Multi factor authentication text vs app - Security Discussion

Curious if you guys use Google Authenticator or SMS as your primary for MFA. Google Authenticator doesn't support the app backup features of Android so moving phones is a huge PITA without root. Obviously text messages is not quite as sexxxxy and also requires signal.

I use the Google Authenticator app if possible. Sometimes text message can take minutes to arrive, so authenticator app is always ready
I can always restore account via text message, if I change my phone and then reinstall authenticator to new phone. And I don't currently root because it breaks security model of android and I think rooting makes authenticator app more vulnerable to attacks.

Related

WM 6.5 dies - need a new OS/device! Can Android be without Google?

Hey folks,
is it at the moment (in the future?) possbile to use a fullfeatured android-system without a google account/being bound to google? I love WM 6.5, because it comparatively is independent of any cloud stuff. Windows Mobile Phone 7 is very closed and lives in the cloud. So how open is android and to what extent is it spy-/adware?
Thx
My thoughts:
I was a WM5/6 user for quite a few years (at least 4+ years). I heavily hacked my WM phones to get the functionality I craved.
After fooling around with various Android ports to my HTC Titan, I decided to give the TBD Verizon Android phone (aka Droid) a chance when it came out. Since that fateful day, I haven't had a single regret. The Droid (and Android) is absolutely amazing.
Prior to my Droid, I had a couple of almost totally unused GMail accounts. I was resigned to the idea that to get the full functionality out of my Droid, I needed to move into the Google "cloud".
I have been amazed at how well everything flows together, now that everything syncs/baselines off of my main GMail account.
I'm not sure how functional the phone will be if you don't have a GMail account. Here is my (probably inaccurate) guess of functionality degradation you will face by not using a GMail account:
1) The Google Market may not allow you to purchase any apps. App purchases are paid through Google Checkout - Which is associated with your GMail account.
2) EMail integration is obviously very well implemented with Google. When a message is sent to my GMail account, it seems like I get it just a few seconds later on my phone. You can also set up your GMail account to poll any of your already existing email accounts from other providers. While not updated as fast as your GMail account, it still operates very well, and also color-codes which email account your messages came from. If you don't want to use GMail, the K-9 Mail app can work as an alternative to the GMail app.
3) Syncing with Google Contacts and multiple Google Calendars won't be available to you. The instant syncing of contacts/calendars is *very* useful, and works totally seamlessly. Again, updating a contact (or event) on the web (or your phone) nearly instantaneously updates the phone / web, respectively. You don't have to worry about losing contacts or calendars anymore. If you already had a GMail account with Contacts & Calendars, all that information is available on your phone within a minute or so after you have powered up your Droid for the first time. (Note: I do have some moderate gripes about how contacts are displayed & grouped on GMail & Android. I hope Google will be addressing these items soon). If your Droid gets damaged and you don't have a GMail account, you will probably have to manually reenter all your contacts / appointments.
4) Other non-Google "push" apps (such as Flight Tracker Pro) probably won't work since they need your GMail address to send their integrated information to your phone to update their app status.
5) Probably a bit of other stuff, but I'm too tired to think right now.
As far as my "who is watching my activity" paranoia level is concerned, I don't have any concerns at all about Google. I haven't seen a single instance in the months I have been using my Droid where Google appeared to be targeting any overtly obnoxious advertising in my direction. (However, if you are still concerned about ads, there is a hack to Android to block all ads). If I had any concerns, I would certainly trust Microsoft less (by a few orders of magnitude) than Google.
I'm not entirely sure how Google is making a lot of money from the Android adoption, other than having more devices natively using Google for searching (which can result in their advertising revenue). But from what I have seen, it is no worse than when you are using Google on your PC to do your web searches.
After using Android for months now, I can't ever see going back to WM6 again. WM6 was incredibly lame in comparison. Web browsing on Android is what I always hoped the WM6 platform would achieve (but never seemed to reach). Android is an amazing OS, certainly comparable to the Apple iPhone in almost all aspects, and exceeds WM6 in most aspects.
My advise would be to take the plunge and get an Android phone & GMail account set up. Try it out. If you don't like the OS (or Google cloud stuff), you can always return the phone within a couple of weeks for all the carriers, and go back to a WM6 phone.
The only thing you really need a google account for the Market. I have all syncing (mail, contacts and calendar) turned off and auto sync turned off. I believe you have to leave background sync turned on but that's it.
For everything else I use a hosted exchange account.
if you can live without google voice and google talk, then yeah. It is a fully functional OS. Market is not essential to core functionality and you can always install apks directly from sdcard as well as switch your search engine to whatever you prefer.

gmail notifier security

If someone writes an app and intends to steal google passwords, and puts it on the app store, and people download it, can they get all those people's google passwords?
For example I see several gmail notifier apps. When asking to install it, the phone notifies me that it has access to my gmail password. So what's to stop a thief from creating an app and stealing passwords this way?
bump .... anyone?

