14

I am using social networking services such as

  • My Banking
  • GMail
  • PayPal
  • Facebook
  • Twitter
  • Google+
  • LinkedIn

All of these services text messages me a six digit code to login from anywhere, even a device which is recognized from previous logins. I have had several major attempts of people resetting and trying to recover my password from these services. They have managed to change my passwords and cause some locked accounts, distress, and basically making my life harder.

If it wasn't for the 2-Factor Authentication, my accounts would be in so much trouble and I would be fighting with these companies to try to repair my public image. I have had at least 57 attempts, and successful hackings of my accounts, yet stopped when they get to the login code that is required.

Is there a way to prevent this from happening any further? I've already taken the best security steps which I can manage, such as:

  • Different long, complex passwords (A-Z, a-z, 0-9, and all special characters)
  • Different emails for each service
  • 2 Factor Authentication with all services
  • Completely random security questions and answers without relating information back to myself

Is there anymore steps I can take into insuring my safety online?

Improve this question
7
  • 3
    This is a tough one. I wish more companies supported IP white-listing, I've only encountered a few domain registrars who do it currently. Be careful with your mobile device too for any services that use SMS for 2FA, use Google Authenticator or a hardware 2FA token if possible. There's been instances of malicious apps used to steal SMS 2FA tokens.
    – thexacre
    May 3, 2014 at 4:59
  • 1
    I don't download games or anything at all on my phone. I namely use it for phone calls, text messages, and to take a picture once in a blue moon. But, thanks for the advice with my phone also.
    – Traven
    May 3, 2014 at 5:04
  • 4
    You can't stop it. Only the service provider can do so by having an additional confirmation step to verify your email account before resetting your password.
    – Question Overflow
    May 3, 2014 at 8:27
  • ...how are they managing to change your passwords? Usually that requires a login (which would include your 2-factor auth). Now, I can imagine them going for the "forgotten password" process, but that doesn't usually change the password (just send a reset link to the email, which can usually be ignored).
    – Clockwork-Muse
    May 4, 2014 at 3:53
  • 1
    @mit and that's why you check the apps permissions before installing
    – user36976
    May 5, 2014 at 16:46

1 Answer 1

Reset to default
6

The answer is that you cannot in most cases as it completely depends on the company that provides the services and whether they provide an option to disable password recovery by email. So you would have to check whether this option is available for each and every service.

While this may be annoying in your particular case in most cases it's beneficial and an easy and convenient way for the customers to recover their lost password without involving customer service. The latter is also a cost matter as maintaining an extensive customer service department is a huge cost driver for internet companies which they therefore try to avoid.

One service that I know where you can disable email password recovery selectively and completely is namecheap. But this also with the disclaimer that when you completely disable it you acknowledge that the process will take a significant amount of time (a few workdays) and that you have to provide proof by a physical ID to regain access to your account.

In your particular case I would really think about whether it's not worth to go through the annoying process of renewing/changing your digital identities like loginnames and email to get rid of these persistent attempts of taking over your existing id. While they may not disappear completely it should at least reduce it significantly as long as they cannot figure out your new id.

Improve this answer
1
  • 1
    At least I can lock down my domains with this knowledge now, thanks to you. I would answer the question myself with getting rid of all of the try hards and script kiddies, but that answer is more of an opinion.
    – Traven
    May 3, 2014 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .