Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

141–150 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#141

Post by angry_octet »

ocdtrekkie wrote: post #115
drodgers wrote: post #81

Earlier quoted context omitted.

> As a side perk, Australia has no equivalent to a National Security Letter, and FastMail is able to hence notify me of any government requests for access to my data. Unfortunately we've got something pretty close: ASIO can designate any of its activities to be part of a Special Intelligence Operation at will, which makes any disclosure of the operation or its components into a crime (10 years jail if it 'endangers'…

Interesting. Can other countries invoke it? Because I know the US can ask the Australian government for assistance, but I wonder if that assistance can qualify for being an SIO.

By all indications, use of this provision is extremely rare, nothing like the number of NSLs issued in the US. So it would be a big ask, but it could happen if the consequences of wide disclosure were 'extremely grave'.

For context, one of the motivating leaks was when there was a planned 5am counter terror raid, and someone in the state police leaked the who/what/where to a major newspaper, who had papers coming off the presses at 3am about people who hadn't been raided yet.

Re: Adding a phone number to your Google account can make it less secure

#142

Post by incompatible »

exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.

Re: Adding a phone number to your Google account can make it less secure

#143

Post by kochthesecond »

marco1 wrote: post #26
ocdtrekkie wrote: post #18

Earlier quoted context omitted.

This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people. It's hard to justify Gmail these days other than the frustration of migrating off of it. As a side perk, Australia has no equivalent to a National Security Letter,…

> This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. Can absolutely confirm that. However, there's place for both Gmail and FastMail. Just know what you pay and what you're entitled to get for that price.

How is search in FastMail? And mobile clients?

Re: Adding a phone number to your Google account can make it less secure

#144

Post by dimino »

eveningcoffee wrote: post #118
dimino wrote: post #99

Earlier quoted context omitted.

They didn't ban your account for not having a phone number.

What else? I was creating this for Youtube videos for my son. When we were about to upload a video, it was already banned.

I dunno, but you weren't banned for not having a phone number attached to your account, because I and many others have accounts without phone numbers and are not banned.

Re: Adding a phone number to your Google account can make it less secure

#145

Post by nfriedly »

I think that for a lot of people, the added access is worth the security risk: they're more likely to forget their own password than to be hacked.

One of my moms friends had gone through the Gmail password reset process a few times, but she but she called me one day kind of frantic because she could no longer reset her password (or remember the old one).

It seems that previously Google had allowed either a phone call or an SMS to the phone number on her account, but had recently taken away the call option. Her phone was a landline that couldn't receive SMS messages.

She didn't have (or couldn't access) a backup account and couldn't remember the answers to any of her security questions, or at least not enough of them.

I think she just gave up and switched to Yahoo.

Re: Adding a phone number to your Google account can make it less secure

#146

Post by dnr »

AdmiralAsshat wrote: post #17
nchelluri wrote: post #6

What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I recently turned on 2FA on a bunch of accounts (nine total) and ran into the same problem. My solution was to save the initialization QR codes and print them on a piece of paper (actually three copies, stored in separate locations). This involved a bunch of screenshotting and messing around in gimp and was in general a big pain. But if my phone dies, restoring my 2FA setup will be much simpler than using backup codes: I just have to scan codes; the account providers aren't involved at all.

(I do also keep a few backup codes for the most important accounts in my wallet.)

I know Authy can back up 2FA state to their own cloud, but it's unclear how secure this is: they let you restore codes onto a new phone with the same number, and apparently even to a brand new phone (https://www.authy.com/phones/change/). So it seems like stealing a phone number would allow an attacker to steal 2FA codes stored in Authy.

(What I'd really like is a TOTP app that let me back up its state into a single giant QR code or a small file that I could print out in hex and scan+ocr later.)

Re: Adding a phone number to your Google account can make it less secure

#147

Post by billconan »

I have this weird thing in my google account.

When I set up my 2 way authentication, I noticed my account has a phone number added, which I don't recognize at all. The phone number has a Florida area code. I have never been to Florida. I emailed google about this, asking how the number was added? I didn't get any reply.

Re: Adding a phone number to your Google account can make it less secure

#148

Post by Figs »

lukasb wrote: post #40
wfunction wrote: post #30

Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now…

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

> We do send an email when you log in from a new device.

Which is useless, because whoever got access can just delete it or change your password.

Re: Adding a phone number to your Google account can make it less secure

#150

Post by agentdrtran »

exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

Facebook is the same way - support, even when you do pay for something like ads - is nonexistent.
Post reply on HN