Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

281–290 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#281

Post by raisedbyninjas »

creeble wrote: post #276
jliptzin wrote: post #269

Earlier quoted context omitted.

Yea, I've had a google voice number that I have used sporadically for my business for a few years and suddenly my account was just banned without any obvious reason. It was obvious to me that it was some bot gone wild on their end and was clearly a mistake. I tried contacting Google about it for months with no response. It was a number I actually needed for something important but was never able to recover it. I woul…

Ug, that pretty much terrifies me. I have a google voice number that I've used (for free) since it was Grand Central, and rely on it pretty heavily. Anybvody else seeing GV random revokes? I wonder what would happen if I tried a port-out for this number.

Google Voice numbers can be ported to Project-Fi. Porting to another carrier would almost certainly be more successful from that service.

Re: Adding a phone number to your Google account can make it less secure

#282

Post by raisedbyninjas »

balls187 wrote: post #75

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

I recently had to regain account access to an employee's company provided phone on T-mobile after misplacing the password and PIN. If you know the phone number and can guess one of the numbers they recently called, you're in.

Re: Adding a phone number to your Google account can make it less secure

#283

Post by abandonliberty »

These are recovery options. By definition they make your account less secure by adding additional entry points for both you and a potential attacker.

I have 2 factor enabled and did some testing.

Security options Account Recovery email (phone # disabled) 2 factor Recovery phone #, backup codes

All of these require you to provide them. Phone number is given as XXX-XXX-XX12. Email is userna*@domain.com.

Failing all of those options, Google asks you to provide an associated email to help with recovery. It then provides a freeform text field for you to explain the situation and expect a response in 3-5 business days. If you have a secondary less-secured email address this could be a viable vector.

tl;dr two factor seems to add an additional layer of security / accounts that an attacker would have to compromise if appropriately configured. Recovery options weaken your security and you should be cautious when configuring.

Re: Adding a phone number to your Google account can make it less secure

#284

Post by RubyPinch »

aianus wrote: post #274
RubyPinch wrote: post #221

Earlier quoted context omitted.

2FA requires a phone number (for google accounts)

It does not. I had TOTP 2FA only on my last work account and it was company policy not to add phone numbers for security reasons.

https://i.imgur.com/SCxAk0V.png is what I get if I try to add two fac to my account, doesn't seem to be any way around it

Re: Adding a phone number to your Google account can make it less secure

#285

Post by jandrese »

Houshalter wrote: post #114
jandrese wrote: post #77

Earlier quoted context omitted.

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

I doubt they attack every single account every single day. At that point google should just ban the IPs doing that. Or at least turn of notifications for those IPs. Anyway excessive notifications are a solved problem. You can limit the notifications to one every month, and you can allow the user to disable them. But I would certainly like to know if someone tried to login to my account, and I think it would make regu…

In the last week my host has blocked 173 different IPs for attempting to guess passwords on SSH. And I don't even have psasword authentication enabled on SSH.

And this is on a nothing host. Almost completely anonymous and yet under constant attack.

Re: Adding a phone number to your Google account can make it less secure

#286

Post by rsync »

twr wrote: post #212
rsync wrote: post #206

Earlier quoted context omitted.

Not mine, FWIW. Ten out of ten score on mail-tester.com, a clean IP that I acquired 15 years ago ... and further, gmail watches people daily remove my one-to-one correspondence from their spam folders. And yet, most (but not all) new gmail recipients will not see my emails until they remove them from their spam folder. Google does not want people to self-provide email and there is no incentive for them to do so.

dnsbl.info reports that 69.43.165.11, MX for mail.rsync.net, is blacklisted by ips.backscatterer.org: http://www.backscatterer.org/?ip=69.43.165.11 I suggest fixing your SMTP server configuration [1][2] and maybe listing your IP on dnswl.org. (edit: I see you did the latter.) [1]: http://www.backscatterer.org/index.php?target=bounces [2]: https://web.archive.org/web/20140215064312/http://spamlinks....

That's the rsync.net mailserver and that's interesting, thank you.

However I was speaking of my own, personal mailserver, which is not listed.

Also - do we really think "big email" (like google) are using either of these (blacklist or whitelist) services ?

Re: Adding a phone number to your Google account can make it less secure

#288

Post by baybal2 »

This is how Russians hacked social media accounts and public emails of British MPs last year.

It is assumed that they procured IMSI IDs of MPs from open sources (databases of gaming companies (this why Google lets apps to read your IMSI) or advertising cookie brokers).

Then, they used Russian cell phone networks to announce a “Roaming transfer” of their phone numbers from BT to them and then used an “SMS login” and password recovery from their Snapchats/Twitters/Whattsups. Once they logged into them, it is believed that they downloaded past conversations and other data through synchronisation APIs.

Back then, Google only confirmed that they did sent a recovery SMS to one account, but hackers didn’t manage to answer a security question. This probably deterred them from attempting to try the same trick on Google accounts of other MPs whose numbers they pwned, or maybe Googlers simply made that up to cover their asses.

Amazingly, many cell operators don’t check the digital signature on roaming requests, nor require the roaming counter-parties to pass them through.

Re: Adding a phone number to your Google account can make it less secure

#289

Post by baybal2 »

givinguflac wrote: post #108
eveningcoffee wrote: post #20

Earlier quoted context omitted.

I did it. Then they banned it. Having my phone number or any other hard identifier is none of Googles business.

I have a google account without a phone number, but it's always been that way so they probably aren't going to ban me... I hope at least until I finish migrating

They do that if:

1. You don't log in from a first world IP (the terminology from their user operations team), but previous logins were from them.

2. You registered from an IP in a country where they don't have access to sending SMS, but they go to a country where they have.

3. Bot detection algo flagged you, and bot detection algo are one of their crown jewels that they don't tell to support people.

Re: Adding a phone number to your Google account can make it less secure

#290

Post by cmdrfred »

rsync wrote: post #286
twr wrote: post #212

Earlier quoted context omitted.

dnsbl.info reports that 69.43.165.11, MX for mail.rsync.net, is blacklisted by ips.backscatterer.org: http://www.backscatterer.org/?ip=69.43.165.11 I suggest fixing your SMTP server configuration [1][2] and maybe listing your IP on dnswl.org. (edit: I see you did the latter.) [1]: http://www.backscatterer.org/index.php?target=bounces [2]: https://web.archive.org/web/20140215064312/http://spamlinks....

That's the rsync.net mailserver and that's interesting, thank you. However I was speaking of my own, personal mailserver, which is not listed. Also - do we really think "big email" (like google) are using either of these (blacklist or whitelist) services ?

I can't tell you what goes on behind the scenes at Google, but I have resolved email issues to gmail by getting removed from blacklists.
Post reply on HN