Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a phone number to your Google account can make it less secure

tech.vijayp.ca

Post reply on HN
Print view View original

81–90 of 299 posts

Re: Adding a phone number to your Google account can make it less secure

#81

Post by drodgers »

ocdtrekkie wrote: post #18
exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

This is why last weekend I moved to FastMail. I've filed two support tickets since, and both were responded to in an hour or two. For the trivial cost of half a Netflix subscription, the most vital thing I have on the Internet is supported by real people. It's hard to justify Gmail these days other than the frustration of migrating off of it. As a side perk, Australia has no equivalent to a National Security Letter,…

> As a side perk, Australia has no equivalent to a National Security Letter, and FastMail is able to hence notify me of any government requests for access to my data.

Unfortunately we've got something pretty close: ASIO can designate any of its activities to be part of a Special Intelligence Operation at will, which makes any disclosure of the operation or its components into a crime (10 years jail if it 'endangers' the operation).

http://www.abc.net.au/news/2014-10-14/journalists-face-jail-...

Re: Adding a phone number to your Google account can make it less secure

#82

Post by jakub_g »

exelius wrote: post #39
seanwilson wrote: post #28

Earlier quoted context omitted.

> Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Google would obviously start losing money though if people perceived Gmail as easy to hack.

Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" It's called externalizing your costs, and Google is exceptionally good at it.

No one is perfect, but IMO when it comes to security, Google goes to great lengths to make stuff in the web secure, probably the most from all the bigcorps out there.

They are very aggressive about fixing TLS/SSL-related issues (finding and fixing vulnerabilities, deprecating old ciphers, promoting new stuff like cert pinning and HSTS, lowering SERPs in Google for non-https websites; they've also put in place means to detect and report fraudulent HTTPS certs, and many more).

Many of the top security researchers work for Google, and many of them even not on things directly related for Google's daily businesses.

If I'd have to say about some bigcorp that they don't care about security, Google would be the last on this list.

Google customer support is totally another pair of shoes though.

Re: Adding a phone number to your Google account can make it less secure

#83

Post by vijayp »

balls187 wrote: post #75

Recently my wife, without any identification, went to Tmobile and was able to have my account automatically canceled and added to a new joint family account. She went with my knowledge, but TMobile never called to confirm. After which my phone no longer had service, and I had to install a new sim card prior. While she did this with my knowledge, I no longer have access to make changes to the account, until she adds m…

Yeah, a couple of years back, I went to a t-mobile store (I think it was on Broadway and Park Pl) to get a new SIM card; I'd lost it in Europe when I was on holiday. They gave me a new SIM card and let me pay cash without even checking my ID…

Re: Adding a phone number to your Google account can make it less secure

#84

Post by x1798DE »

vonklaus wrote: post #13
x1798DE wrote: post #4

I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…

I think the main issue is that google doesn't accept certain senders anymore. As a generic thread about running a mailserver/mail service pops up here often. That means users are shoveled into about one of 4 "acceptable" providers which have control of the entire market. They demand, full name and usually gender, mobile, alternative email and more. So you get pushed into their information pipeline to stop "spam".

It certainly could be an issue, but honestly even if it were possible to set up my own mail server, that's even worse for pseudonymity than a google account because ICANN records are public and I'd be the only one using my domains. It would make it much easier for some random person to uniquely identify me, which is a worse threat than Google identifying me by my phone number. This is one of those situations where anonymity loves company.

Also, the problem is not limited to e-mail. There are some non-email services from Google. I'd be perfectly happy to sign up for a Google account where you can't send e-mails, or where you can only send e-mails to people who have sent you e-mails.

Re: Adding a phone number to your Google account can make it less secure

#85

Post by kibwen »

aiiane wrote: post #62
kibwen wrote: post #45

Earlier quoted context omitted.

I'm on mobile right now, and I don't see a way to check 2FA status from within the Gmail app. I can confirm that I've had it set up correctly before, as I've received an authentication code from Google as recently as September 28.

You should be able to visit https://myaccount.google.com in a mobile browser to check your 2FA setting.

Aha, thanks, that does indeed say that 2FA is disabled. But I'm seriously baffled as to how it became disabled, as I absolutely enabled it previously and have been receiving 2FA verification codes via text since at least May 2015. Is there some way of accidentally disabling 2FA for Google accounts? I haven't gotten a new phone for years, and I've made no other changes to my Google account for as long.

Re: Adding a phone number to your Google account can make it less secure

#86

Post by vonklaus »

hash-set wrote: post #71

I always thought Google was trying to tie your gmail account back to a cell phone number so they could help end anonymity on the Internet. Or else give the information to the NSA or something. I'm trusting Google less and less these days. At the very least, Google should not have come out in favor of a particular Presidential candidate. Corporations have become incredibly powerful entities, able to affect the lives o…

Don't understand the downvotes. Thought this was widely acknowledged.

Re: Adding a phone number to your Google account can make it less secure

#87

Post by gist »

exelius wrote: post #39
seanwilson wrote: post #28

Earlier quoted context omitted.

> Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Google would obviously start losing money though if people perceived Gmail as easy to hack.

Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" It's called externalizing your costs, and Google is exceptionally good at it.

> Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!"

No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to matter.

Re: Adding a phone number to your Google account can make it less secure

#88

Post by keyme »

jdavis703 wrote: post #51
keyme wrote: post #25

This doesn't even take into account how inherently insecure are actual mobile networks. Human factor notwithstanding. Using GSM? Your recovery code is sent essentially plaintext over the air. Think you're not using GSM? I'll just follow you around until you are (say, if you go out of town). Since I'm already following you around, maybe I'll just jam your 3G/4G for a minute. Save us the waiting around. Disabling 2G on…

By the time I have you (or anyone else) following me around to hack me, I've got way bigger problems than loosing my Gmail account.

I don't know.

I can imagine you saying the same thing about the case in OPs article.

The attack was targeted. The attacker knew your name, phone number and email address. The attacker went through some real effort to hack you (SEing reps, buying SIMs, burner iPhone, taking some risk).

How much further do you think they were willing to go? Not enough for a $200 plane ticket?

You have a problem the moment someone capable has targeted you. For the attacker, is just a matter of choosing the easiest attack vector. Today it was Verizon reps. Tomorrow it may get a bit more difficult.

Re: Adding a phone number to your Google account can make it less secure

#89

Post by jasonjayr »

antocv wrote: post #78
jasonjayr wrote: post #29

Earlier quoted context omitted.

I've several children, and can no longer make Google accounts for their Chromebooks. All the phone numbers I have and control can no longer be used to register further accounts. What happens to users that buy a new Android cell phone who's number has been burned by Google?

This is the time to get to know https://mail.yandex.com Seriously, the interface is so much better than todays gmail, its astonishing. There is no spam either, and no ads.

The email account is not the issue; I run my own email server with all the fun that brings.

It's that the Chrome Books really need separate Google accounts otherwise, settings + notifications to end up replicated to all of them.

And yes, I have a greater than average number of children. I feel as if the only way forward is to purchase a google for business account, and add them all there :-/

Re: Adding a phone number to your Google account can make it less secure

#90

Post by FullMtlAlcoholc »

>Eventually, with the help of Google’s customer support

That he was able to contact someone at customer support for his Gmail account was the most amazing thing in this article!

> and some ex-colleagues who still work at Google,

:( That's why

Post reply on HN