3 ms·
In his learning he is missing the biggest mistake: resetting the email account by sms 2FA and all are secure enough, the problem for him was that his mobile ph
by tpetry 7y ago
In his learning he is missing the biggest mistake: resetting the email account by sms
2FA and all are secure enough, the problem for him was that his mobile phone number was the only thing needed to gain access because the attacker wad (1) able to reset the password for the mail account by sms and (2) 2fawas sms based.
There should be _absolutely no_ way of resetting the password of your mail account besides some pregenerated tokens you are keeping safe somewhere.
- antimora 7y agoI just tried and confirmed Gmail requires a recover phone number or email for standard set up. And Gmail gives you an option to recover with SMS =\
- idlewords 7y agoThere are two places in Gmail where you might have your phone number. The first is in 2FA options, and it's easy to delete if you add TOTP or a security key. The second is "recovery phone number" in a different settings pane. That one is easy to miss!
- gniv 7y agoFirst thing I did after reading the article was to check the recovery options of my gmail account. Here's a direct link, takes one minute to audit yours: https://myaccount.google.com/u/0/security?hl=en https://myaccount.google.com/u/0/security?hl=en