Hacker News Reader

Comment by siglesias | Hacker News Reader

From the article:

The backup email address on my Gmail account is that same .mac email address. At 4:52 PM, they sent a Gmail password recovery email to the .mac account.

Here Gmail was only as strong as the weakest password recovery email service it was linked to. I consider this a failure on Google's part.

View on HN

With two factor authentication enabled this shouldn't be an issue.

Why not require it then?

not useable in all country. Not applicable on imap, pop3. Use case where an email account serve more than 1 physical person. Unusable while you travel.

"Unusable while you travel" or in other countries is simply false: one of the two-factor authentication options is the google authenticator app on your smartphone, which requires no internet/phone connectivity at all. It's time-based.

The imap/pop thing is still a legitimate concern. App-specific passwords let those continue working, but they have security issues of their own.

And yet another option is a set of emergency use codes that you write down or print on a card.

It's quite possible to add two-factor logins for any protocol, that works in any country with a cell phone network. Just demand a response to a challenge via cell phone before validating the password, you could even require one of those RSA token thingies if you want. Just a matter of cost and convenience.

I used 2 step verification for my gmail. Our cell phone operator cannot receive international sms (I know, that sucks), so I used my home phone, so every time I logged in to my gmail I received a call from google voice robot to tell me the pin number. It sounded perfect at first, but when I started to actually use it, I noticed everytime I needed to login to gmail, I wasn't home. I'd call my parents so they could say me the pin or use the backup codes that google provided me with. That was so uncomfortable I had to turn it off.

Not everyone has a cell phone.

Reply on news.ycombinator.com