Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

71–80 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#71

Post by hash-set »

I always thought Google was trying to tie your gmail account back to a cell phone number so they could help end anonymity on the Internet. Or else give the information to the NSA or something. I'm trusting Google less and less these days.

At the very least, Google should not have come out in favor of a particular Presidential candidate. Corporations have become incredibly powerful entities, able to affect the lives of all their employees and many others. If they can't wield this power ethically, they need to be shut down or we risk suffering under fascism.

Re: Adding a phone number to your Google account can make it less secure

#72

Post by vijayp »

jcoffland wrote: post #60

> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change in recovery email, name, and two-factor-auth settings, coupled with a “my account has been compromised” help request is highly suspicious. This series of events could easily occur in legitimate cases. Say you lose or destroy your cellphone. Since you only ever…

Yeah, I could believe that it would create too many false positives and in retrospect things do often seem easy.

Google and other service providers do have data to evaluate the benefit and cost of making decisions based on patterns, and they probably do.

Re: Adding a phone number to your Google account can make it less secure

#73

Post by jandrese »

jcoffland wrote: post #60

> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change in recovery email, name, and two-factor-auth settings, coupled with a “my account has been compromised” help request is highly suspicious. This series of events could easily occur in legitimate cases. Say you lose or destroy your cellphone. Since you only ever…

At the very least, any change to the email address should send out an email to the old address stating "If you didn't make this change, click on this link to have your account frozen until you do a password reset."

It's silly to depend on an email for authentication, then allow the hacker to just delete the email address before they change the password. Giving the old address the right of first refusal defeats that kind of attack and should be dead simple to implement since the framework was already laid down for the "verify your email" step during setup.

Re: Adding a phone number to your Google account can make it less secure

#74

Post by vijayp »

CobrastanJorji wrote: post #55
AdmiralAsshat wrote: post #17

Earlier quoted context omitted.

The problem with the backup codes is that I have so many now. Pretty much a list of codes for every account I have 2FA enabled on (about a dozen). If I actually printed them out and kept them in my wallet, my wallet would be overflowing by now. Authy has been a great improvement over Google Authenticator for me. I primarily used it when I migrated phones for the upteenth time, but were I to lose my phone, I could als…

I keep them in LastPass, along with the passwords themselves. That does make LastPass a single point of failure for me, but I know myself and know that I'm not gonna remember where I put all of my one time recovery codes.

Yeah, I'm also scared of LastPass being a SPOF. While LastPass does do a good job, no one is perfect, and the cost of having my account compromised is really high

I'm now leaning towards encrypting backup codes with a passphrase and putting the encrypted blobs in LastPass. I haven't actually done this but as long as I don't forget the second passphrase, that might work…

Re: Adding a phone number to your Google account can make it less secure

#75

Post by balls187 »

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account.

She went with my knowledge, but TMobile never called to confirm.

After which my phone no longer had service, and I had to install a new sim card prior.

While she did this with my knowledge, I no longer have access to make changes to the account, until she adds me to the list of authorized people, and I lost all my voice mail.

It's very disturbing that she could do this, without any sort of checks and authorization.

Also, FWIW, my wife and I do not share a last name, and she did not provide anything other than my phone number to TMobile. She was a new Tmobile customer, and I was an existing customer, albeit on a very cheap pre-paid plan.

Re: Adding a phone number to your Google account can make it less secure

#77

Post by jandrese »

wfunction wrote: post #66
lukasb wrote: post #40

Earlier quoted context omitted.

I work at Google (I don't work on this stuff though, so I'm basically just another random commenter.) We do send an email when you log in from a new device. What would you do if you got an email about failed attempts to login / reset password?

> We do send an email when you log in from a new device. AFTER login? or before? I need to know when someone is trying to attack me, not when they've already succeeded. Otherwise what's the point? At least if I know beforehand that someone knows my password but failed OTP check then I can change my password, right? Why does Google not tell me when this happens? It's like common sense...

On the Internet? You'll get alerts that people are trying to hack you every single day. There are whole botnets that go around just trying to authenticate to everything everywhere using usernames sniffed from other hacks and every password under the sun.

Re: Adding a phone number to your Google account can make it less secure

#78

Post by antocv »

jasonjayr wrote: post #29
x1798DE wrote: post #4

I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…

I've several children, and can no longer make Google accounts for their Chromebooks. All the phone numbers I have and control can no longer be used to register further accounts. What happens to users that buy a new Android cell phone who's number has been burned by Google?

This is the time to get to know https://mail.yandex.com

Seriously, the interface is so much better than todays gmail, its astonishing. There is no spam either, and no ads.

Re: Adding a phone number to your Google account can make it less secure

#79

Post by vijayp »

zitterbewegung wrote: post #2

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

That's a good point. Though I think it would be challenging to have a phone number that no one knows which you also carry around with you.

It's possible if you use something like Google Voice for most of your regular calls, but you still need to make sure that the telco can't tie your name to your number…

Re: Adding a phone number to your Google account can make it less secure

#80

Post by phs318u »

mahyarm wrote: post #44
marco1 wrote: post #26

Earlier quoted context omitted.

> This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. Can absolutely confirm that. However, there's place for both Gmail and FastMail. Just know what you pay and what you're entitled to get for that price.

For me the issue is transitioning from something like gmail to my own email. I've had the account for 12 years at this point.

I'm in a similar boat. I've used Gmail since its first year in operation. I started transitioning off it earlier this year, keeping it running as I've slowly migrated the vast number of web accounts that use my Gmail address as an ID, to use the new email address. With the benefit of hindsight I see that I should have registered my own domain and used that for all web registrations. Oh well. The final step will be to migrate my archive. I hope to be done by Christmas at which point I will strip all details from my account and then delete it.
Post reply on HN