[Q] GMAIL Password ?

I've had a GMail account for years, and never once had a problem. I recently got an Android phone, and started getting GMail delivery failures for emails about "acai berry" slimming, which obviously is spam I didnt send. As a developer, I can understand that servers can be hacked, and nothing is perfect.
Earlier in the week I couldn't check my GMail email from my Android phone. I then logged in from my PC & was told there was suspicious activity. I got an access code sent by SMS & reset my password. I then checked the suspicious activity & found 2 accesses to my account from Poland. Definately not me. I still thought someone had hacked the server.
But last night alarm bells started ringing. I was running some API example code in Eclipse through the debugger on the emulator, and saw in the LogCat window some messages about permissions being requested by the app. One of them being requested was "ACCESS_GMAIL_PASSWORD" (may not have been the exact wording - I forgot to make a note of it) but it definately said GMAIL & PASSWORD in the permission name.
Now it was only in the Emulator, which didnt have any personal info in it. But when installing apps from the Marketplace on my real phone, I always check the permissions very carefully & wouldnt have installed anything that requested my GMail password. I cant believe Google would have provided API methods to access my GMail password ? Is this right ? Is it possible for an app to do so without me knowing it has permission to do so ? If its possible, I may have to reconsider using GMail.
Thanks for any feedback.
Well some apps do actually require the Google login credentials. Like appbrain for example. And I've been using appvrain forever with no problem.
Sent from my DROIDX using Tapatalk
Yeah, but shouldn't we be aware of these permissions when we are installing. I know I haven't installed any apps that explicitly said they would access my GMail account.
Well I've checked for the following applications I've got on my phone and that use Gmail password:
- Android Market
- Chrome to Phone
- Gmail
- Google Reader
- GTasks
- Google Maps
and for all of them in the Authorisations list it is clearly written "Use an account authentification information" (I've translated from what I read in French so it may not be the exact wording in English).
So IMO if you use at least Android Market and Gmail application you have inevitably given access to your Gmail password.
On that list I have
- Android Market
- GMail
- Google Maps
All were pre-installed on the phone. Also, I trust the authors of these pieces of software. The problem is my GMail account has been accessed by a spammer sending "Acai berry" slimming emails. I dont think Google would misuse my GMail password for this purpose.
I am more concerned that I have been downloading apps from the Marketplace & one of them got my GMail password. I realise that apps have "Full internet access" when they are ad sponsored, I suspect a rogue app accessed my GMail password & then used its internet access to send the password to a spammer.
I have several apps from sources I dont fully trust, with "Full Internet Access". But I dont have any that asked for Account Authorisation when installed.
Is there any way I can recheck what apps can access my GMail password ?
Thanks.
There is an app on the market called task identifier that should help you out.
Sent from my DROIDX using Tapatalk
Looks exactly what I'm after. Thanks.
gungh0 said:
Looks exactly what I'm after. Thanks.
Click to expand...
Click to collapse
No problem. Good luck with it all.
Sent from my DROIDX using Tapatalk

How to transfer SMS from android phone without using an app...

