How did Verizon move his services to an iPhone 4? Does it mean the attacker had physical access to his phone?
call them up and say you bought a new phone. Give them unique serial number of the phone and tell them to transfer service to it.
Adding a phone number to your Google account can make it less secure
31–40 of 299 posts
Re: Adding a phone number to your Google account can make it less secure
#32As a Project FI user, not an option unfortunately.
Re: Adding a phone number to your Google account can make it less secure
#33How did Verizon move his services to an iPhone 4? Does it mean the attacker had physical access to his phone?
No, they just change in their system the IMEI or ESN that phone number is registered to so all incoming calls and texts start going to the phone the attacker owns. It's just social engineering where you pretend to be the customer and tell them you need to transfer your number to a new phone.
Re: Adding a phone number to your Google account can make it less secure
#34I've also noticed that there's something very surprising about how Google has implemented their 2FA. When I log into Gmail from a new computer, it does not text me an authentication code and then lock me out of the account until I enter the code. Instead it lets me into my account immediately with only a password, and then sends my phone a notification that someone has logged in from a new computer. Ignoring this not…
I can confirm that that's what happens to your account when you dont have 2FA enabled. Can you double check your settings?
Re: Adding a phone number to your Google account can make it less secure
#35I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…
I never put in my number into my Google account. Ironically, the only US number I have is via Google voice/hangouts. So they have it. It's just not associated. I'm not even sure if it would be allowed, as there'd be no way to use it as a 2-factor auth without actually being logged in.
Re: Adding a phone number to your Google account can make it less secure
#36What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…
The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…
Put your recovery codes on an offline SD card somewhere safe in your house. I keep mine in a literal safe.
Re: Adding a phone number to your Google account can make it less secure
#37Phone diversion can also be used to confirm large bank transfers; this happened to a friend of mine in 2012 http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...
Re: Adding a phone number to your Google account can make it less secure
#38I've also noticed that there's something very surprising about how Google has implemented their 2FA. When I log into Gmail from a new computer, it does not text me an authentication code and then lock me out of the account until I enter the code. Instead it lets me into my account immediately with only a password, and then sends my phone a notification that someone has logged in from a new computer. Ignoring this not…
That's not how Google 2FA works; you seem to have misconfigured something. When you actually have 2FA on (like I do), you must enter your one-time code after entering the correct password.
If I've misconfigured something, then it's news to me as to how. I've received 2FA texts from Google before, so I know that it used to work as expected, and I haven't been in my account settings for over a year. If something on my account has changed, then it's been out from under my feet without my understanding as to how.
Re: Adding a phone number to your Google account can make it less secure
#39> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…
> Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Google would obviously start losing money though if people perceived Gmail as easy to hack.
Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!"
It's called externalizing your costs, and Google is exceptionally good at it.
Re: Adding a phone number to your Google account can make it less secure
#40Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now…
I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.)
We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?