Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

211–220 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#211

Post by CrendKing »

zitterbewegung wrote: post #2

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

The reason why they use phone in the first place is that you will always have it with you. The reason why you have your phone with you is because you use it to make phone call. Unless you are suggesting to buy phone that supports dual SIM cards, I think this idea is not very practical. Why not have physical TFA device instead (they are usually much cheaper and lighter than a phone)?

Re: Adding a phone number to your Google account can make it less secure

#212

Post by twr »

rsync wrote: post #206
cmdrfred wrote: post #41

Earlier quoted context omitted.

It accepts my personal mail server just fine. You need to support encryption, spf, and dkim but mail will flow no problem to gmail users in my experience.

Not mine, FWIW. Ten out of ten score on mail-tester.com, a clean IP that I acquired 15 years ago ... and further, gmail watches people daily remove my one-to-one correspondence from their spam folders. And yet, most (but not all) new gmail recipients will not see my emails until they remove them from their spam folder. Google does not want people to self-provide email and there is no incentive for them to do so.

dnsbl.info reports that 69.43.165.11, MX for mail.rsync.net, is blacklisted by ips.backscatterer.org:

http://www.backscatterer.org/?ip=69.43.165.11

I suggest fixing your SMTP server configuration [1][2] and maybe listing your IP on dnswl.org. (edit: I see you did the latter.)

[1]: http://www.backscatterer.org/index.php?target=bounces

[2]: https://web.archive.org/web/20140215064312/http://spamlinks....

Re: Adding a phone number to your Google account can make it less secure

#213

Post by sergers »

balls187 wrote: post #75

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

Similar thing i experienced with Rogers Wireless in Canada recently.

wife and I had separate accounts. i logged in with her account to the rogers account site and added my phone number to her account with a few basic details that are on every statement sent in the mail....

I had a joint account with my wife as a owner.

then my work had a corp plan with rogers, so wanted to switch to that, but since I am the employee, i had to be the account owner.

this isnt actually so simple.

they had to create a net new account with me as owner. and re-assign the phone numbers to the new account.

when i called in to their account support line, they asked for my 4 digit PIN. I said i have no idea what it is, the guy in the store just punched some numbers in when he setup the account and never told me.

they were okay with that and proceeded to ask me some details that are on my mailed statements....

Then they said they needed the account holders permission. --i was at work, my wife was out of town, i didnt feel like bothering her.

i said "hold on one minute, just let me get her". i put the phone on mute for 30 seconds. unmuted and changed my voice slightly "Hello? Yes i am fine with my husband taking ownership and transfering the numbers"

"she" then passed the phone back to me and the rep proceeded with the transfer.

Re: Adding a phone number to your Google account can make it less secure

#214

Post by AdmiralAsshat »

dnr wrote: post #146
AdmiralAsshat wrote: post #17

Earlier quoted context omitted.

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I recently turned on 2FA on a bunch of accounts (nine total) and ran into the same problem. My solution was to save the initialization QR codes and print them on a piece of paper (actually three copies, stored in separate locations). This involved a bunch of screenshotting and messing around in gimp and was in general a big pain. But if my phone dies, restoring my 2FA setup will be much simpler than using backup code…

>So it seems like stealing a phone number would allow an attacker to steal 2FA codes stored in Authy.

You're required to set a password on your Authy database before you can start adding tokens to it. So when I transferred my Authy database to a new phone (had to send in the old one for a replacement), I had to confirm the password before it would sync to the new device. Authy also bugs you about once a month to confirm your password phrase to make sure you don't forget it.

Additionally, you can set a PIN that Authy will prompt you for any time you try to open the app. I have that set, as well, so that even if someone should get past my lockscreen, they can't reach my 2FA tokens without another PIN.

Re: Adding a phone number to your Google account can make it less secure

#215

Post by twr »

vonklaus wrote: post #86
hash-set wrote: post #71

I always thought Google was trying to tie your gmail account back to a cell phone number so they could help end anonymity on the Internet. Or else give the information to the NSA or something. I'm trusting Google less and less these days. At the very least, Google should not have come out in favor of a particular Presidential candidate. Corporations have become incredibly powerful entities, able to affect the lives o…

Don't understand the downvotes. Thought this was widely acknowledged.

It's widely acknowledged by the paranoid. The reason why so many services started requiring a phone number at signup is that it's an extremely effective anti-spam technique. Of course, the paranoid people aren't necessarily wrong either.

Re: Adding a phone number to your Google account can make it less secure

#216

Post by weaksauce »

eveningcoffee wrote: post #187
lucb1e wrote: post #181

Earlier quoted context omitted.

I think you've made your opinion clear. Why continue to try pushing it as fact? There are a thousand factors at play in spam/fraud/whatever detection, how can you possibly say with a straight face that you're certain the phone number is not a leading reason?

It may be that this persons knows something more that we do not (does not seem to be the case) or has very different experience. I do not mind this. It is indeed possible that the cause of the ban originated from some other source as from entered personal details and sequence of actions. It actually motivates me to create another experiment. While this statement will be really buried, it reminds me that we still shou…

From what I can tell from a few days ago, you can't create a new account without a phone number.

Re: Adding a phone number to your Google account can make it less secure

#218

Post by js2 »

jasonjayr wrote: post #29
x1798DE wrote: post #4

I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…

I've several children, and can no longer make Google accounts for their Chromebooks. All the phone numbers I have and control can no longer be used to register further accounts. What happens to users that buy a new Android cell phone who's number has been burned by Google?

You should be aware that Google has minimum age requirements. I was not aware of this and my son disclosed his age to Google as part of setting up another Google service, which then locked out his account.

https://support.google.com/accounts/answer/1350409?hl=en

I switched to Fastmail after that.

Re: Adding a phone number to your Google account can make it less secure

#219

Post by RubyPinch »

knz wrote: post #97
BinaryIdiot wrote: post #46

Earlier quoted context omitted.

I bet I know which one of those resources actually exists .

Google's Project Fi has great customer support. You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out. Good luck if you aren't a paying customer though...

>You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out.

if you were locked out of your phone (plan) & email, would you be able to contact them?

Re: Adding a phone number to your Google account can make it less secure

#220

Post by batiudrami »

balls187 wrote: post #75

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

I used to work in telco (in another country) and it's a difficult line to tread. 95% of customers have no idea what their 4 digit PIN was so you have to identify them other ways, and not being able to access their account is the kind of thing that pisses even legitimate customers off (which is why it's so easy to take advantage of).

Our company's policy was "if they don't know the PIN you have to connect them to the call centre and have them verify for you" but customers are rarely impressed to be handed a phone to the overseas call centre.

I know I got it wrong at least once.

Post reply on HN