Is using Google Voice number for two-factor authentication a big mistake?

Question

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks and credit unions.

I'm wondering whether using a Google Voice telephone number as the so called Physical device to which one would receive text message codes to confirm one's possession of the Physical device is a mistake since potentially your GV account could be hacked, and then your Physical device is effectively stolen?

What if you are using two-factor Google authentication which puts an application on your smart phone to confirm identity, does that make using GV for others safe if you assume Google is safe?

Answer 1

The main problem with this would be when someone has malware on your computer (such as a keylogger) they would be able to get your Google Voice password as well as your normal account password. They could then get past the two factor authentication. If you always access Google Voice from a separate system you'd still technically be two factor though.

Answer 2

If you restricted access to your Google Account and implemented multi-factor authentication to access it prior to accessing Google Voice it'd increase the threshold of unauthorized access and would be safer to use. But often users don't use PINs or anything else on their physical devices either and of course you can't physically lose it either.

If your phone number is compromised you're easily able to change it too using Google Voice.

Answer 3

Yes it is a mistake. You've made your account more secure, but not with a 2nd factor.

There are three factors for identification: something you know, something you are, and something you have.

In this case, something you have, is supposed to be a physical device (your mobile phone) that only you (in theory) have access to.

While Google Voice allows SMS traffic, it also allows anyone with a computer, an internet connection, and your credentials to access to your SMS, so you've diminished the factor quite significantly. Instead of 2-factor, you actually have a single factor, a password, used twice: your site password, and the password for your google voice account. This is not 2-factor auth.

It's not different in reality, than clicking the "forgot my password" link, and having the reset link sent to your google account (which is the same account used to access Google voice).