4 ms·
So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Gol
by pascalxus 9y ago
So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Golden:
1. Do NOT secure your sensitive accounts (facebook, primary email, bank accounts, twitter, etc) with your telco phone #. Telco Phone number is NOT secure!
"Create a brand new Gmail email account. Do not connect it to any of your existing email accounts. (When signing up for a new Gmail, you don’t need to enter a phone number or current email, although there are fields for you to do so. Leave them blank.) Once you’ve created the new island-unto-itself email address, create a new Google Voice number." Use this Google Voice # to secure your primary accounts, and don't have your telco # listed in any of those accounts.
But, make sure your New Gmail account is super secure, with a security key, as mentioned in the article.
2. Check the password recovery methods for all your sensitive accounts and make sure the answers aren't duplicated from any other site. Actually, it's best to remove them, if you can.
If any security experts want to chime in, please do.
- txmx2000 9y agoOr use a Google Voice number to setup 2FA on the same account. That way you can only ever login if you have a device on your person already logged in. If somehow you're away from technology long enough that all your devices are locked, use a printed backup code to unlock one.
- pascalxus 9y agoBut, if you use Google Voice number on your other Gmail account, they say it's not recommended because you can get locked out of both. I think you can use Google Voice number on everything other than your main Gmail account. So, to be extra safe, after you've set up your 2FA for gmail, make sure to change your recovery phone # to something other than your main telco or google voice number.
- deleted 9y ago[deleted]
- txmx2000 9y agoSame account. You can use the Google Voice number to 2FA its associated gmail account. A printed backup key will protect you from getting permanently locked out. But nobody will be able to login without physical access to your device or printed key. This is how 2FA was meant to work. It should always require a physical device only you have access to. Otherwise it's just using 1FA two times.
- davchana 9y agoSomewhere on YouTube somebody got locked from his google account while streaming live because of similar setup as your suggestion, Google 2fa codes to Google voice, and the look on the face when he realised it was hilarious. Not sure, but maybe he sorted it out somehow.
- 0xfeba 9y agoUse Google Authenticator or any other time-based token app. Print out the private key, store in a safe. Also print out extra codes and also put in a safe.
- weinzierl 9y ago> When signing up for a new Gmail, you don’t need to enter a phone number This is not true in general. It probably at least depends on the country you try to sign-up from probably other factors.
- kbart 9y agoGmail didn't mandate phone number the last time I created dummy account (~1 month ago). I don't have phone number linked even with my primary account.
- weinzierl 9y agoI don't doubt that. In my experience sometimes a phone number is required and sometimes not. When it prompted for a phone I didn't find a way to work around that.
- FabHK 9y agoI find that when I create a dummy account from a clean browser (no cookies) with a VPN, a phone number is required. I wouldn't be surprised if they do some internal risk/dodginess assessment based on several factors.
- eikenberry 9y agoCan you then remove it after the fact? I was able to remove the phone number from my account without it complaining.
- creepydata 9y agoThey do sometimes though depending on how "risky" they deem you based on a secret criteria. I've never been able to bypass their phone number requirements.
- TorKlingberg 9y agoIt seems Google Voice is US only, and a bit abandoned. From the UK, the website throws various errors, and searching for "Google Voice" in Apple's App Store just shows spam apps.
- tokenizerrr 9y agoSame for NL. I keep hearing it getting mentioned, but the website is completely nonfunctional and makes little sense.
- tjbiddle 9y agoNot abandoned - The past year Google has been pushing updates; including a new websites and mobile apps (finally)!
- jdeibele 9y agoYes, it's nice to see signs of life. I, like many people, have been afraid it would go the way of Google Reader. Too bad they really dumbed down the interface - it's not possible to delete messages from the new site.
- rsync 9y ago"Once you’ve created the new island-unto-itself email address, create a new Google Voice number." Use this Google Voice # to secure your primary accounts, and don't have your telco # listed in any of those accounts." The problem with this otherwise good idea is that google will not allow you to keep this account as an island. Eventually you will get the "we've noticed something suspicious about your account" dialog which requires entering some other, unrelated phone number. You're locked out until you do so. The suspicious behavior is, of course, signing up without a live phone number. Ironically, they will accept any number you input with no verification that it is related to the account in any way. They just want to see a live, carrier number input. (This has been my experience from within the US)
- shostack 9y agoWhat an interesting way of increasing phone number data conversion rates.
- klez 9y agoTwitter does that too. At some point I created another account without specifying a phone number, posted a tweet from there and next thing you know they are flagging it for suspicious activity and asking for my phone number to unlock the account.