Hacker News Reader

Comment by calvin | Hacker News Reader

One more great reason to set up two-step verification for your Gmail and Google Apps accounts.

http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...

I came here to say this, so thanks for saying it for me, calvin. Anyone reading on HN should probably set up two-step verification on their Google accounts.

I've yet to do this. Reason being I wonder what will happen if I lose my phone...

Is there a way to set up two-step without a phone?

Google provides a set of numerical codes for you to print out and store in case you lose your phone. They're all one-time use, and allow you to get in and change the settings.

Does that mean that if ANY of them are used, the rest are invalidated? Or just that any one of them may be used once?

You get 10 codes per generation(and can regenerate them whenever you want), and each code can be used once.

You can use an alternate number to have a text message sent to you and there are printable one-time pads. The one-time pads have come in handy for me, because I always let the battery on my phone die.

In addition to the one time pad, you can specify other phone numbers. The system will call these phones and read the code aloud.

The recommended way is to use the Google Authenticator app - available on Android, iOS, and BlackBerry devices - doesn't require an Internet connection, mobile service, or a data plan to generate verification codes.

http://www.google.com/support/accounts/bin/answer.py?answer=...

I'm using it on my iPod.

Also, you should NOT have Gmail open while surfing the web. I won't even visit a link emailed to me directly. I'm either reading email or surfing, but never both; all private data gets wiped between sessions. Sure, it's a bit paranoid, but it eliminates quite a few attacks and opportunities for social engineering.

Perhaps it is domain registrars that need to implement two-step verification before transfers. It would be such a labour-saving move, and potentially safe so much time resolving disputes. Just offer people to "lock" their domains to be unlocked with a mobile phone number.

It would be a simple twillio app.

Reply on news.ycombinator.com