Adding a phone number to your Google account can make it less secure • Hacker News Board

Re: Adding a phone number to your Google account can make it less secure

#121

Post by walrus01 » Thu, Oct 20, 2016, 9:48 PM UTC

SS7, phone numbers and telco stuff are built on trust, with a 1970s/1980s business model when the only people messing with the system was the ILEC.

It's trivially easy to fake scanned documents proving that you're authorized to port a phone number from one service to another. In this case there was probably no SS7 messing about at all, just somebod falsifying the info or socially engineering his cellular carrier to transfer the number to a new phone. Mitnick's "Art of Deception" book is an authoritative resource on this problem.

Re: Adding a phone number to your Google account can make it less secure

#122

Post by codedokode » Thu, Oct 20, 2016, 9:52 PM UTC

This is serious problem. In some banks having access to a phone allows the attacker to login into a web client and transfer money from the account. And many web services rely on SMS as a method to restore the password.

Re: Adding a phone number to your Google account can make it less secure

#123

Post by wfunction » Thu, Oct 20, 2016, 9:52 PM UTC

Houshalter wrote: post #114

jandrese wrote: post #77

Earlier quoted context omitted.

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs. Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regu…

+1 same. Rssponses like the one you just replied to completely drive me nuts. If you don't think it'll be useful for me then let me disable it. Don't use it as an excuse.

Re: Adding a phone number to your Google account can make it less secure

#124

Post by metabren » Thu, Oct 20, 2016, 9:52 PM UTC

I imagine adding a phone number to your Google account is more about Google having a particular phone number explicitly linked to an account for their information graph rather than for security reasons.

Re: Adding a phone number to your Google account can make it less secure

#125

Post by wfunction » Thu, Oct 20, 2016, 9:53 PM UTC

jandrese wrote: post #77

wfunction wrote: post #66

Earlier quoted context omitted.

> We do send an email when you log in from a new device. AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

Did you even read my comment? The most important scenario I just referred to was AFTER the password is typed correctly. Not before. I'm pretty damn sure botnets aren't going around entering my password correctly.

Re: Adding a phone number to your Google account can make it less secure

#126

Post by codedokode » Thu, Oct 20, 2016, 9:55 PM UTC

fullmetaleng wrote: post #16

x1798DE wrote: post #4

I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…

When is the last time you tried? I have created a gmail account couple of weeks back without providing phone number and recovery email.

It probably depends on your IP address, country and maybe something else. Some time ago I was unable to register on youtube without providing a phone number, and earlier I have registered a Google Account from Android emulator that was instantly blocked. Maybe it is because of spam, or maybe because lot of people are using the same IP address.

Re: Adding a phone number to your Google account can make it less secure

#127

Post by dragonwriter » Thu, Oct 20, 2016, 9:55 PM UTC

AFAICT, and this is supported by the Google screenshot shown promoting the feature, Google doesn't say the phone makes the account more secure, it says that it makes the account more usable, since it provides a way to recover from lockouts. This is one of many cases where usability and security aren't aligned.

Re: Adding a phone number to your Google account can make it less secure

#128

Post by MBlume » Thu, Oct 20, 2016, 9:56 PM UTC

knz wrote: post #97

BinaryIdiot wrote: post #46

Earlier quoted context omitted.

I bet I know which one of those resources actually exists .

Google's Project Fi has great customer support. You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out. Good luck if you aren't a paying customer though...

I pay for Google Drive, in part because it seemed like the closest I could get to paying for GMail, I don't suppose that counts...

Re: Adding a phone number to your Google account can make it less secure

#129

Post by alasdair_ » Thu, Oct 20, 2016, 9:57 PM UTC

exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

>they've got a less-than-stellar reputation for support of paying customers

I've actually had surprisingly good support from the $150/month plan for their cloud products. They get back to me quickly and give good advice (with custom code samples when needed).

Re: Adding a phone number to your Google account can make it less secure

#130

Post by gist » Thu, Oct 20, 2016, 10:01 PM UTC

buyx wrote: post #100

gist wrote: post #87

Earlier quoted context omitted.

> Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to matter…

No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to be an issue. Email is the gateway to almost everything else. It's used for account recovery as well as (wrongly) passwords and other sensitive information. Google Drive and docs would also be compromised. It's actually a bigg…

I am not doubting that. I am just saying that the vast majority of people that use gmail will never have a case where someone wants what they have so much to go to the effort to social engineer their wireless company. Ntim but to mention that there is a bigger risk of getting your house broken into or a host of other things or identity theft. Plus this requires certain bad behavior and failure as well on the part of the phone company. [1] It's not clear how easy this would be for a normally determined hacker to pull it off.

[1] So we have two probabilities at work.