4 ms·
You know what's really scary? Gmail is held up as the pinnacle of email security, but they let you reset your password by proving ownership of just a phone numb
by Meekro 11y ago
You know what's really scary? Gmail is held up as the pinnacle of email security, but they let you reset your password by proving ownership of just a phone number!
So much for 2FA. So much for strong passwords. All I have to do is obtain your SSN, call up your cell phone provider and hijack your phone number, and initiate a password reset with Google. That gets me into your Gmail, which in turn gets me into all your other accounts.
Ridiculously easy. Google should be ashamed.
- Moshe_Silnorin 11y agoEven if you use google authenticator?
- Meekro 11y agoYes -- having the "recovery phone number" lets you bypass their google auth two-factor. See more here: [1] https://support.google.com/accounts/answer/183723?hl=en https://support.google.com/accounts/answer/183723?hl=en
- Lx1oG-AWb6h_ZG0 11y agoSurely this is barking up the wrong tree? The problem is with your phone provider allowing anyone to hijack your number. What Google does is entirely reasonable for the vast majority of people. If AT&T fucks up, that's not Google's fault.
- sliverstorm 11y agoIsn't that still kind of 2FA? You have to link a SSN to an email address. physical 2FA always provided less security against people who know you (and thus could easily make that link), because those people have the physical presence to steal your token unlike a hacker in Elbonia.
- markdown 11y agoWoohoo, great slapdown!! ... ... .. Now tell us what they should use instead of phone 2FA?