Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

131–140 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#131

Post by codedokode »

jakub_g wrote: post #98
zitterbewegung wrote: post #2

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

This works as long as they don't insist on verifying you through that secondary phone number (this is the case for now for Google I think - if something suspicious is going on, they ask you if you want an sms with a verification code, or an email to a secondary address; but maybe not all services with 2FA make this optional). It's not fun to have 2 phones always with you. But maybe the 2-SIM devices will become more…

You don't have to have a second phone (or even just a SIM card) with you, you can keep it at home.

Re: Adding a phone number to your Google account can make it less secure

#133

Post by darkhorn »

In Turkey, if you apply for a new SIM card (let's say you have micro and you want nano) then you cannot access your bank account (for example Garanti Bank, probably other big banks too). Doesn't matter whether you try to access the bank via your PC or phone or via your home telephone, a massage appears saying that your SIM card has been changes and thus you need to re-validate yourself. So, this means that the banks and mobile operators share data.

Plus, if you apply for a new SIM card and you have a changed information in your ID, such as your father's has changed his name or you have corrected your birth place, then your ID is send to the government and only when the government gives a permission then they can give you a new SIM.

If you are not the owner of the SIM card no one talks to you.

If you want a new phone number then you must register with your ID.

Re: Adding a phone number to your Google account can make it less secure

#134

Post by tnorthcutt »

ocdtrekkie wrote: post #113
mahyarm wrote: post #44

Earlier quoted context omitted.

For me the issue is transitioning from something like gmail to my own email. I've had the account for 12 years at this point.

Yeah, I procrastinated on this for years. What I did was: - Created an email address at my own domain and forwarded it to Gmail. - For the last year or so, started using it as my email address and changing accounts to use it as it came up. - Signed up with FastMail and set up my domain's MX records to point to it. - Still checking Gmail for stragglers to change over to my new address. - Eventually will set Gmail addr…

Eventually will set Gmail addresses to forward, but didn't want to rush that so I remember to just make stuff not go to Gmail.

When I did this (from @gmail to @mydoman on google apps), I set up a filter to star/label anything forwarded from the old address, so I'd see an update was needed at the sending service/person. Perhaps the same could be done with FastMail.

Re: Adding a phone number to your Google account can make it less secure

#135

Post by xg15 »

throw7 wrote: post #96

Google seems to think phones are very secure: https://support.google.com/accounts/answer/183723 Why mobile phones are more secure Your mobile phone is a more secure identification method than your recovery email address or a security question because, unlike the other two, you have physical possession of your mobile phone.

...until the moment where you don't anymore.

Re: Adding a phone number to your Google account can make it less secure

#136

Post by TsomArp »

doubt_me wrote: post #102
exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

Like how I have more than enough information to get one of my old accounts back but their Automated Response Forms reject everything. Even the moderators on the gmail support forums rejected my claims as well and pretty much said "deal with it".

Same happens to me. I have the original creation email, my email is (was?) the backup email originally created. I know the date and time of creation of the account, and they still reject it.

Re: Adding a phone number to your Google account can make it less secure

#137

Post by nothrabannosir »

alasdair_ wrote: post #129
exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

>they've got a less-than-stellar reputation for support of paying customers I've actually had surprisingly good support from the $150/month plan for their cloud products. They get back to me quickly and give good advice (with custom code samples when needed).

Same here; support on google cloud was stellar indeed.

Re: Adding a phone number to your Google account can make it less secure

#138

Post by throw2016 »

I think with centralization comes control, arbitary rules, surveillance, potential for abuse of power and loss of end user control.

The fact that it keeps on becoming more and more difficult for individuals to run mailservers cannot be a coincidence.

The solution is decentralization at least for things like reddit, mail, search, social and other similar services. Multiple discrete 'old style' forums, search services, email providers and individual servers with dispersed control cannot be easily silenced, surveilled or subject to arbitary rules.

I think the usual response is people don't care but I think that's because they don't know and may not have stopped to consider the consequences. And perhaps more important before they didn't have to care. Now increasing creepiness from centralized providers means sooner or later users will wisen up.

If parents for instance become concerned about privacy issues they will go out of their way to protect their children and this can lead to new more privacy aware services, rules, and distributed applications. It also makes centralized unicorns based out of SV less of a desirable thing.

Re: Adding a phone number to your Google account can make it less secure

#139

Post by proee »

Another issue with sending Google verification reset codes over SMS is that a lot of "Google Phones" allow for viewing text messages/headers while the phone is "locked." Therefore if you leave your phone (even for just a few seconds), someone could quickly gain access to the reset vectors. In looking at the DNC leaks for example, if an attacker had the phone number of a high-profile target, locates them in person, and then execute a reset "event", they're now in very serious jeopardy, assuming attacker gets physical access to the target's phone for just a few seconds. (Edit: Attacker might have the ability to also view their phone through a high-resolution camera(s) as the target pulls up the text message. Thus allowing attacker access to codes without physical access to device.)

Re: Adding a phone number to your Google account can make it less secure

#140

Post by softawre »

jakub_g wrote: post #82
exelius wrote: post #39

Earlier quoted context omitted.

Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" It's called externalizing your costs, and Google is exceptionally good at it.

No one is perfect, but IMO when it comes to security, Google goes to great lengths to make stuff in the web secure, probably the most from all the bigcorps out there. They are very aggressive about fixing TLS/SSL-related issues (finding and fixing vulnerabilities, deprecating old ciphers, promoting new stuff like cert pinning and HSTS, lowering SERPs in Google for non-https websites; they've also put in place means t…

> Google customer support is totally another pair of shoes

Pair of shoes! Nice. I tend to say "why the face" a lot in our internal chat at work. Now I have another one (POS)

Post reply on HN