3

While setting up my Android account on my phone, I am asked

If you like, you can add this phone's number to your account ....

..for example you number will be used to:

Reset your password if you forget it ...

How is that in any way secure? So if someone picks up my phone and requests a password reset, it will be sent straight into their hands? By default, notification content is displayed on the lock screen, and that would include a short password reset SMS.

Now, I realise that physically losing your hardware is never a good thing from a security perspective, but let's look at some of the measures that are in place to protect you in the event that your device does fall into the wrong hands:

  • Users are encouraged to set a lock screen during setup
  • Account password is never stored on device, tokens are used instead
  • By default, debugging and bootloader unlock are disabled, and screen unlock is required to enable them
  • Even when debugging is enabled, screen unlock required to add new debugging client
  • Unlocking bootloader causes factory reset

All of the above seem to be undermined by the fact that with the default settings, you can display a password reset token on the lock screen.

Surely Google aren't that stupid? What am I missing here?

2 Answers 2

1

Yes it is quite a compromise of a Google account if you lose an Android device that isn't protected (with disk encryption + a lock screen). It is best practice to be able to remotely wipe the device. When you realize you have lost the device you should immediately log into your Google account on a PC to update the 2FA settings. You're not missing anything, using a phone number/SMS for 2FA is not good and I wish we'd stop requiring it.

1
  • SMS is at least a bit better in this case than a phone call because you can usually stop it from being seen without the phone being unlocked. It's still horribly insecure compared to a TOTP app though. Nov 14, 2018 at 19:36
0

You can take the following steps

  1. Hide notification content in the lock screen.
  2. Use a strong PIN, Password or Bio metric to lock your phone.
  3. Set up a SIM card lock so that your SIM cannot be used in another phone without the security PIN.

Hiding the sensitive notifications in the lock screen will by itself prevent the scenario you mentioned. Here is a useful reference regarding this in Android SE.

2
  • Biometrics might not be the best approach, given that they can be "taken" from you by force wired.com/story/police-unlock-iphone-face-id-legal-rights Nov 14, 2018 at 13:17
  • 2
    @SeeYouInDisneyland Agreed. I was not insisting on Bio metrics. It is one of the options. The main point is to address the issue where the OP feels that any person with his phone can get the recovery code.
    – Kolappan N
    Nov 14, 2018 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .