4 ms·
Ironically Google's Yubikey implementation requires you to register a phone number to your Google account, which many people don't want to do.
by zurn 9y ago
Ironically Google's Yubikey implementation requires you to register a phone number to your Google account, which many people don't want to do.
- idlewords 9y agoYeah, it's a big flaw in the setup. The instructions I linked have users add it temporarily, to unlock the rest of the options, and remove it afterwards.
- yakult 9y agoOnce you've added it, it's google's forever and you've only got their word that they've 'deleted' it. I bet it's still available with a warrant.
- blfr 9y agoThe problem isn't that Google knows your phone number but that they will use it (or more precisely the attacker will use it after redirecting your texts) for account recovery which you can prevent by removing the number.
- mtgx 9y agoYes, and Facebook and Dropbox have enabled Yubikey/U2F support in the same way. It's stupid and it gives you a false sense of security (because you're using hardware tokens, which you'd expect to be more secure).
- idlewords 9y agoOn Facebook, you can subsequently take your phone number off.
- TotallyHuman 9y agoOnly an Id10t would think it's actually deleted from FB-data logs.
- aptwebapps 9y agoThe point is that it's no longer an attack vector. Wrt privacy, sure, it's probably still there.