Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

191–200 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#192
Two years ago, I added a friend on to my phone plan so that he could call his sick mother. I made it clear to Telus (my carrier) that he should not be able to modify the account or discuss account details with them, and they assured me that he wouldn't without both my PIN and express permission to add him to the account administrators list. Three months later he walked into a Telus store and got a new iPhone with a 2 year contract on my plan. When he stopped paying what he owed, guess who got stuck with the early termination fee?

Re: Adding a phone number to your Google account can make it less secure

#193

>While Bob didn’t have multi-factor authentication enabled, he had also heeded Google’s suggestions to add a backup phone number to bolster security. Ah, there it is. No two factor turned on.

If he was using SMS for 2FA, he still would have been compromised.

The article states that if 2FA is enabled, then answering a security question or access to the recovery email is also required.

Re: Adding a phone number to your Google account can make it less secure

#194
post #184
post #40

Earlier quoted context omitted.

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

> We do send an email when you log in from a new device. Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)

Why wouldn't you store cookies?

Re: Adding a phone number to your Google account can make it less secure

#195
post #181
post #180

Earlier quoted context omitted.

I'm not Google customer support, but I'll repeat for a third time; you were not suspended because you didn't provide a phone number.

I think you've made your opinion clear. Why continue to try pushing it as fact? There are a thousand factors at play in spam/fraud/whatever detection, how can you possibly say with a straight face that you're certain the phone number is not a leading reason?

It's not my opinion, it is fact. There was a reason he was suspended, and it is not his phone number not being attached to his account.

Also, I didn't say anything about leading reason.

Re: Adding a phone number to your Google account can make it less secure

#196

Earlier quoted context omitted.

Like how I have more than enough information to get one of my old accounts back but their Automated Response Forms reject everything. Even the moderators on the gmail support forums rejected my claims as well and pretty much said "deal with it".

Same happens to me. I have the original creation email, my email is (was?) the backup email originally created. I know the date and time of creation of the account, and they still reject it.

If you don't have a recovery email address actively assigned, then you should be locked out.

That's what adding a recovery email is for: to deliberately weaken your account's security, in exchange for convenience.

If you disable recovery, then -- no surprise -- you won't be able to access your account if you lose access.

This post may seem unkind, but keep in mind that some people deliberately do not add recovery methods, in order to prevent secondary-takeover access; and that the above poster's request would fundamentally drastically weaken the security of those users.

Re: Adding a phone number to your Google account can make it less secure

#197
post #180

Earlier quoted context omitted.

I'm not Google customer support, but I'll repeat for a third time; you were not suspended because you didn't provide a phone number.

So who are you then? :) But I am willing to create another more controlled experiment.

I'm concerned about your ability to control the necessary variables. For example, any one of your anti-tracking measures (you're big into Internet privacy, yes?) may be triggering the suspension.

Re: Adding a phone number to your Google account can make it less secure

#199
post #53

Earlier quoted context omitted.

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I find it far simpler to make a secure backup of the authenticator QR code than it is to save all of the one-time backup codes.

I wish it were possible to print a sheet of QR codes for all your 2FA accounts in Authy. The in-app backup seems to work well, but an easy offline backup would make me a lot more comfortable.

Re: Adding a phone number to your Google account can make it less secure

#200
post #177

Earlier quoted context omitted.

+1 Have had multiple issues with Google Apps and GCloud over the years and very promptly received phone calls from support (that I didn't expect). I live in Fiji, and have a tiny small business account (~$30/m)

Out of curiosity, what are the residential and biz Internet connections like in Fiji? Low or limited/capped bandwidth?

Very badly capped. Eg: http://www.unwired.com.fj/plans.jsp

Divide FJD prices by 2 for the approximate USD values. There are 3 ISP's (Vodafone, Digicel/Unwired, and TFL Connect).

Post reply on HN