Even with 2FA, Google accounts can be hacked with just a phone number
1–10 of 128 posts
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#2Well I heard from a friend of mine that in Argentina the cellphone provider can access to your info.
The case was this one. He was cheating her girlfriend, a friend of her accessed to my friend's text messages log, saw the evidence, and told to the gf about it. Apparently, but I never confirmed this, the friend (the one who read the messages) worked in the cellphone provider of my friend.
Since then I know I can't trust in my cellphone ever again, but I always was suspicious about this could be possible.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#3This leaves so many open questions. Foremost: How did they guess his GMail password? Is there a way to access GMail without knowing the password? Ie. by sending a reset password per SMS?
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#4This leaves so many open questions. Foremost: How did they guess his GMail password? Is there a way to access GMail without knowing the password? Ie. by sending a reset password per SMS?
They enabled call forwarding and got Google to call with a password reset code.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#5This leaves so many open questions. Foremost: How did they guess his GMail password? Is there a way to access GMail without knowing the password? Ie. by sending a reset password per SMS?
They enabled call forwarding and got Google to call with a password reset code.
Thanks. I think I'll remove my phone number as a backup option.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#6Earlier quoted context omitted.
They enabled call forwarding and got Google to call with a password reset code.
Thanks. I think I'll remove my phone number as a backup option.
Google periodically prompts me on login to add my cell phone number to increase my account's security.
I think someone confused about what "increase" means.
(And this is all the more surprising because in general I see all sorts of parts of Google making great end-user security decisions.)
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#7This just happened to me. The same timeframe, the same vector of attack, but a different target. They wanted my Twitter handle. Fortunately it was an old handle that Twitter had locked down and was not transferable. The hacker succeeded in making me lose my handle for a few days, but some friends came to my aid and I was able to get resolution through Twitter support.
My telecom company was helpful at first, but then we began to see circle-the-wagons behavior from them. We were at least able to get the call forwarding off of the account, but they would not tell us any details about what had happened on the account.
Until your story (and even now) I'm not exactly sure if my hacker had been able to forward the text messages or simply routed the phone call to his phone and using Google's password reset process was able to get a robo call to accomplish the same thing.
All of this is seriously making me consider creating my own 2FA service, only slightly better.
One quick recommendation I would add would be to put a passcode on your account with your mobile provider. Just call them and say "I'd like to add a passcode to my account", so you can at least add one extra layer of security there.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#8Wild.. you know, using google voice for a number of years, I switched to using mvno operators for my cell phone a few years back... Now, I'm glad they don't allow call forwarding on those accounts.
Though it seems like a lot of work, It's hard to imagine going through this... with a similar mindset.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#9There is always a weak link. Ugh.
Re: Even with 2FA, Google accounts can be hacked with just a phone number
#10This leaves so many open questions. Foremost: How did they guess his GMail password? Is there a way to access GMail without knowing the password? Ie. by sending a reset password per SMS?
They enabled call forwarding and got Google to call with a password reset code.
So in order to prevent that attack vector, I need to make sure my phone isn't set up to receive calls to recover my account?