Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks and credit unions.

I'm wondering whether using a Google Voice telephone number as the so called Physical device to which one would receive text message codes to confirm one's possession of the Physical device is a mistake since potentially your GV account could be hacked, and then your Physical device is effectively stolen?

What if you are using two-factor Google authentication which puts an application on your smart phone to confirm identity, does that make using GV for others safe if you assume Google is safe?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

The main problem with this would be when someone has malware on your computer (such as a keylogger) they would be able to get your Google Voice password as well as your normal account password. They could then get past the two factor authentication. If you always access Google Voice from a separate system you'd still technically be two factor though.

share|improve this answer
    
If I have my Google Voice configured for two factor? –  Mark C. Wallace Mar 22 '13 at 18:32
    
Worse--if you used the same password for whatever site has 2-factor, and your google voice account. –  Alan Jun 1 '13 at 15:37

If you restricted access to your Google Account and implemented multi-factor authentication to access it prior to accessing Google Voice it'd increase the threshold of unauthorized access and would be safer to use. But often users don't use PINs or anything else on their physical devices either and of course you can't physically lose it either.

If your phone number is compromised you're easily able to change it too using Google Voice.

share|improve this answer
    
While I understand what you're trying to say, I think you should find ways to reword it, as it's slightly awkwardly written. For example, what is unauthorized access threshold? The sentence about users often not using PINs,... also ends with describing inability to physically lose Google Voice, not a physical device, as it currently seems to suggest. I realize it's only the wording, but please edit it for clarity nonetheless. Thanks! –  Noordung Jun 1 '13 at 9:48

Yes it is a mistake. You've made your account more secure, but not with a 2nd factor.

There are three factors for identification: something you know, something you are, and something you have.

In this case, something you have, is supposed to be a physical device (your mobile phone) that only you (in theory) have access to.

While Google Voice allows SMS traffic, it also allows anyone with a computer, an internet connection, and your credentials to access to your SMS, so you've diminished the factor quite significantly. Instead of 2-factor, you actually have a single factor, a password, used twice: your site password, and the password for your google voice account. This is not 2-factor auth.

It's not different in reality, than clicking the "forgot my password" link, and having the reset link sent to your google account (which is the same account used to access Google voice).

share|improve this answer
    
Your concerns are solved by using the Google Authenticatr. –  Ramhound Jun 3 '13 at 12:22
    
If you're using Google Authenticator, why aren't you just sending the SMS directly to your phone anyway? –  Alan Jun 3 '13 at 13:16
    
Its easier to change the Google voice number then it is to change your phone number. You can also recieve digital copies of the text message, archive the text messages, and have an overall better message history. Sending a text message through Google Voice is also FREE and it costs $0.30 to recieve a normal text message through your phone provider. –  Ramhound Jun 3 '13 at 14:10

One use case that's been ignored in the answers thus far is for those who are unable to keep their physical phone on their persons at all times. If you're not allowed your cell phone at work for example, I'd argue that using Google Voice as your two factor authentication source is a huge step over not having two factor authentication at all. No, it's not perfect and it is susceptible to risk, but that risk is much less of a risk than what it would be just leaving your services as password authentication only.

I guess I'm saying to use common sense. If you're able to keep your phone on you every time you need to log in somewhere then don't bother using Google Voice as it's a risk, but if you can't always access your second authentication device, make that authentication be Google Voice to give you better security than a single authentication source.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.