Adding a phone number to your Google account can make it less secure • Hacker News Board

Re: Adding a phone number to your Google account can make it less secure

#91

Post by throwanem » Thu, Oct 20, 2016, 9:02 PM UTC

djsumdog wrote: post #35

x1798DE wrote: post #4

I don't think it's possible to make a Google account without a phone number anymore. It's really unfortunate, especially because I deliberately don't set up fallback contacts for my "alternate" gmail accounts, and Google keeps locking them as suspicious when I log in from a second location, and I need to "verify" with a phone number any time that happens (at which point I abandon the account). I understand that they…

I never put in my number into my Google account. Ironically, the only US number I have is via Google voice/hangouts. So they have it. It's just not associated. I'm not even sure if it would be allowed, as there'd be no way to use it as a 2-factor auth without actually being logged in.

I recently tried doing exactly that, and got back something like "This is not an acceptable verification number" with no further explanation.

Re: Adding a phone number to your Google account can make it less secure

#92

Post by drv » Thu, Oct 20, 2016, 9:03 PM UTC

djsumdog wrote: post #42

vonklaus wrote: post #13

Earlier quoted context omitted.

I think the main issue is that google doesn't accept certain senders anymore. As a generic thread about running a mailserver/mail service pops up here often. That means users are shoveled into about one of 4 "acceptable" providers which have control of the entire market. They demand, full name and usually gender, mobile, alternative email and more. So you get pushed into their information pipeline to stop "spam".

Yep, I wrote one not too long ago: http://penguindreams.org/blog/how-google-and-microsoft-made-... I've been meaning to write a follow up after I met some MailChip devs at a conference. They told me at MailChip they have to slowly spin up new servers, sending e-mail through them slowly so Google registers their new SMTP IPs. The other thing they told me: MailChip owns a /A, and can therefore separately out their serv…

(Assuming you mean MailChimp)

I don't know anything about how MailChimp operates, but a quick search turns up this blog post about how to set up SPF records [1].

From there, you can get a list of which IPs MailChimp authorizes as a sender; following the SPF include directive, you can see they specify two IPv4 ranges, both of which are in class C space, so it seems unlikely that MailChimp has their own class A for SMTP senders.

[1]: https://blog.mailchimp.com/senderid-authentication-for-your-...

Re: Adding a phone number to your Google account can make it less secure

#93

Post by buyx » Thu, Oct 20, 2016, 9:04 PM UTC

SIM swap fraud has been common in South Africa for years, and bank accounts were being cleaned out before the cell networks tightened their procedures. Yet I've started to see reports of similar scams in the developed world.

I'm surprised that anyone is surprised by this. Perhaps the time has come for a more global approach to security.

Re: Adding a phone number to your Google account can make it less secure

#94

Post by mtgx » Thu, Oct 20, 2016, 9:04 PM UTC

Google does another stupid thing (or at least it used to do two years ago, but I think it's still doing it): when you pick Google Auth for 2FA, and for some reason you can't use it, you can still login to your account with an SMS code...

Like WTF Google? Any attacker could just as easily do that, too, anytime they want. As long as this remains true, Google Authenticator (or any other Google security measure that could easily by bypassed this way with SMS) has literally zero advantages over SMS, while retaining the disadvantages of being less convenient to use, etc.

Re: Adding a phone number to your Google account can make it less secure

#95

Post by vijayp » Thu, Oct 20, 2016, 9:04 PM UTC

exelius wrote: post #12

> I'm curious [...] why Google doesn’t temporarily disable accounts so impacted until a human reviews activity. Because Google doesn't have humans reviewing anything unless there's a direct link to marginal revenue/cost avoidance attached to that interaction that can be priced in. Their business model is to achieve scale through automation and machine learning; which means not doing things that would require manual i…

Yeah, maybe human review is not the most scalable solution; if data analysis shows that certain patterns of behaviour are highly predictive of an account takeover, there are almost certainly product solutions for them.

I guess the real question is what the data actually show

Re: Adding a phone number to your Google account can make it less secure

#96

Post by throw7 » Thu, Oct 20, 2016, 9:04 PM UTC

Google seems to think phones are very secure:

https://support.google.com/accounts/answer/183723

Why mobile phones are more secure

Your mobile phone is a more secure identification method than your recovery email address or a security question because, unlike the other two, you have physical possession of your mobile phone.

Re: Adding a phone number to your Google account can make it less secure

#97

Post by knz » Thu, Oct 20, 2016, 9:11 PM UTC

BinaryIdiot wrote: post #46

Sir_Cmpwn wrote: post #7

>Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back. I bet I know which one of these resources was more important.

I bet I know which one of those resources actually exists .

Google's Project Fi has great customer support. You can get someone via IM almost instantly and they also offer phone/email support. As a Fi customer, that would be my first stop if I was locked out.

Good luck if you aren't a paying customer though...

Re: Adding a phone number to your Google account can make it less secure

#98

Post by jakub_g » Thu, Oct 20, 2016, 9:11 PM UTC

zitterbewegung wrote: post #2

Adding a phone number that people KNOW about can make it LESS secure. A workaround is to get a phone number that is only used for identity verification and not given out to anyone.

This works as long as they don't insist on verifying you through that secondary phone number (this is the case for now for Google I think - if something suspicious is going on, they ask you if you want an sms with a verification code, or an email to a secondary address; but maybe not all services with 2FA make this optional).

It's not fun to have 2 phones always with you. But maybe the 2-SIM devices will become more mainstream soon, which can solve this problem.

Re: Adding a phone number to your Google account can make it less secure

#99

Post by dimino » Thu, Oct 20, 2016, 9:11 PM UTC

eveningcoffee wrote: post #20

fullmetaleng wrote: post #16

Earlier quoted context omitted.

When is the last time you tried? I have created a gmail account couple of weeks back without providing phone number and recovery email.

I did it. Then they banned it. Having my phone number or any other hard identifier is none of Googles business.

They didn't ban your account for not having a phone number.

Re: Adding a phone number to your Google account can make it less secure

#100

Post by buyx » Thu, Oct 20, 2016, 9:12 PM UTC

gist wrote: post #87

exelius wrote: post #39

Earlier quoted context omitted.

Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" It's called externalizing your costs, and Google is exceptionally good at it.

> Right; so instead they've built their security model around assumptions that other companies' (namely telcos) account processes are secure. That way Google can say "it's not our fault; we can't do anything about it!" No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to matter…

No, they've built their model on the fact that for the vast majority of their users this will never be an issue. Maybe a celebrity, maybe an important target but the average user, never going to be an issue.

Email is the gateway to almost everything else. It's used for account recovery as well as (wrongly) passwords and other sensitive information. Google Drive and docs would also be compromised.

It's actually a bigger issue that you would think.