4 ms·

Not who you asked, but if you have signed into a Google app (Gmail, youtube, etc) on a phone then they will send a push notification to that phone that bypasses

by CamJN 6y ago

Not who you asked, but if you have signed into a Google app (Gmail, youtube, etc) on a phone then they will send a push notification to that phone that bypasses 2FA. This cannot be disabled, you can choose to login with the second factor you setup, but it doesn't provide any security anymore.

Daho0n 6y ago
If you are signing into something from a phone and get the prompt on that same phone you already have 1) chosen to add the account phone-wide on that phone and 2) provided 2FA to do so. What you are doing is browsing the web on your 2FA hardware and complaining it isn't secure.
- p49k 6y ago
  1. I don’t want every device I login with Google to automatically become a 2FA device. There are plenty of scenarios where this reduces account security. 2. They send these non-optional push notifications as part of the account recovery process as well. Once someone was relentlessly trying to get into my gmail account (not maliciously, I think they probably had a similar address and got confused) and I was deluged with these notifications for hours with no way to make them stop.
  - mindslight 6y ago
    3. They then go on to disable your actual recovery options that they've deemed "less secure". I recently tried to sign on to my grandfathered Gapps account to reset its activity timeout (Google demands I perform the account recovery process for every login). This time, Google decided I couldn't authenticate with my longstanding recovery email, instead demanding that I use some long cleared browser/tablet session (lol, such surveillance culture assumptions). I was eventually able to contact what appeared to be a real live human in GSuite support that took on my case even though it was a free account (after going a few rounds of them referring me to gmail account support, and gmail support bot referring me back to them). So believe it or not, it is possible to contact a human at Google. Of course after I got the grandfathered Gapps account back, I was trying to figure out what it's actually good for, especially now that they've restricted adding domain names. The only things I could find are if I wanted to use gmail on my personal domain (no thanks), or if I want my published Google identity to include my own domain name (shrug). So back into storage it goes, this time with an explicit "2FA" tablet.
- CamJN 6y ago
  You seem to be labouring under some pretty egregious misconceptions. I am not signing into something from my phone. The flow is: i try to log into gmail/google docs/whatever on my laptop's browser. Google sends my phone, tablet, any other mobile device I own a notification. if someone taps that notification, the laptop's browser is logged in, with no 2fa. There's no such thing as a phone-wide google account on iPhones. There are google made apps, which completely fuck the security for your google account.
  - joshuamorton 6y ago
    What? The phone is a second factor. The push notification is more secure than sms 2fa, the only more secure option is a yubikey, and your can disable push notifications on favor of a yubikey.
deleted 6y ago
[deleted]

by CamJN 6y ago

Daho0n 6y ago

If you are signing into something from a phone and get the prompt on that same phone you already have 1) chosen to add the account phone-wide on that phone and 2) provided 2FA to do so. What you are doing is browsing the web on your 2FA hardware and complaining it isn't secure.

p49k 6y ago
1. I don’t want every device I login with Google to automatically become a 2FA device. There are plenty of scenarios where this reduces account security. 2. They send these non-optional push notifications as part of the account recovery process as well. Once someone was relentlessly trying to get into my gmail account (not maliciously, I think they probably had a similar address and got confused) and I was deluged with these notifications for hours with no way to make them stop.
- mindslight 6y ago
  3. They then go on to disable your actual recovery options that they've deemed "less secure". I recently tried to sign on to my grandfathered Gapps account to reset its activity timeout (Google demands I perform the account recovery process for every login). This time, Google decided I couldn't authenticate with my longstanding recovery email, instead demanding that I use some long cleared browser/tablet session (lol, such surveillance culture assumptions). I was eventually able to contact what appeared to be a real live human in GSuite support that took on my case even though it was a free account (after going a few rounds of them referring me to gmail account support, and gmail support bot referring me back to them). So believe it or not, it is possible to contact a human at Google. Of course after I got the grandfathered Gapps account back, I was trying to figure out what it's actually good for, especially now that they've restricted adding domain names. The only things I could find are if I wanted to use gmail on my personal domain (no thanks), or if I want my published Google identity to include my own domain name (shrug). So back into storage it goes, this time with an explicit "2FA" tablet.
CamJN 6y ago
You seem to be labouring under some pretty egregious misconceptions. I am not signing into something from my phone. The flow is: i try to log into gmail/google docs/whatever on my laptop's browser. Google sends my phone, tablet, any other mobile device I own a notification. if someone taps that notification, the laptop's browser is logged in, with no 2fa. There's no such thing as a phone-wide google account on iPhones. There are google made apps, which completely fuck the security for your google account.
- joshuamorton 6y ago
  What? The phone is a second factor. The push notification is more secure than sms 2fa, the only more secure option is a yubikey, and your can disable push notifications on favor of a yubikey.

deleted 6y ago

[deleted]