TOT Google email re BT mail

Well you would be not giving any matching usernames, so they would be of limited use.

Sometimes its also nice to know that your choice of password is not in common use, and hence sat in all the prehashed rainbow tables and dictionary attack word lists.

And Troy Hunt's HIBP and hardly counts as "a random site"...

PayPal emails don't show

What do you do if you no longer have access to the mobile with the number you gave them?

It isn't the "From" address (which is trivially easy to forge) that is important, it is either the "Reply To" address or the *target* of any link (*not* the text of the link in the email).

Hopefully you have setup alternative steps for authentication.

These include using an app (installed on a different device) or downloading backup codes to be kept in a folder (bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'.)

If you haven't done any of that, and you can't prove to the organisation otherwise who you are, you are out of luck.

So if you use 2FA, investigate and setup these options now!

I used to work somewhere that made their employees give google their personal mobile numbers for google 2FA. The resistance of non-techy folks for doing that was remarkable...

I have customers where the union would refuse that sort of thing, if the employer wanted a mobile number for the employee, they had to provide them with a mobile (and various other 'pointless' objections over the years, such as not accepting the photo from the id cards be stored in active directory).

If it's a *decent* 2FA system, there are alternative mechanisms. Certainly MS and Facebook allow you to create some 2FA keys you can save to a file in case you don't have signal or access to the device.

The Reply To: address is just as easy to forge as the From: address isn't it? When I send an E-Mail my MUA allows me to invoke an editor on the whole sent message including the headers.

I agree about the link targets though.

Maybe but I don't use the google account.

Jonathan

Interestingly when I sign on to the gamil account it says there are no security issues and the email account that it is linked to is a hotmail address not a BT one.

Jonathan

Sounds rather flaky. I don't think PayPal have any such system. Just my usual email address and an old Bigfoot address that doesn't work any more. I don't think I have any other organisations I use use 2FA apart from the taxman who won't let me log in without going through a page that asks whether I want to receive communication by email or post with no skip option so I'm not bothering with them for now.

When you sign up for 2FA I don't think any of them mention what you do if you lose your phone, and neither do techy/security people when they say what a good idea it is.

It's the target of the link I'm talking about:

Indeed. One of the key things about looking at target addresses, is that you only use them to give a "no go" indication.

If it looks suspect, then don't go.

If it looks ok then that does not mean go, it just means you make a decision based on the other evidence.

There are some tricks that can help. Doing a whois lookup on the owner of the domain may shed some light - compare it with the domain you know is legit.

Going to virustotal's url checker:

Even more reason to make sure its secure since you are less likely to notice someone else using it maliciously.

Then you need to use another method of recovery.

You are better off using a Time based One Time Passcode (TOTP) generator as an app on your phone for the 2FA. That way the 2FA link is to you actual phone and not to you mobile service.

See services like Google Authenticator, Authy, Microsoft Authenticator etc (there are loads - they are (nearly) all based on the same industry standard code generation algorithm.

It is a lot less insecure than DOB and other personal information that any half decent scammer can easily obtain.

That is supposed to have been stopped but helpful customer services can probably still be tricked into doing it by a sufficiently sophisticated aggressor using phishing techniques to obtain the information.

The problem I have with 2FA is that the OTP sometimes takes so long to arrive here (bad signal) that the website can time out before I get it.

Thank you all for your suggestions. After 90 minutes I have managed to change my Google passwords. I hadn't realised that my recovery hotmail email address had a different password to my gmail account (only used for Android access). It took a few turns around the block to get both changed, which I have now managed. Having changed the google login for my hotmail address, I discovered that they had been concerned about my Airbnb login which uses the BT email, so I have now changed that.

Why they couldn't have said that in the first place I don't know.

It's sort of like the difference between my prime BT email login and BT.com, which uses the same prime email address as the id for login. Easy to get the two confused. Another wasted afternoon - or perhaps not.

Thank you again, Jonathan.

Yes, but the reply to address is relevant when they want you to email them rather than use a web form.