I've also noticed that there's something very surprising about how Google has implemented their 2FA. When I log into Gmail from a new computer, it does not text me an authentication code and then lock me out of the account until I enter the code. Instead it lets me into my account immediately with only a password, and then sends my phone a notification that someone has logged in from a new computer. Ignoring this notification has no consequence for the logged-in computer. Convenient indeed, but this is really not how I expect 2FA to work, and does nothing to prevent an attacker from reading the contents of your emails or sending fraudulent emails with nothing but a password.
Adding a phone number to your Google account can make it less secure
11–20 of 299 posts
Re: Adding a phone number to your Google account can make it less secure
#12> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity.
Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual intervention unless absolutely required.
Explicitly, this means that for free services like Gmail, humans aren't involved. Ever. Try getting support for a Google product and you'll see what I mean -- there's not even a phone number to call or an e-mail address unless it's a paid product (and even then, they've got a less-than-stellar reputation for support of paying customers).
Re: Adding a phone number to your Google account can make it less secure
#13I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…
I think the main issue is that google doesn't accept certain senders anymore. As a generic thread about running a mailserver/mail service pops up here often.
That means users are shoveled into about one of 4 "acceptable" providers which have control of the entire market. They demand, full name and usually gender, mobile, alternative email and more.
So you get pushed into their information pipeline to stop "spam".
Re: Adding a phone number to your Google account can make it less secure
#14Can Americans explain me how can you just do things like that by calling customer support? Wouldn't it make more sense to go and show your ID if you want to make changes like that?
Where would you go to show ID? In many places in America, the closest telco customer service office may be a 2 hour drive away. Everyone saves time/money by being able to do it over the phone; but unfortunately the customer service reps are usually poorly trained.
Re: Adding a phone number to your Google account can make it less secure
#15I've also noticed that there's something very surprising about how Google has implemented their 2FA. When I log into Gmail from a new computer, it does not text me an authentication code and then lock me out of the account until I enter the code. Instead it lets me into my account immediately with only a password, and then sends my phone a notification that someone has logged in from a new computer. Ignoring this not…
Uhh, are you sure? I've never seen it behave this way and that doesn't make sense. Can anyone else corroborate this?
Normally after you enter your password it immediately asks for the 2FA authentication code. There's only one button and that's to verify the code. If you try to go to gmail.com before entering that code it will make you start the entire authentication process over again.
Re: Adding a phone number to your Google account can make it less secure
#16I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…
When is the last time you tried?
I have created a gmail account couple of weeks back without providing phone number and recovery email.
Re: Adding a phone number to your Google account can make it less secure
#17What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…
The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now.
Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could also restore the database on my tablet in the meantime and use that instead. The prospect of doing so does leave me a little concerned, however, because my phone has full-disk encryption enabled while my tablet does not.
Re: Adding a phone number to your Google account can make it less secure
#18> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…
This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people.
It's hard to justify Gmail these days other than the frustration of migrating off of it.
As a side perk, Australia has no equivalent to a National Security Letter, and FastMail is able to hence notify me of any government requests for access to my data.
Re: Adding a phone number to your Google account can make it less secure
#19I've also noticed that there's something very surprising about how Google has implemented their 2FA. When I log into Gmail from a new computer, it does not text me an authentication code and then lock me out of the account until I enter the code. Instead it lets me into my account immediately with only a password, and then sends my phone a notification that someone has logged in from a new computer. Ignoring this not…
That's not how Google 2FA works; you seem to have misconfigured something. When you actually have 2FA on (like I do), you must enter your one-time code after entering the correct password.
Re: Adding a phone number to your Google account can make it less secure
#20I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…
When is the last time you tried? I have created a gmail account couple of weeks back without providing phone number and recovery email.
I did it. Then they banned it.
Having my phone number or any other hard identifier is none of Googles business.