Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

51–60 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#51

Post by jdavis703 »

keyme wrote: post #25

This doesn't even take into account how inherently insecure are actual mobile networks. Human factor notwithstanding. Using GSM? Your recovery code is sent essentially plaintext over the air. Think you're not using GSM? I'll just follow you around until you are (say, if you go out of town). Since I'm already following you around, maybe I'll just jam your 3G/4G for a minute. Save us the waiting around. Disabling 2G on…

By the time I have you (or anyone else) following me around to hack me, I've got way bigger problems than loosing my Gmail account.

Re: Adding a phone number to your Google account can make it less secure

#52

Post by AnonCoward1 »

sumitgt wrote: post #32

As a Project FI user, not an option unfortunately.

Yet one would suspect that Google, being both your telecom provider AND your email provider, would be less vulnerable to social engineering targeting one of their two services by means of the other.

Re: Adding a phone number to your Google account can make it less secure

#53

Post by kej »

AdmiralAsshat wrote: post #17
nchelluri wrote: post #6

What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I find it far simpler to make a secure backup of the authenticator QR code than it is to save all of the one-time backup codes.

Re: Adding a phone number to your Google account can make it less secure

#54

Post by 1457389 »

badminton1 wrote: post #49
exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

You know, you can see articles where people report social engineering attacks on Amazon customer service and extract a great deal of information from them. Having a human involved is not necessarily a solution, can be another attack vector.

Nice binary logic there. It's an attack vector therefore it can't be a solution to customer problems. The issues here are orthogonal.

Re: Adding a phone number to your Google account can make it less secure

#55

Post by CobrastanJorji »

AdmiralAsshat wrote: post #17
nchelluri wrote: post #6

What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I keep them in LastPass, along with the passwords themselves. That does make LastPass a single point of failure for me, but I know myself and know that I'm not gonna remember where I put all of my one time recovery codes.

Re: Adding a phone number to your Google account can make it less secure

#56

Post by StavrosK »

zitterbewegung wrote: post #2

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

A solution would be to not add a phone number, and store the password in a password database instead.

Re: Adding a phone number to your Google account can make it less secure

#57

Post by tn13 »

seanwilson wrote: post #28
exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

> Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Google would obviously start losing money though if people perceived Gmail as easy to hack.

The alternative being ?

Re: Adding a phone number to your Google account can make it less secure

#58

Post by hughes »

lukasb wrote: post #40
wfunction wrote: post #30

Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now…

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

I get notifications about that from Facebook sometimes. It is a bit unnerving to hear that someone is attempting to repeatedly log in with my email address, but it certainly prompts me to make sure my accounts are locked down well.

Re: Adding a phone number to your Google account can make it less secure

#59

Post by badminton1 »

1457389 wrote: post #54
badminton1 wrote: post #49

Earlier quoted context omitted.

You know, you can see articles where people report social engineering attacks on Amazon customer service and extract a great deal of information from them. Having a human involved is not necessarily a solution, can be another attack vector.

Nice binary logic there. It's an attack vector therefore it can't be a solution to customer problems. The issues here are orthogonal.

Just saying that, in this article telcos are the weakest link. In some other cases customer support has been the weakest link.

Re: Adding a phone number to your Google account can make it less secure

#60

Post by jcoffland »

> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change in recovery email, name, and two-factor-auth settings, coupled with a “my account has been compromised” help request is highly suspicious.

This series of events could easily occur in legitimate cases. Say you lose or destroy your cellphone. Since you only ever logged in via your phone you don't know the password. Your recovery email was attached to a service you don't use because you normally use gmail. I'm not saying this scenario is a good idea just that it's probably quite common.

As a software developer I often hear from well meaning users that are appalled that software didn't do-the-right-thing in some complex scenario that appears to have an obvious solution because the desired outcome in obvious. In reality, handling the corner cases is complex. Adding these obvious solutions to the code easily leads to even worse situations.

Post reply on HN