Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

181–190 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#181

Post by lucb1e »

dimino wrote: post #180
eveningcoffee wrote: post #176

Earlier quoted context omitted.

It may depend on the time frame and geolocation. I tried to do this about 6 months ago. I have also an old account that does not have a phone number and it is functional. What I was describing was a creation of a new account.

I'm not Google customer support, but I'll repeat for a third time; you were not suspended because you didn't provide a phone number.

I think you've made your opinion clear. Why continue to try pushing it as fact? There are a thousand factors at play in spam/fraud/whatever detection, how can you possibly say with a straight face that you're certain the phone number is not a leading reason?

Re: Adding a phone number to your Google account can make it less secure

#182

Post by eveningcoffee »

dimino wrote: post #180
eveningcoffee wrote: post #176

Earlier quoted context omitted.

It may depend on the time frame and geolocation. I tried to do this about 6 months ago. I have also an old account that does not have a phone number and it is functional. What I was describing was a creation of a new account.

I'm not Google customer support, but I'll repeat for a third time; you were not suspended because you didn't provide a phone number.

So who are you then? :)

But I am willing to create another more controlled experiment.

Re: Adding a phone number to your Google account can make it less secure

#183

Post by bikamonki »

Google fills my droid with bloatware. Even worse: all of Google apps will not work without Google Play Services which is a super abusive app: among other things, it logs ALL MY ACTIVITY 24-7. So, if Google already runs apps with such privileges, why not adding a small app that mimics Whatsapp SMS verification. After verifying that a given SIM is installed on the phone where my Google account has been authenticated, it can establish a secure tunnel to send me 2FA codes. If a hacker would clone my SIM and even have my Google password they can prevent login until I grant permission from the first install/verification. Should I lose/change my phone, Google would not allow a second verification unless a pin is entered (which I created on the first SIM verification). Another aproach that avoids the pin number would be a delay before authenticating the second install. If I get 24hrs and a notifcation that I have logged-in on a second device, I certainly have enough time to fix any possible hack.

Re: Adding a phone number to your Google account can make it less secure

#184

Post by lucb1e »

lukasb wrote: post #40
wfunction wrote: post #30

Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now…

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

> We do send an email when you log in from a new device.

Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)

Re: Adding a phone number to your Google account can make it less secure

#185

Post by x0x0 »

vijayp wrote: post #72
jcoffland wrote: post #60

> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change in recovery email, name, and two-factor-auth settings, coupled with a “my account has been compromised” help request is highly suspicious. This series of events could easily occur in legitimate cases. Say you lose or destroy your cellphone. Since you only ever…

Yeah, I could believe that it would create too many false positives and in retrospect things do often seem easy. Google and other service providers do have data to evaluate the benefit and cost of making decisions based on patterns, and they probably do.

But the benefits are to them and the costs are to us =P

That said, I have no idea how to do account recovery if you cannot trust the phone number.

Re: Adding a phone number to your Google account can make it less secure

#186

Post by lucb1e »

knz wrote: post #103
hughes wrote: post #58

Earlier quoted context omitted.

I get notifications about that from Facebook sometimes. It is a bit unnerving to hear that someone is attempting to repeatedly log in with my email address, but it certainly prompts me to make sure my accounts are locked down well.

Do you have an email address that may be similar to others? My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).

> login

> emails

There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.

Re: Adding a phone number to your Google account can make it less secure

#187

Post by eveningcoffee »

lucb1e wrote: post #181
dimino wrote: post #180

Earlier quoted context omitted.

I'm not Google customer support, but I'll repeat for a third time; you were not suspended because you didn't provide a phone number.

I think you've made your opinion clear. Why continue to try pushing it as fact? There are a thousand factors at play in spam/fraud/whatever detection, how can you possibly say with a straight face that you're certain the phone number is not a leading reason?

It may be that this persons knows something more that we do not (does not seem to be the case) or has very different experience.

I do not mind this. It is indeed possible that the cause of the ban originated from some other source as from entered personal details and sequence of actions.

It actually motivates me to create another experiment.

While this statement will be really buried, it reminds me that we still should be thankful that we can somewhat conceal our identity as a private enterprise can be much more unforgiving that the state.

Re: Adding a phone number to your Google account can make it less secure

#188

Post by lucb1e »

NolF wrote: post #153
Figs wrote: post #148

Earlier quoted context omitted.

> We do send an email when you log in from a new device. Which is useless, because whoever got access can just delete it or change your password.

They send emails to the alternate account.

Which is very nice as a family member who is the recovery contact for many other family members. Wish this shit could be turned off, I've never heard it help anyone (though I'm sure we can find a stranger on the internet who can testify how useful it was for them).

Re: Adding a phone number to your Google account can make it less secure

#189

Post by lucb1e »

billconan wrote: post #147

I have this weird thing in my google account. When I set up my 2 way authentication, I noticed my account has a phone number added, which I don't recognize at all. The phone number has a Florida area code. I have never been to Florida. I emailed google about this, asking how the number was added? I didn't get any reply.

Honestly, did you expect a reply from Google? Have you ever had one?

Even people I was friendly with on forums or social networks that were employees for Google (or Microsoft for that matter, or both in one occasion) stopped responding when I mentioned anything from "heads up (since there is no contact listed for product x): there's a bug here, you might wanna forward that" to "do you know why this is that way?" It's a really weird experience. I've stopped trying to contact tech giants that are too big to care about an individual.

Re: Adding a phone number to your Google account can make it less secure

#190

Post by knz »

lucb1e wrote: post #186
knz wrote: post #103

Earlier quoted context omitted.

Do you have an email address that may be similar to others? My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).

> login > emails There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.

Unfortunately that was a management decision rather than technical decision!
Post reply on HN