4 ms·

To avoid such things, I have a notebook in my drawer in which I have all the passwords to all my online accounts written down. If I change a password, I update

To avoid such things, I have a notebook in my drawer in which I have all the passwords to all my online accounts written down. If I change a password, I update the entry. If I create any sort of online account, it gets added to the diary. I figured if someone bothered enough to physically steal my diary from my drawer, I'd have bigger problems to worry about than my YouTube credentials.

jstarfish 9y ago
I'm currently locked out of a Gmail account I have the password for but Google decided that isn't enough; it doesn't like my IP address and wants me to verify against a phone number I no longer have.
- BenjiWiebe 9y ago
  So I guess the diary should include a history of phone numbers. And maybe addresses to be safe.
  - nasredin 9y ago
    ...And the IP you used to sign up... and the city for that IP in the geolocation database at that specific date... and the exact User Agent string... and the time zones... and... Or maybe they should stop being idiots and allow people with strong passwords to... just use passwords to authenticate. Maybe some type of "I know what I am doing, kindly fuck off Google" option.
    - dingo_bat 9y ago
      > Maybe some type of "I know what I am doing, kindly fuck off Google" option. Tbf if you really knew what you're doing, you wouldn't be using gmail.
      - herewulf 9y ago
        This from the guy with all his passwords in a notebook in the desk drawer.. Have you thought of ROT13 encoding them?
  - jopsen 9y ago
    Just do one-time recovery codes.
- BenjiWiebe 9y ago
  Oh wait, missed that you needed access to the number. I thought it was just prompting you for the number.
- kuschku 9y ago
  > wants me to verify against a phone number I no longer have. I had the same. There's a good chance someone else has that number now - add them on WhatsApp/Facebook Messenger/etc by phone number, Google their number and try to find them, or call them. In my case, I was able to recover the account by communicating with the new owner, and him quickly sending me the 2FA code he got from Google when I tried to log in.
  - _jomo 9y ago
    That would be a clever phishing technique if you know your target no longer owns the number associated with an account.
    - kuschku 9y ago
      That's why it's so insane to consider it a safe 2FA source. 6 months. That's all it takes between the last time a user successfully used a phone number, and a new user getting assigned the same number with prepaid SIMs in Germany. 6 months is a damn short time.
cratering 9y ago
reminds me of this https://news.ycombinator.com/item?id=14714234 https://news.ycombinator.com/item?id=14714234

jstarfish 9y ago

I'm currently locked out of a Gmail account I have the password for but Google decided that isn't enough; it doesn't like my IP address and wants me to verify against a phone number I no longer have.

BenjiWiebe 9y ago
So I guess the diary should include a history of phone numbers. And maybe addresses to be safe.
- nasredin 9y ago
  ...And the IP you used to sign up... and the city for that IP in the geolocation database at that specific date... and the exact User Agent string... and the time zones... and... Or maybe they should stop being idiots and allow people with strong passwords to... just use passwords to authenticate. Maybe some type of "I know what I am doing, kindly fuck off Google" option.
  - dingo_bat 9y ago
    > Maybe some type of "I know what I am doing, kindly fuck off Google" option. Tbf if you really knew what you're doing, you wouldn't be using gmail.
    - herewulf 9y ago
      This from the guy with all his passwords in a notebook in the desk drawer.. Have you thought of ROT13 encoding them?
- jopsen 9y ago
  Just do one-time recovery codes.
BenjiWiebe 9y ago
Oh wait, missed that you needed access to the number. I thought it was just prompting you for the number.
kuschku 9y ago
> wants me to verify against a phone number I no longer have. I had the same. There's a good chance someone else has that number now - add them on WhatsApp/Facebook Messenger/etc by phone number, Google their number and try to find them, or call them. In my case, I was able to recover the account by communicating with the new owner, and him quickly sending me the 2FA code he got from Google when I tried to log in.
- _jomo 9y ago
  That would be a clever phishing technique if you know your target no longer owns the number associated with an account.
  - kuschku 9y ago
    That's why it's so insane to consider it a safe 2FA source. 6 months. That's all it takes between the last time a user successfully used a phone number, and a new user getting assigned the same number with prepaid SIMs in Germany. 6 months is a damn short time.

cratering 9y ago

reminds me of this https://news.ycombinator.com/item?id=14714234 https://news.ycombinator.com/item?id=14714234