3 ms·
Few people seem to realize that if you loose access and they restore you access with limited information, then any attacker could do the same. If you care abou
by jopsen 9y ago
Few people seem to realize that if you loose access and they restore you access with limited information, then any attacker could do the same.
If you care about your Google, GitHub, Dropbox, Amazon, PayPal accounts the you should sign up for 2FA.
Ideally, you should have one-time recovery codes printed and U2F or TOTP when U2F isn't available.
I keep all of my TOTP tokens on my yubikey which also does the U2F magic. And of course I have a back up.
But if you don't care to setup 2FA, well, I can see how it's better for Google to lock you out as oppose to locking someone else in.
- sandywotsits 9y agoI agree. It seems that the author of the article didn't know the password, had requested new passwords multiple times, and hadn't protected the account in any significant way. This, presumably, was the red flag for the automated system. It would be interesting to know by how much each extra security step strengthens an account. I would also be interested to know if regular payment (for storage, for example) provides an additional 'trust' signal to Google.