Adding a phone number to your Google account can make it less secure • Hacker News Board

Re: Adding a phone number to your Google account can make it less secure

#111

Post by FT_intern » Thu, Oct 20, 2016, 9:25 PM UTC

exelius wrote: post #14

angry-hacker wrote: post #5

Can Americans explain me how can you just do things like that by calling customer support? Wouldn't it make more sense to go and show your ID if you want to make changes like that?

Where would you go to show ID? In many places in America, the closest telco customer service office may be a 2 hour drive away. Everyone saves time/money by being able to do it over the phone; but unfortunately the customer service reps are usually poorly trained.

for practicality, you should be able to set your customer service security preferences to tighten or loosen this.

Re: Adding a phone number to your Google account can make it less secure

#112

Post by [deleted] » Thu, Oct 20, 2016, 9:27 PM UTC

[deleted]

Re: Adding a phone number to your Google account can make it less secure

#113

Post by ocdtrekkie » Thu, Oct 20, 2016, 9:29 PM UTC

mahyarm wrote: post #44

marco1 wrote: post #26

Earlier quoted context omitted.

> This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. Can absolutely confirm that. However, there's place for both Gmail and FastMail. Just know what you pay and what you're entitled to get for that price.

For me the issue is transitioning from something like gmail to my own email. I've had the account for 12 years at this point.

Yeah, I procrastinated on this for years. What I did was:

- Created an email address at my own domain and forwarded it to Gmail.

- For the last year or so, started using it as my email address and changing accounts to use it as it came up.

- Signed up with FastMail and set up my domain's MX records to point to it.

- Still checking Gmail for stragglers to change over to my new address.

- Eventually will set Gmail addresses to forward, but didn't want to rush that so I remember to just make stuff not go to Gmail.

The hardest thing is getting used to folders again vs. labels. But FastMail has everything like filters and aliases and two-factor auth to an extent that... honestly makes Gmail look kinda basic.

The advanced features of Gmail were the most compelling reason to switch to it, but FastMail takes them a lot further.

Re: Adding a phone number to your Google account can make it less secure

#114

Post by Houshalter » Thu, Oct 20, 2016, 9:32 PM UTC

jandrese wrote: post #77

wfunction wrote: post #66

Earlier quoted context omitted.

> We do send an email when you log in from a new device. AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs.

Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regular users more security conscious.

Re: Adding a phone number to your Google account can make it less secure

#115

Post by ocdtrekkie » Thu, Oct 20, 2016, 9:34 PM UTC

drodgers wrote: post #81

ocdtrekkie wrote: post #18

Earlier quoted context omitted.

This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people. It's hard to justify Gmail these days other than the frustration of migrating off of it. As a side perk, Australia has no equivalent to a National Security Letter,…

> As a side perk, Australia has no equivalent to a National Security Letter, and FastMail is able to hence notify me of any government requests for access to my data. Unfortunately we've got something pretty close: ASIO can designate any of its activities to be part of a Special Intelligence Operation at will, which makes any disclosure of the operation or its components into a crime (10 years jail if it 'endangers'…

Interesting. Can other countries invoke it? Because I know the US can ask the Australian government for assistance, but I wonder if that assistance can qualify for being an SIO.

Re: Adding a phone number to your Google account can make it less secure

#116

Post by mikeleeorg » Thu, Oct 20, 2016, 9:36 PM UTC

balls187 wrote: post #75

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

It's frightening how easy this is. Here's another example:

http://www.businessinsider.com/hacker-social-engineer-2016-2

Re: Adding a phone number to your Google account can make it less secure

#117

Post by shortstuffsushi » Thu, Oct 20, 2016, 9:36 PM UTC

badminton1 wrote: post #59

1457389 wrote: post #54

Earlier quoted context omitted.

Nice binary logic there. It's an attack vector therefore it can't be a solution to customer problems. The issues here are orthogonal.

Just saying that, in this article telcos are the weakest link. In some other cases customer support has been the weakest link.

Isn't customer service the weakest link in both of those cases?

Re: Adding a phone number to your Google account can make it less secure

#118

Post by eveningcoffee » Thu, Oct 20, 2016, 9:45 PM UTC

dimino wrote: post #99

eveningcoffee wrote: post #20

Earlier quoted context omitted.

I did it. Then they banned it. Having my phone number or any other hard identifier is none of Googles business.

They didn't ban your account for not having a phone number.

What else? I was creating this for Youtube videos for my son. When we were about to upload a video, it was already banned.

Re: Adding a phone number to your Google account can make it less secure

#119

Post by dangero » Thu, Oct 20, 2016, 9:47 PM UTC

badminton1 wrote: post #59

1457389 wrote: post #54

Earlier quoted context omitted.

Nice binary logic there. It's an attack vector therefore it can't be a solution to customer problems. The issues here are orthogonal.

Just saying that, in this article telcos are the weakest link. In some other cases customer support has been the weakest link.

It's a great counterpoint because with a large staff you can never solve the human element. It's also corollary to the hacking approaches we see regularly employed: Send an exploit payload via email to everyone in the company and somebody is bound to open it. In fact in the security space they've moved away from even saying you can protect the front door and are more focused on detection and correction once an intrusion occurs.

Re: Adding a phone number to your Google account can make it less secure

#120

Post by ocdtrekkie » Thu, Oct 20, 2016, 9:48 PM UTC

marco1 wrote: post #26

ocdtrekkie wrote: post #18

Earlier quoted context omitted.

This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people. It's hard to justify Gmail these days other than the frustration of migrating off of it. As a side perk, Australia has no equivalent to a National Security Letter,…

> This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. Can absolutely confirm that. However, there's place for both Gmail and FastMail. Just know what you pay and what you're entitled to get for that price.

For some people, email is not a big part of their lives, and it's probably fine to have a free service. But I'd argue almost anyone for whom email is a daily necessity, you should be paying for a certain quality of service. I mean, your email is the core of your online identity, and if it vanishes, such as the dozens of stories we've heard of Google terminating people's account without warning, it can be devastating to put everything back together.