my ISP a few months back and was presented with a variety of security questions that I couldn't provide the answer to. I certainly didn't know the 4 digit passcode I created 2+ years ago and I haven't used since. My fist couple guesses on my favorite movie were wrong. It was only after my second guess of my best friend durin…
A mobile carrier's identity verification could be augmented by asking questions about who you called recently. Remote identity verification over the internet is not solved perfectly, but FIDO's U2F is pretty good. Hardware tokens cost money which most people won't buy, which is one problem. To prevent getting locked out you have to buy (and the service has to support) multiple hardware tokens, but that protects again…
> Hardware tokens cost money
All your excellent examples will dwarf mine, but I'll still tell it as a very cheap medium:
When I was at Fortis Luxembourg, the bank gave me a passive token: A card with a few dozen digits on it. At each login it would request 3 of those along with the password.
The key point of this is, it never transmitted the full key over the wire. So someone who intercepted the communication could never rebuild my full password.
Cost for the bank? A few cents. Security? The best I ever had from banks.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#94Earlier quoted context omitted.
Backup codes.
It's also possible to install the seed for the TOPT generator on multiple devices - all the ones I've bumped into have a mechanism for typing in a long-ish string as well as scanning a QR code - record that string (secured like a password, in something like 1Password) and you can always re-seed another device to come up with the same codes. I've got all mine on two phones and a iPad - one of the phones is usually in…
For all the sites that use TOPT, I have a screenshot of the QR code that was presented me, encrypted with GPG (using a symmetric key and a random password) and then I put that encrypted file in my 1Password collection.
I feel reasonably secure about this (as secure as I'm feeling about all the passwords already there in 1password) and I have a huge advantage that changing my phone won't require remembering to disassociate all accounts first if I don't want to lose access to them.
As TOPT works without a back-channel, that QR code stays useable until I manually revoke that key on the respective web site.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#95Earlier quoted context omitted.
Depends. What is your first and last name? I require your address, SSN, mother's maiden name and the name of your first pet to verify your answer. Thank you, have a great day!
I have no idea why are you asking me that or why was I downvoted. I said nothing about identity verification, just trademark issues. Seriously, wtf?
He is attempting humour.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#96I appear to have missed something. How did the hacker know his mobile number? Domain name registration?
That's my guess based on a pretty easy to figure out WHOIS. But security by obscurity here only goes so far: if someone really wants your phone number, there's lots of ways to get it.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#97Re: Even with 2FA, Google accounts can be hacked with just a phone number
#98Earlier quoted context omitted.
A mobile carrier's identity verification could be augmented by asking questions about who you called recently. Remote identity verification over the internet is not solved perfectly, but FIDO's U2F is pretty good. Hardware tokens cost money which most people won't buy, which is one problem. To prevent getting locked out you have to buy (and the service has to support) multiple hardware tokens, but that protects again…
> Hardware tokens cost money All your excellent examples will dwarf mine, but I'll still tell it as a very cheap medium: When I was at Fortis Luxembourg, the bank gave me a passive token: A card with a few dozen digits on it. At each login it would request 3 of those along with the password. The key point of this is, it never transmitted the full key over the wire. So someone who intercepted the communication could n…
Unfortunately, that sort of static information frequently is targeted for phishing. The bank can keep telling people that they will never ask for all the codes at once, but some subset of customers will happily comply with such a request in a badly written email.
Mind you, dynamic 2FA frequently only narrows the time window in which phishing is effective. Even with transaction-based 2FA, you'd need people to actually read the text message the bank sends them with the transaction authorisation code.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#99There's a balance between keeping others out and preventing yourself being locked out. Every time you add another factor, you also have to add another recovery option in case you lose that factor: 1) Password(A) :| Hacker must break A :| Losing A locks you out 2) Password(A) + SMS recovery(B) :( Hacker must break A or B :) Losing A and B locks you out 3) Password(A) + SMS(B) 2FA :) Hacker must break A and B :( Losing…
You could also have 2 SIM cards in your phone, one number known, one for additional business. A lot of phones have sockets for 2 SIM cards, and the cost is almost nothing.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#100Earlier quoted context omitted.
People need to be much more aware of the fact that you don't own your gmail address, or your Twitter/Facebook/LinkedIn/Instagram/whatever account. Those companies encourage people to build their reputations and networks and "personal brands" inside their walled gardens, while repeatedly demonstrating that they won't lift a finger to help protect the user's custodianship of "their" usernames. Unfortunately - when you…
I think it's a good idea to own your own domain name, at least as a tech savvy user. You can still use Google Apps with it (Google for work now?). That being said, I think it's a bit unfair to say companies won't lift a finger to help protect their users usernames. On the technical security level, many companies put a lot of effort into things like 2F, general internet security, etc. In particular Google, but also Dr…
Technical measures to prevent account theft are always welcomed but they stop there; at prevention.
As most of us know through experience though, poop happens.
In our era, for many people an account at an online social network is part of their identity. Losing it can be devastating. An account at Google is even more; it is one's documents, emails, contacts, calendar, photos, various data and digital purchases. So it is very important that there is support when you need it. Is it really so costly? I don't know. How many cases of account theft are there every day if the technical (prevention) measures are good? Maybe affected users are willing to cover some of them?