"2-Step Verification" - Okay Google, That's Great, But What If...

[Beef_Wallington]

I don't know about anyone else's experience with (specifically) Google's 2FA, but for me what happens is that a text gets sent to my phone that says "Please verify it was you trying to sign in to your account", and then there is the choice of tapping "No, it's not" or "Yes, it's me." They don't send me a code or number that I can just keep on hand to use over and over.

Like others here, I'm all for heightened security, but I'll go back to my main point, which is, what if I lose my phone, or it goes belly-up, or I just plain don't WANT a smartphone a year or two from now? Because as far as I can tell, the only way for me to use 2FA with Google is to own/have possession of a smartphone for the rest of my life. - If I am wrong on that, someone correct me...

They don’t send reusable codes, that person is talking about keeping the same phone number and receiving codes via text.

2FA is generally available via text, email or app so no, you are not required to possess a smartphone for the rest of your life.

That being said app based is becoming more and more popular as it is more secure.

 

[MJ5150]

Extra step to sign in to something. What could anyone do with my TB account that has any serious ramifications?

You're a supporting member that's been here for seven years. That adds some credibility to what you would post here over someone who, let's says joined today or yesterday.
Take that to the next level and think of the impact on classified transactions here at TB. You either listing something for sale or offering to buy something would be less suspicious to the average buyer/seller than that same person who joined today or yesterday. It's been happening here the last few months now, members getting their accounts hacked and the hacker trying to purchase something for sale in our classifieds or sell something.
As for those who think they're safe from hackers because they aren't rich, famous, important, etc, don't fool yourself. Hackers these days aren't always after you in particular. They want data and access to other ways to get data. Everyone is a target, and we should all conduct ourselves while using internet/network resources accordingly.
2FA/MFA is a great extra step. While authenticating via text/SMS is mostly easy, using an actual authentication app (or key fob when applicable) is the better way to go if you want to get serious.

-Mike

 

[who]

...I lose my phone?

What if, when my contract is up with this phone, and I go to get another (assuming I even do, because I have been toying with the idea of trying life without a mobile phone), I decide to go with a bare-bones "dumb" phone instead of a smartphone?

THis has to be one of the mst irritating things ever. And even though I have checked the "do not ask again on this device" box on the sign-in page, Google still texts me an often-slow-to-arrive notification where I have to tap "yes, it's me" to get into my damn account.

**** outta here Google...

Somewhere in your account settings, you should be able to find something about backup two-factor authentication codes. You can print those out and keep them in a safe place so if you lose access to your phone, you have another way of getting into your account.

 

[S-Bigbottom]

You're a supporting member that's been here for seven years. That adds some credibility to what you would post here over someone who, let's says joined today or yesterday.
Take that to the next level and think of the impact on classified transactions here at TB. You either listing something for sale or offering to buy something would be less suspicious to the average buyer/seller than that same person who joined today or yesterday. It's been happening here the last few months now, members getting their accounts hacked and the hacker trying to purchase something for sale in our classifieds or sell something.
As for those who think they're safe from hackers because they aren't rich, famous, important, etc, don't fool yourself. Hackers these days aren't always after you in particular. They want data and access to other ways to get data. Everyone is a target, and we should all conduct ourselves while using internet/network resources accordingly.
2FA/MFA is a great extra step. While authenticating via text/SMS is mostly easy, using an actual authentication app (or key fob when applicable) is the better way to go if you want to get serious.

-Mike

I have signed out of TB maybe five times ever, I click on talkbass.com and am in as me.

Maybe I should log out once in a while. Figure if I am not typing my password often it would not be picked up by spyware on the computer (if there is any).
Just learning about this two step thing.

Darn it.
Now that this message is on the internet the risk went up.

 

[TOOL460002]

You're a supporting member that's been here for seven years. That adds some credibility to what you would post here over someone who, let's says joined today or yesterday.
Take that to the next level and think of the impact on classified transactions here at TB. You either listing something for sale or offering to buy something would be less suspicious to the average buyer/seller than that same person who joined today or yesterday. It's been happening here the last few months now, members getting their accounts hacked and the hacker trying to purchase something for sale in our classifieds or sell something.
As for those who think they're safe from hackers because they aren't rich, famous, important, etc, don't fool yourself. Hackers these days aren't always after you in particular. They want data and access to other ways to get data. Everyone is a target, and we should all conduct ourselves while using internet/network resources accordingly.
2FA/MFA is a great extra step. While authenticating via text/SMS is mostly easy, using an actual authentication app (or key fob when applicable) is the better way to go if you want to get serious.

