7 ms·

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30

This. I deal with relatively higher volumes of information that must remain secure. With google, I have hardware authentication device and 10 codes. Every 30 days or so it asks me to plug in the hardware device. Randomly it asks me more often - I have no idea why but no objection. My password is secure as well and only used on google but THANKFULLY I do not need to change it all the time and so I don't have to write it down. This feels like a reasonably secure approach. No SMS text option. The idea that your phone number is the key that allows you to reset all your passwords (no matter how complicated / securing no matter how much sensitive info) is ridiculous.

smitty1e 7y ago
Any redundancy on that piece of hardware? "Two is one and one is none," as the Special Operations folks will explain. Sure, the math is squirrely; but the sentiment is real.
- stouset 7y ago
  The recovery codes.
simonebrunozzi 7y ago
> No SMS text option. ... ridicolous Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0] [0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-2f65c691edf8 https://medium.com/@simon/mobile-twitter-hacked-please-help-...
- senectus1 7y ago
  I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked.. They stole your SIM. SMS option was now in their control. SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.
  - Thorrez 7y ago
    Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.
  - mehrdadn 7y ago
    > sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.
    - petjuh 7y ago
      Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
      - mehrdadn 7y ago
        If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.
      - jvanderbot 7y ago
        No, as other threads have pointed out, SMS is trivially hacked
      - privateSFacct 7y ago
        You do realize that the minimum wage worker at your local phone store can setup a new phone with your number? That they may have friends who they accidentally do this for? That they may not detect the fake ID some random person with your name and number shows them? Etc etc. None of this requires getting your phone.

smitty1e 7y ago

Any redundancy on that piece of hardware? "Two is one and one is none," as the Special Operations folks will explain. Sure, the math is squirrely; but the sentiment is real.

stouset 7y ago
The recovery codes.

simonebrunozzi 7y ago

> No SMS text option. ... ridicolous Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0] [0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-2f65c691edf8 https://medium.com/@simon/mobile-twitter-hacked-please-help-...

senectus1 7y ago
I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked.. They stole your SIM. SMS option was now in their control. SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.
- Thorrez 7y ago
  Everything you said agrees with what simonebrunozzi said. SMS is a bad 2FA option.
- mehrdadn 7y ago
  > sure its better than not having 2FA but only a little better. I'm becoming convinced this is a pervasive fallacy (perhaps not for all users in all cases, but for many). Having SMS as your 2FA potentially makes your phone, phone line, and everything linked to it an attack target. So you might lose a heck of a lot more than you would if they were all unlinked. It depends kind of on what your current security practices are, but I think for many it can well be indirectly risking more damage than it's preventing.
  - petjuh 7y ago
    Someone who steals your phone needs to have "physical access" to you. A random pickpocket is most likely to steal your phone and they're not interested in your phone. Most hackers never have physical access to people. The intersection between the 2 sets - hackers and pickpockets - approaches zero.
    - mehrdadn 7y ago
      If the "phone," part bothers you then just focus on the rest of what I wrote. I was making a larger point.
    - jvanderbot 7y ago
      No, as other threads have pointed out, SMS is trivially hacked
    - privateSFacct 7y ago
      You do realize that the minimum wage worker at your local phone store can setup a new phone with your number? That they may have friends who they accidentally do this for? That they may not detect the fake ID some random person with your name and number shows them? Etc etc. None of this requires getting your phone.