In a report released Friday, Google stressed the importance of linking a phone number to an account. Having a phone can help combat hijacking and phishing attacks.
Let's start from the beginning. Almost everyone has an email address. This is necessary for creating accounts on various web services , as well as for communicating, exchanging data, and so on.
Companies such as Google and Microsofthave adopted a system where a user can use the same username and password to log in to all services (owned by the same provider). In addition, these accounts can also be used to log in to third-party services.
Considering all of the above, it's no wonder that hackers find email an easy target. Thousands of attempts are made every day to compromise user accounts. That's why many companies, like Google, are developing methods to prevent and respond to attacks.
Preventive protection methods
A key preventative measure used by Google is adding a recovery phone number to your Google account. Research has shown that it is a very effective method of protection against ATO attacks. The prevention rate reached 100% in the case of automated bots, 99% in phishing attacks, and 90% in targeted attacks.
The researchers identified over 350,000 attempted breaches in a sample of 1.2 million users.
Google strives to provide the highest level of security. Another preventative measure is to detect the origin of a request to log in to the account. The origin concerns both the location and the device. When a user tries to log in from a different device or location, they are asked to prove that they are the legitimate owner of the account by going through a second authentication “test”.
Also, when a suspicious login attempt is detected, the user goes through an additional verification step (e.g. answering some security questions, providing a phone number, etc.).
The study, which highlighted the importance of the phone, concluded that SMS authentication is one of the least effective methods of protection, as it could be compromised by a man-in-the-middle attack. However, the use of prompts increases the prevention rate.
Google says that if users haven't added their phone number, then the weakest protection methods should be used, such as recalling the last location they were logged in. This may be effective for some threats, but not for phishing attacks.
Beyond the phone number, Google provides other means of protecting accounts from attacks, such as “one-time” codes. However, the more steps required for authentication, the less likely they are to be used by the average user.
