7 ms·
Dude needs a Yubikey. Don't have your phone number on a gmail account. https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/r
by idlewords 9y ago
Dude needs a Yubikey. Don't have your phone number on a gmail account.
https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm
- zurn 9y agoIronically Google's Yubikey implementation requires you to register a phone number to your Google account, which many people don't want to do.
- idlewords 9y agoYeah, it's a big flaw in the setup. The instructions I linked have users add it temporarily, to unlock the rest of the options, and remove it afterwards.
- yakult 9y agoOnce you've added it, it's google's forever and you've only got their word that they've 'deleted' it. I bet it's still available with a warrant.
- blfr 9y agoThe problem isn't that Google knows your phone number but that they will use it (or more precisely the attacker will use it after redirecting your texts) for account recovery which you can prevent by removing the number.
- mtgx 9y agoYes, and Facebook and Dropbox have enabled Yubikey/U2F support in the same way. It's stupid and it gives you a false sense of security (because you're using hardware tokens, which you'd expect to be more secure).
- idlewords 9y agoOn Facebook, you can subsequently take your phone number off.
- TotallyHuman 9y agoOnly an Id10t would think it's actually deleted from FB-data logs.
- aptwebapps 9y agoThe point is that it's no longer an attack vector. Wrt privacy, sure, it's probably still there.
- msh 9y agoOr just Google authenticator without a phone number. You can still be phished but it's better than sms.
- idlewords 9y agoVery true, but I don't think it's possible to have an authenticator-only 2FA setup on Gmail. They make you keep the phone number on it.
- simonista 9y agoThis seems to have changed recently. You can now remove the phone as soon as you add authenticator as an option.
- joejoebob 9y agoI'm pretty sure you can remove your number after setting up 2FA.
- deleted 9y ago[deleted]
- msh 9y agoI have that setup currently. I needed a phone number initially but could remove it after setting up authenticator.
- ufmace 9y agoI just removed my phone number, actually, after seeing news of these hacks. Seems to work fine, I guess if you already have Authenticator set up.
- michaelisaok 9y agoEven though you can remove SMS as a 2FA, it looks like Google still asks for an email and phone for "Account recovery options". Probably should remove that as well?
- dghughes 9y agoOr create an email account. It's impossible to sign up to any web email service to be able to send email not just receive if you don't have a phone. I needed an untraceable email to send from for reasons I won't go into but couldn't create one. If you're poor but need a webmail account you need a phone. You can't even put in a fake number since you need to reply to the approval link setup email. Gmail, Outlook, Yahoo, everyone one I tried all require a phone.
- ikeboy 9y agoPay someone on fiver with bitcoin to give you a few email accounts. Problem solved. (Make sure to use Tor and mix the coins.)
- kevin2r 9y agoRecently I was able to create a "test" gmail account without using a phone number, just leave the fields blank and hit continue.
- palunon 9y agoThey may allow you to do that. If you are on an IP that they deem not trustable enough, like if you are on a dynamic IP or come from the wrong country, they'll refuse to create the account without some phone verification (to hinder spammers)
- tptacek 9y agoYes, you should. They demand phones because normal users who aren't being guided through the setup would be likely to lock themselves out of their account without it, but if you know what you're doing you can eliminate the phone dependency.
- rnhmjoj 9y agoI wouldn't recommend it after this: https://news.ycombinator.com/item?id=11690774 https://news.ycombinator.com/item?id=11690774
- bigtones 9y agoI don't get it. Asking for civility in a public forum is not a bad thing (HN does it sometimes), and certainly not a factor you should be taking into account when evaluating security devices.
- idlewords 9y agoIf you have a beef with Yubico, get a U2F token from a different manufacturer. The important thing is to get one.