Adding a phone number to your Google account can make it less secure • Hacker News Board

Re: Adding a phone number to your Google account can make it less secure

#261

Post by jsingleton » Fri, Oct 21, 2016, 11:35 AM UTC

If you are ever required to give a phone number but don't want to then you can use an official fictional one. This means no-one else will have access to it (or be annoyed by it). Same with email addresses.

If you need access then you could use https://smsprivacy.org or https://dtmf.io. I've not tried these though. Or of course you could build something yourself with https://www.twilio.com or https://www.nexmo.com.

I wrote a bit about this here: https://unop.uk/phone-numbers-for-examples-and-user-identifi...

Re: Adding a phone number to your Google account can make it less secure

#262

Post by creshal » Fri, Oct 21, 2016, 12:13 PM UTC

arjie wrote: post #245

BinaryIdiot wrote: post #46

Earlier quoted context omitted.

I bet I know which one of those resources actually exists .

People give Google a lot of shit, but how about paying for service you want? If you do, you get http://imgur.com/a/Udvn6 .

Okay, how do I pay for Google's search? 'cause Google keeps locking entire offices out of it because of "bot-like too high search volume". We're switching to Bing for months at a time.

Re: Adding a phone number to your Google account can make it less secure

#263

Post by nommm-nommm » Fri, Oct 21, 2016, 12:14 PM UTC

lucb1e wrote: post #186

knz wrote: post #103

Earlier quoted context omitted.

Do you have an email address that may be similar to others? My work recently implemented a login process for customers and it was surprising how many user errors we had related to names/emails that were similar (so bob@gmail.com vs nob@gmail.com etc - these were not the actual addresses but you get the idea).

> login > emails There's your problem. If autocomplete didn't exist I'd go nuts having to type my email address, and clearly those people don't have autocomplete or they wouldn't be making mistakes. Just use usernames.

Then nobody remembers their user name, I don't remember any of mine. If I didn't have LastPass I'd be password resetting on every financial account I have.

Re: Adding a phone number to your Google account can make it less secure

#264

Post by nommm-nommm » Fri, Oct 21, 2016, 12:22 PM UTC

darkhorn wrote: post #133

In Turkey, if you apply for a new SIM card (let's say you have micro and you want nano) then you cannot access your bank account (for example Garanti Bank, probably other big banks too). Doesn't matter whether you try to access the bank via your PC or phone or via your home telephone, a massage appears saying that your SIM card has been changes and thus you need to re-validate yourself. So, this means that the banks…

Off topic, but I am really curious. What would be a reason for your father to change his name in Turkey? Is men changing their name common in Turkey?

Re: Adding a phone number to your Google account can make it less secure

#265

Post by 7Z7 » Fri, Oct 21, 2016, 12:34 PM UTC

jcoffland wrote: post #174

ScottBurson wrote: post #170

Earlier quoted context omitted.

> This series of events could easily occur in legitimate cases. I don't think so. Why, in your scenario, would they file a help request saying the account had been compromised? They might file a request with some other content, but not that . Your general point is valid, but I think the OP has probably figured out a set of features from which one could pretty reliably tell that something was amiss. And all he's sugge…

If you lock the account because someone filled a help request claiming the account was compromised, then hackers could use this as a DOS.

..received a help request, along with all the other events (changed password, changed recovery email, changed phone number). Not just the help request.

Re: Adding a phone number to your Google account can make it less secure

#266

Post by gpvos » Fri, Oct 21, 2016, 12:48 PM UTC

geomark wrote: post #248

degenerate wrote: post #230

Earlier quoted context omitted.

AdWords is "different" because if your account has an issue, they aren't getting lots of your money. So their support is actually pretty good with AdWords. The rest of their services, the support is pretty bad (such as Google Apps), and their free services may as well have zero support.

My anecdote: I was brought in to help with an AdWords campaign for an ecommerce site. I did some keyword research, ran some small campaigns to get some CTR and conversion metrics, then kicked off a bigger campain, pruning keywords as needed to ensure CTR stayed up and we didn't get a low CTR slap on the account which results in CPC skyrocketing. It was chugging along at a pretty good ROI. At that point I turned it ov…

CTR = click-through rate, CPC = cost per click

Re: Adding a phone number to your Google account can make it less secure

#267

Post by Spooky23 » Fri, Oct 21, 2016, 12:49 PM UTC

I wonder if having having a really shitty prepaid carrier for this purpose or a commercial account is a viable strategy?

A lousy MVNO is impossible to contact in any situation. Usually with business accounts the carrier refuses to talk to anyone except the designated account manager.

Re: Adding a phone number to your Google account can make it less secure

#268

Post by nommm-nommm » Fri, Oct 21, 2016, 12:57 PM UTC

shawn-butler wrote: post #209

Is it possible to sue Verizon, TMo, ATT for their failure to to adhere to their own security practices for damages subsequent to a hack? I think someone should try.

Someone is trying

https://krebsonsecurity.com/2016/08/a-life-or-death-case-of-...

Basically husband had a heart attack and when wife went to call for help her phone had been shut off by ID thieves. Husband died. Kids are suing Verizon for not preventing ID thieves. This story doesn't seem to make sense though because I thought a phone without service could still call 911.

Re: Adding a phone number to your Google account can make it less secure

#269

Post by jliptzin » Fri, Oct 21, 2016, 1:08 PM UTC

incompatible wrote: post #142

exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I would have happily paid a monthly fee for the service if it meant I could at least get a response from a support email (ironically there's no number for google voice support). I even tried pleading with my adwords manager where I was spending a ton of money every month and she said she didn't known how to help.

Re: Adding a phone number to your Google account can make it less secure

#270

Post by alibarber » Fri, Oct 21, 2016, 1:10 PM UTC

abandonliberty wrote: post #231

incompatible wrote: post #142

Earlier quoted context omitted.

So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.

You're a product, not the customer. How well do we treat most livestock? I recently realized Windows 10 is going the same way and unfortunately it's much harder to not use your OS than Google or FB, and impacts your ability to use other purchased software.

I have a domain and a paid-for email hosting service that I use for my personal email. When I tell people this I often get looks of incredulity: Pay money?! Why not just use google? I must be mad!

My response is that I do not want an advertising company to handle my most personal correspondence. In my mind it really is that simple.