Oh no!!

[who?]

https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/

 

[highland145]

Whew, Boomerd, Perk and I just skated by.

 

[BoomerD]

 

[highland145]

Strange looking urinal.

 

[Ichinisan]

I've been using Google Authenticator forever for the simple reason that I don't need to have a signal on my phone to use it.

The same app works with other services too, like Dropbox, Hotmail, and even AnandTech Forums two-factor authentication.

I don't understand why they recommend Google Voice for this. It's like they've never tried to use it for automated SMS systems. Half of those things reject a GV number. Others pretend to accept it, but you never get the text messages.

 

[clamum]

Man I think that Krebs guy is a genius. I feel that way about pretty much any security/crypto-security guys/gals; just intelligent folks IMO.

So for his suggestion on getting a Google Voice number, do I have the steps right?
1.) Sign up for a Google Voice number, entering in your current mobile number as the transfer-to number
2.) Go through your major accounts, replacing your entered Phone Number with your new Google Voice number
3.) Remove your "real" mobile number from Google Voice

I'm kinda confused about #3. Doesn't that mean that Google Voice no longer has a number to forward to? Or maybe it was "baked in" when you first created the account and can be removed later?

 

[Ichinisan]

Man I think that Krebs guy is a genius. I feel that way about pretty much any security/crypto-security guys/gals; just intelligent folks IMO.

So for his suggestion on getting a Google Voice number, do I have the steps right?
1.) Sign up for a Google Voice number, entering in your current mobile number as the transfer-to number
2.) Go through your major accounts, replacing your entered Phone Number with your new Google Voice number
3.) Remove your "real" mobile number from Google Voice

I'm kinda confused about #3. Doesn't that mean that Google Voice no longer has a number to forward to? Or maybe it was "baked in" when you first created the account and can be removed later?

Even without text message forwarding, you can still get Google Voice app for texting. It gets push notifications. You can even get text messages emailed to you and reply from your email client.

 

[RichUK]

 

[clamum]

Even without text message forwarding, you can still get Google Voice app for texting. It gets push notifications. You can even get text messages emailed to you and reply from your email client.

Hmmm. I guess I'm still a little confused. So once you do Step 3 and remove your real mobile number from Google Voice, you have to use the Google Voice app to check any texts you may get (since they're no longer forwarded to your real mobile number since you just removed it from GV)?

 

[Red Squirrel]

https://www.youtube.com/watch?v=Xpc0s9FsA1Q

 

[Ichinisan]

Hmmm. I guess I'm still a little confused. So once you do Step 3 and remove your real mobile number from Google Voice, you have to use the Google Voice app to check any texts you may get (since they're no longer forwarded to your real mobile number since you just removed it from GV)?

Correct. The app can also get push notifications, so it's just like having another instant messaging app.

 

[Darwin333]

Whew, Boomerd, Perk and I just skated by.

Yeah but we both know that your wife controls all of your money.

 

[highland145]

Yeah but we both know that your wife controls all of your money.

Not the beer fund.

 

[Darwin333]

Not the beer fund.

ie your allowance

No worries my friend, you are a smart man. Happy wife equals a happy life.

 

[clamum]

Correct. The app can also get push notifications, so it's just like having another instant messaging app.

Huh. While I'm not super worried about security since I think I do a pretty good job already, my AMEX card was somehow compromised earlier this year. While that's not related to two-factor authentication, I think I might make this switch. Seems pretty easy to do.

EDIT: I guess the only drawback is some people are saying not every two-factor authentication option allows for the GV number, which kinda sucks.

 

[Ichinisan]

...
EDIT: I guess the only drawback is some people are saying not every two-factor authentication option allows for the GV number, which kinda sucks.

Most of them do allow a standard time-based authenticator app like Google Authenticator or Microsoft Authenticator.

I don't remember if it was specifically a two-factor security thing that refused to work with a Google Voice number, but I believe some sweepstakes and other systems asking for (or requiring) a phone number rejected it. Craigslist is the only specific service that I definitely remember rejected my GV number. I've encountered many systems over the last 10 years that reject my Google Voice number, but I can't remember them all.

 

[CZroe]

Most of them do allow a standard time-based authenticator app like Google Authenticator or Microsoft Authenticator.

I don't remember if it was specifically a two-factor security thing that refused to work with a Google Voice number, but I believe some sweepstakes and other systems asking for (or requiring) a phone number rejected it. Craigslist is the only specific service that I definitely remember rejected my GV number. I've encountered many systems over the last 10 years that reject my Google Voice number, but I can't remember them all.

Taco Bell contest entries, for one.