-Mike

Very timely point. Just did 2FA for TB because after an oddly long scam call from "Comcast" I did a factory wipe/reset on my phone. I actually went to the physical store, because my calls were in fact being intercepted. After that hard reset, TB was the one account with a ton of red flags. Also, even after the reset my calls are still being intercepted. I went to a Comcast store about an hour ago and they confirmed this. So... I am on a phone that has been wiped multiple times, both at home and lastly in the store, and things are still not right. Very bizarre, and I'm pretty sure it is related to my printer's security certificate, because there was some shenanigans with that. Hopefully this isn't too bad a derail. This is the second 100% verified phone hack this year: First was a Google play exploit that affected way more than just myself, and this current one is anyone's guess at this point.

 

[S-Bigbottom]

I actually went to the physical store, because my calls were in fact being intercepted. After that hard reset, TB was the one account with a ton of red flags. Also, even after the reset my calls are still being intercepted. I went to a Comcast store about an hour ago and they confirmed this. So... I am on a phone that has been wiped multiple times, both at home and lastly in the store, and things are still not right. Very bizarre, and I'm pretty sure it is related to my printer's security certificate, because there was some shenanigans with that. Hopefully this isn't too bad a derail.

This is my thinking for not typing my account and passwords much and stay logged in, the more it is typed the more opportunities to be intercepted.

 

[Selta]

This is my thinking for not typing my account and passwords much and stay logged in, the more it is typed the more opportunities to be intercepted.

Passwords aren't transmitted, and especially not transmitted in clear text. A good authentication system hashes your password, and sends that, then compares that hash to the hash in the authentication database. If the hashes match, success.
It's best to use a complex, unique password (and if possible, username) at every site. Store those passwords in a password manager. When possible use 2FA as well. Having unique credentials in as many places as possible limits your impact if any one site gets compromised.

 

[MJ5150]

This is my thinking for not typing my account and passwords much and stay logged in, the more it is typed the more opportunities to be intercepted.

It's less likely for you to have a keylogger (malware that collects everything you type and sends it to a remote server) on your computer than to be fooled into giving up your login info in a phishing attempt, or a data breach. A data breach would occur when an entity you have done business with experiences an attack on their network and the data they store for all of their customers is leaked, or breached.
You have likely seen headlines of this nature in recent months as various companies have to report this to those affected and then it becomes public knowledge, which it should.
There are other ways to steal your username and password, like brute force. Hackers realize the weakest point in the security chain is the end user so they don't have to use those as much when it's much easier to send out a couple million 'click here to reset your password' emails and figure even if .01% click and type that's a good return.
This post isn't meant to scare anyone or induce paranoia, but it is best practice for all of us to be vigilant about protecting our online presence, no matter how small it seems to be.
Here is an example from the medical world. Suppose you are broke, unemployed, in collections and having your wages garnished. You are not important in any business or otherwise circles. You don't even have but maybe one or two friends and no family. By the definition of some, you are a nobody. Still, if a hacker obtains your name SSN, and date of birth, they can use your identity for a medical procedure or to process claims for medical procedures and/or equipment. You have no clue until a few months later when you start getting bills for these procedures or claims. Yeah, it wasn't you, but it's going to be a nightmare to clean up that mess. It may not end up costing you a dime when it is all said and done, but someone out there just scammed the medical facility and insurance for thousands of dollars.

-Mike

 

[TOOL460002]

This is my thinking for not typing my account and passwords much and stay logged in, the more it is typed the more opportunities to be intercepted.

Ya, admittedly TB is the one I type in the most, but I don't believe I have had any specific passwords stolen. My phone issue this spring they got access to one or two saved passwords, so access, but couldn't change it or anything. I just stopped using auto-fill on forms, but I'm currently on a compromised device so clearly I ain't doing it right! I was confused why they would spend 30min on the phone with me having gotten zero information (they already had some Comcast info, like that email, which has not been used once, so I didn't even know it at the time). Years ago some scammer also had lots of Comcast details that I legitimately don't know how they got them. They were asking for payment to cover equipment destroyed in a house fire, only I'd already done that and this wasn't Comcast. No idea how they knew I was a customer who suffered a house fire. And very much to MJ's point, I am not rich nor do I have anything particularly valuable. My current theory is that they recorded my voice on that call to attempt to use in automated systems. They didn't flinch at my address of 123 Fake St and a zip of 69420, nor at my "name." Weird one. Guess I'll find out. Went ahead and froze all bank stuff anyway.