Android Security - Giving Google Your Phone Number

Question

While setting up my Android account on my phone, I am asked

If you like, you can add this phone's number to your account ....

..for example you number will be used to:

Reset your password if you forget it ...

How is that in any way secure? So if someone picks up my phone and requests a password reset, it will be sent straight into their hands? By default, notification content is displayed on the lock screen, and that would include a short password reset SMS.

Now, I realise that physically losing your hardware is never a good thing from a security perspective, but let's look at some of the measures that are in place to protect you in the event that your device does fall into the wrong hands:

• Users are encouraged to set a lock screen during setup
• Account password is never stored on device, tokens are used instead
• By default, debugging and bootloader unlock are disabled, and screen unlock is required to enable them
• Even when debugging is enabled, screen unlock required to add new debugging client
• Unlocking bootloader causes factory reset

All of the above seem to be undermined by the fact that with the default settings, you can display a password reset token on the lock screen.

Surely Google aren't that stupid? What am I missing here?

Answer 1

Yes it is quite a compromise of a Google account if you lose an Android device that isn't protected (with disk encryption + a lock screen). It is best practice to be able to remotely wipe the device. When you realize you have lost the device you should immediately log into your Google account on a PC to update the 2FA settings. You're not missing anything, using a phone number/SMS for 2FA is not good and I wish we'd stop requiring it.

Answer 2

You can take the following steps

1. Hide notification content in the lock screen.
2. Use a strong PIN, Password or Bio metric to lock your phone.
3. Set up a SIM card lock so that your SIM cannot be used in another phone without the security PIN.

Hiding the sensitive notifications in the lock screen will by itself prevent the scenario you mentioned. Here is a useful reference regarding this in Android SE.