Hi.
Wife has Moto G5 Play. Recently got her a Samsung A30S. I had installed SMS Backup and Restore on her phone years ago, was expecting to use that to transfer SMS. Looked at her phone and the app was not there. Checked on Google and the most recent SMS backup was 18 months ago. Tried to reinstall SMS Backup and Restore. Wouldn't install. Looked for Google Play on her phone. It was gone too (!!) I tried installing other apps for transferring SMS and Google Play on my laptop said the apps had been installed, but nothing ever appeared on her phone.
So... how can I get her SMS messages from her old phone to her new one? Is there a way to hook the phones up to my laptop and transfer them that way? Through the filesystem?
Thanks in advance!
Visit the website of Google Play on your laptop, and login with your wife's Google account on the web page.
Then find and install some app for transferring SMS on the web of Google Play.
Now, go to that Moto G5 Play, and make sure that you login with your wife's Google account in Settings - Account. Later, you will find that app on the Moto G5 Play.
At last, take advantage of that app in order to transfer SMS.
Hi James,
Thank you for taking the time to reply with some advice. Unfortunately, the process you describe is exactly what I mentioned in my original post as not working. Sorry if I was unclear (I left off that I was using her Google account). I tried to give as much detail as I could but the bottom line is that Google Play on the web says it has installed apps as I requested but they in fact do not get installed. So I'm hoping to be able to manually copy the SMS file over or possibly get a PC based application that will connect with the phone over USB and do the transfer. Thanks again for your insight... perhaps you know something that will work with these constraints?
Thanks,
Alan
James_Watson said:
Visit the website of Google Play on your laptop, and login with your wife's Google account on the web page.
Then find and install some app for transferring SMS on the web of Google Play.
Now, go to that Moto G5 Play, and make sure that you login with your wife's Google account in Settings - Account. Later, you will find that app on the Moto G5 Play.
At last, take advantage of that app in order to transfer SMS.
Click to expand...
Click to collapse
Different methods to transfer SMS
Hey friend
There are many methods through which you can transfer SMS:-
Transfer messages from Android to Android using Bluetooth
Transfer messages from Android to Android using SMS Backup & Restore
Use the above keyphrases to search on google. I assure you will find a solution
MrTechSonu said:
Hey friend
There are many methods through which you can transfer SMS:-
Use MobileTrans - Phone Transfer[Windows vesion]
Select and transfer desired messages, contacts, call logs from Android to Android via dr.fone - Transfer (Android)
Transfer messages from Android to Android using Bluetooth
Transfer messages from Android to Android using SMS Backup & Restore
Use the above keyphrases to search on google. I assure you will find a solution
Click to expand...
Click to collapse
I know that software, don't ever install it, if you read what data it collects you'll have goose pumps. It uses adb and sideloads an app while you're using it. Don't ever use it, honestly it's not worth it. (And yes it collects transactions info such as your card number)
Thank You
Raiz said:
I know that software, don't ever install it, if you read what data it collects you'll have goose pumps. It uses adb and sideloads an app while you're using it. Don't ever use it, honestly it's not worth it. (And yes it collects transactions info such as your card number)
Click to expand...
Click to collapse
Thanks dude,
And I'm really sorry for that dangerous information. I felt really guilty after realizing it. Thanks again for providing the correct information
You can use the Bluetooth that comes with your phone without installing additional tools.
Turn on the Bluetooth on both your phones and have them paired by confirming the passcode.
Once the two phones are successfully paired, you can go to the Messaging app on the Moto G5 phone and choose the text messages that you want to send to the new device.
MrTechSonu said:
Thanks dude,
And I'm really sorry for that dangerous information. I felt really guilty after realizing it. Thanks again for providing the correct information
Click to expand...
Click to collapse
Don't worry now you know
But be careful with Wondershare in general, they're pretty sketchy with their privacy policy, and please take the time to read pricy policies, it's really worth it
i'm having the same problem myself.

Must use WhatsApp on Android phone, concerned with privacy issues.

Long story short I have to use WhatsApp for communication with one person. I have no other need for it, never had a WhatsApp account and never had Facebook or Instagram account (no need for either).
I will be using it on Android phone - either on my "daily driver" running Android 11 or on my spare phone running Android 9. I also have Windows 10 PC but my understanding WhatsApp still has to be installed on the phone before it can be used on PC.
I really don't like the fact that WhatsApp account has to be associated with the phone number. Does it mean that no more than one WhatsApp account can be associated with specific phone number?
I also want to avoid having all my contacts syphoned and sent to Facebook/Instagram. From what I learned this is a default behavior and if you deny WhatsApp access to contacts the functionality will be restricted.
So my plan is:
Create new Google account
Create new user on my Android phone and set it up with this new Google account. This new user will only have one contact (the person I need to communicate to)
Install WhatsApp under the new user account. At worst my phone number and another person number will be sent to Facebook or Instagram account.
Does it sound like a good plan? Any other things I can do to avoid my information being vacuumed?
JoeSchmoe007 said:
I really don't like the fact that WhatsApp account has to be associated with the phone number. Does it mean that no more than one WhatsApp account can be associated with specific phone number?
Click to expand...
Click to collapse
A Whatsapp account is tied to phone's SIM-card. AFAIK this can not be bypassed.
I won't let WhatsApp or FB run on any of my devices. Not for anyone.
Lol, this forum is as internet social as I get
That person you "communicate" with has email, right? I've blown people off because they insist on texting vs phone. I find it quit annoying and bothersome for a number of reasons.
Meh, people are trouble...

Categories

Resources