Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

271–280 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#271
post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

Facebook is the same way - support, even when you do pay for something like ads - is nonexistent.

If I permanently lost access to my facebook account I'd probably be mildly relieved that I'm finally done with it. My google account though, I'd be in panic mode.

Re: Adding a phone number to your Google account can make it less secure

#272
post #82

Earlier quoted context omitted.

No one is perfect, but IMO when it comes to security, Google goes to great lengths to make stuff in the web secure, probably the most from all the bigcorps out there. They are very aggressive about fixing TLS/SSL-related issues (finding and fixing vulnerabilities, deprecating old ciphers, promoting new stuff like cert pinning and HSTS, lowering SERPs in Google for non-https websites; they've also put in place means t…

> Google customer support is totally another pair of shoes Pair of shoes! Nice. I tend to say "why the face" a lot in our internal chat at work. Now I have another one (POS)

just realized "another pair of shoes" is an idiom in my native tongue (in fact, it's "another pair of boots" to be precise)

Re: Adding a phone number to your Google account can make it less secure

#273

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

Is anyone aware of repots on the comparative level of security of the various cell providers? I'd be interested to know how providers in various tiers of scale like US Cellular compare to TMobile and Sprint compare to Verizon and AT&T.

Re: Adding a phone number to your Google account can make it less secure

#274

What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…

2FA requires a phone number (for google accounts)

It does not. I had TOTP 2FA only on my last work account and it was company policy not to add phone numbers for security reasons.

Re: Adding a phone number to your Google account can make it less secure

#275
One thing that I don't see mentioned: The attacker doesn't need to know the victim's email address or even name, if they have a compromised phone number.

If you go to mail.google.com and say "Find My Account," you can enter a phone number directly, and then proceed with SMS-based recovery, if it's enabled.

This means that any time an attacker gains access to a phone number, they can plug it into gmail and fish to see if they can break in to an account.

Re: Adding a phone number to your Google account can make it less secure

#276

Earlier quoted context omitted.

So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I woul…

Ug, that pretty much terrifies me. I have a google voice number that I've used (for free) since it was Grand Central, and rely on it pretty heavily.

Anybvody else seeing GV random revokes? I wonder what would happen if I tried a port-out for this number.

Re: Adding a phone number to your Google account can make it less secure

#277

Earlier quoted context omitted.

So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I woul…

This is why I won't rely on Google Voice for anything important - if they won't make it a paid service with some additional features, that means it's a cost center that could go away at any time.

Heck, I'd happily pay for Google Voice with the addition of fax capabilities (even if it was receive-only), particularly since my online faxing service was bought out by eFax (feh) and at the next renewal will jack up from $15/year to $85/year (bye!). I'd happily pay multiples of how much I was previously paying to be an actual /customer/ who gets that kind of services.

Re: Adding a phone number to your Google account can make it less secure

#278
post #97

Earlier quoted context omitted.

Google's Project Fi has great customer support. You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out. Good luck if you aren't a paying customer though...

>You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out. if you were locked out of your phone (plan) & email, would you be able to contact them?

My wife is also a subscriber so I would still have access to support behind a login. Support staff are also quite active on the reddit site for Fi.

Re: Adding a phone number to your Google account can make it less secure

#279

Earlier quoted context omitted.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I woul…

Ug, that pretty much terrifies me. I have a google voice number that I've used (for free) since it was Grand Central, and rely on it pretty heavily. Anybvody else seeing GV random revokes? I wonder what would happen if I tried a port-out for this number.

This right here is the quicksand you stand on with Google's free products. Starts out pretty innocuous. Hey, check out this cool new free phone product called Google Voice. You check it out, it's cool, don't really know how it might be useful but you play around with it and maybe use it for a side project or as a toy. Eventually, maybe years later, you find it may be very useful to your business. Great! You roll it out, slowly more and more things depend on it as you incorporate it more deeply into your services. Then suddenly, like a turkey on Thanksgiving Day, you're permanently cut off from your account without warning and without recourse. Now you're in a state worse off than had you never signed up for the service to begin with.

Re: Adding a phone number to your Google account can make it less secure

#280

Earlier quoted context omitted.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I woul…

This is why I won't rely on Google Voice for anything important - if they won't make it a paid service with some additional features, that means it's a cost center that could go away at any time. Heck, I'd happily pay for Google Voice with the addition of fax capabilities (even if it was receive-only), particularly since my online faxing service was bought out by eFax (feh) and at the next renewal will jack up from $…

> if they won't make it a paid service with some additional features, that means it's a cost center that could go away at any time

Project Fi is a paid version of Google Voice with additional features. I doubt Voice will go away before Fi does.

Post reply on HN