221–230 of 299 posts
What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…
Earlier quoted context omitted.
> We do send an email when you log in from a new device. Which is a non-optional pain in the butt if you don't store cookies. Every login is a new device. Twitter does the same, I got so tired of cleaning up my inbox that I rarely log in anymore without a good reason. (I already didn't log into Google without good reason so that didn't change.)
Why wouldn't you store cookies?
Earlier quoted context omitted.
The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…
I recently turned on 2FA on a bunch of accounts (nine total) and ran into the same problem. My solution was to save the initialization QR codes and print them on a piece of paper (actually three copies, stored in separate locations). This involved a bunch of screenshotting and messing around in gimp and was in general a big pain. But if my phone dies, restoring my 2FA setup will be much simpler than using backup code…
Authy makes me a little nervous (since it's closed source and I can't be sure exactly what they are doing), but at least they claim to encrypt the keys on the phone before they put them on their servers. They state on their site repeatedly that if you forget your encryption password the keys are gone and they can't do anything about it.
Earlier quoted context omitted.
Why wouldn't you store cookies?
From the biggest ad network in the world? The real question is: why do you?!
Earlier quoted context omitted.
I recently turned on 2FA on a bunch of accounts (nine total) and ran into the same problem. My solution was to save the initialization QR codes and print them on a piece of paper (actually three copies, stored in separate locations). This involved a bunch of screenshotting and messing around in gimp and was in general a big pain. But if my phone dies, restoring my 2FA setup will be much simpler than using backup code…
>So it seems like stealing a phone number would allow an attacker to steal 2FA codes stored in Authy. You're required to set a password on your Authy database before you can start adding tokens to it. So when I transferred my Authy database to a new phone (had to send in the old one for a replacement), I had to confirm the password before it would sync to the new device. Authy also bugs you about once a month to conf…
That's not true. Passwords in Authy are for backup, which is optional. Backup synchronizes offline TOTP secrets between paired devices. Only the offline TOTP secret is encrypted; the token name is not.
"Authy Account" secrets, the ones created by the Authy API, used by Coinbase, Cloudflare, et cetera, are always stored remotely, and can be restored without-password to anyone with possession of your phone number and email account.
I wrote about this a little over here:
Earlier quoted context omitted.
I've several children, and can no longer make Google accounts for their Chromebooks. All the phone numbers I have and control can no longer be used to register further accounts. What happens to users that buy a new Android cell phone who's number has been burned by Google?
You should be aware that Google has minimum age requirements. I was not aware of this and my son disclosed his age to Google as part of setting up another Google service, which then locked out his account. https://support.google.com/accounts/answer/1350409?hl=en I switched to Fastmail after that.
> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…
So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.
I signed up for AdWords a long time ago and created a test campaign just to see what it looks like, but never completed the process, so I didn't have a payment method entered.
Fast forward till start of this year, I created an AdMob account to put ads in one iOS game I have, and apparently as soon as I entered my credit card info, the old AdWords campaign started running and was taking $200/day. I noticed after two days and immediately stopped it and contacted support. They quickly got back to me, a person called me and explained that the issue was an error from their side, and they refunded me the amount. It took three weeks for the refund to occur, and during that time the guy called me at least once per week to keep me in the loop. I was surprised with this after all I've heard about Google's support. But I guess that's just one data point in the pool.
> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…
So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.
Earlier quoted context omitted.
So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.
I keep hearing this, but here's my anecdote. I signed up for AdWords a long time ago and created a test campaign just to see what it looks like, but never completed the process, so I didn't have a payment method entered. Fast forward till start of this year, I created an AdMob account to put ads in one iOS game I have, and apparently as soon as I entered my credit card info, the old AdWords campaign started running a…