Two factor auth using SMS us increasingly becoming a risky option. For not I have it on my personal accounts, but I'm considering changing over to Google Authenticator.
Adding a phone number to your Google account can make it less secure
61–70 of 299 posts
Re: Adding a phone number to your Google account can make it less secure
#62Earlier quoted context omitted.
I can confirm that that's what happens to your account when you dont have 2FA enabled. Can you double check your settings?
I'm on mobile right now, and I don't see a way to check 2FA status from within the Gmail app. I can confirm that I've had it set up correctly before, as I've received an authentication code from Google as recently as September 28.
You should be able to visit https://myaccount.google.com in a mobile browser to check your 2FA setting.
Re: Adding a phone number to your Google account can make it less secure
#63i always failed to see why adding a phone number would be somehow more secure. However, i also knew this kind of attack was somewhat common for German online banking accounts using SMS TAN because service providers were easily convinced to send a new (second) sim card to a new address they would never heard of before.
Re: Adding a phone number to your Google account can make it less secure
#64Does anyone know anything about the security with regard to using other providers (e.g. twilio or google voice) as a recovery number? Let's say my recovery number is actually a google voice number that's connected to a separate google account, but not forwarded to my actual cellphone (i.e., I'd have to login to my other google account to view the recovery code). Thoughts?
The specific flaw exposed in this story is not exploitable with providers like Twilio and Google Voice, because they don't assign phone numbers to devices with SIM cards.
Verizon is the bad guy here, since they agreed to re-route SMS traffic from the account holder's device to a new device without properly confirming that the request was coming from the account holder.
Technically there's nothing stopping a motivated attacker from attempting the same social engineering attack against a Twilio or Google Voice number, but getting those providers to re-route SMS isn't as simple as just calling and saying "my iPhone broke, I need you to assign my number to my new phone" like you can with Verizon.
The attacker would need to know some particulars of the SMS routing protocols of Twilio and Google Voice to achieve a similar result.
Re: Adding a phone number to your Google account can make it less secure
#65> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…
This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people. It's hard to justify Gmail these days other than the frustration of migrating off of it. As a side perk, Australia has no equivalent to a National Security Letter,…
Hopefully NSLs will be eventually ruled unconstitutional in the U.S. also.
Re: Adding a phone number to your Google account can make it less secure
#66Kind of related, but any Googlers here? Can you please make Google send notifications whenever someone tries to log in to an account and is required to do anything other than typing in their username/password? I REALLY should know when someone is trying to respond to a 2FA prompt or answer my security questions or use SMS or email to reset my password... it's ridiculous that these don't all result in emails right now…
I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?
> We do send an email when you log in from a new device.
AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...
Re: Adding a phone number to your Google account can make it less secure
#67What I recall reading over the last year is that: - phonelines can be hijacked (this article) - DNS can be hijacked in a similar manner - SMS can be hijacked (for 2FA via text message) I guess 2FA using an authenticator app is the way to go for now. Do you guys agree with the removal of backup phone numbers recommended here? Seems reasonable to me but scary; I've lost my phone(s :( ) before. I do have backup codes ge…
The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…
> If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now.
It seems unnecessary (and easy to lose) to carry them around in your wallet. I print them out, and leave them in an envelope at my parents' house.
Re: Adding a phone number to your Google account can make it less secure
#68It's not the first time that Verizon transfers an account like this...
Have a look at this other story from last month, "On Phone Numbers and Identity":
- https://medium.com/the-coinbase-blog/on-phone-numbers-and-id...
- https://news.ycombinator.com/item?id=12597609
"It turns out the attacker was able to impersonate the employee on a call with Verizon"
Re: Adding a phone number to your Google account can make it less secure
#69Can Americans explain me how can you just do things like that by calling customer support? Wouldn't it make more sense to go and show your ID if you want to make changes like that?
In your call with customer support, questions are asked to verify your identity. They aren't as accurate as physically showing your ID, however. Not that I'd want my ID digitized though.
>Not that I'd want my ID digitized though.
Not that it isn't already. Every state's DMV has it, and there must be some kind of database/API that allows law enforcement to access it.
Re: Adding a phone number to your Google account can make it less secure
#70What are the security implications of using my google voice number as a backup phone number to my google account (the same account)? I've been doing this for a few years, and its been very convenient. Basically, any time I need to log in with a new browser or device, using the number for two factor SMS gives me codes on all other logged in gmail windows, and on my phone.
I do this too, but it's circular. So there is a pretty significant risk of getting locked out entirely if your authentication tokens for your Google account expire on all devices at the same time.
Yes, that's unlikely. But if it happens, we're screwed.
A better option would probably be to set up two Google accounts with two Google Voice numbers and use them to cross-validate each other. I think I'll go do that now.