Like iPhone, a stolen Android phone’s PIN could be used to change Google account password

A report from The Wall Street Journal final week sounded the alarm on an apparent, however scary problem on iPhone that will permit a prison to take over your Apple account. But that’s not one thing unique to iOS. Your Google account could be compromised if a prison stole your Android telephone and its PIN, however there are methods to defend your self.

9to5Google has a rebooted e-newsletter that highlights the most important Google tales with added commentary and different tidbits. Sign up right here!

Last week’s WSJ report cited experiences of iPhone homeowners who had their iPhones stolen, solely to later see their Apple account compromised, the password modified, and additional accounts – together with financial institution accounts – accessed as properly. These weren’t circumstances of superior hacks, however somewhat a easy safety loophole. Using the passcode (PIN) on the iPhone, the prison who stole it was ready to change the account passwords and entry different accounts, all with out figuring out the proprietor’s passwords.

How? On iOS, customers are ready to use their phone’s PIN to change the password to their Apple ID, and getting a PIN is as straightforward as watching the phone’s proprietor enter the quantity, or tricking the phone’s proprietor into sharing their PIN.

WSJ’s Joanna Stern used the instance of “the fog of a late-night bar scene full of young people, where predators befriend their victims and maneuver them into revealing their passcodes” as one situation the place this could occur. And additional, a few of these criminals enabled Apple’s Recovery Key function, which successfully locks customers out of their account with out the stolen iPhone.

Related: Apple ought to spend money on anti-theft safety features for iPhone and iPad

Frighteningly, this may additionally occur on Android telephones, as a PIN is all that’s wanted to change your Google account password.

Mishaal Rahman highlighted how this works on Twitter, with an choice in Google account settings to use your Android phone’s display lock to change the account password. Google permits this because the password change request is coming from a gadget that “is yours,” however there’s no additional verification past your PIN. Google’s course of, notably, first prompts you to enter your present password first, however utilizing the “forgot password” choice permits the PIN to be used as a substitute.

This is clearly regarding, because it means a stolen smartphone could imply shedding entry to your Google account and way more, but it surely was famous within the report that the principle goal for this type of follow appears to revolve round iPhones, as they have an inclination to maintain larger resale worth within the United States. Apparently, 99% of circumstances seen by a detective had been iPhones.

In a assertion to WSJ, a Google spokesperson stated:

Our sign-in and account-recovery insurance policies strive to strike a steadiness between permitting official customers to retain entry to their accounts in real-world eventualities and conserving the unhealthy actors out.

So even when it’s not all that possible to occur on Android, what are you able to do to defend your telephone, and your account?

For one, You also can stick to utilizing biometrics – like your fingerprint – to keep away from snooping eyes from seeing your PIN within the first place.

It additionally wouldn’t be a unhealthy follow to keep away from storing delicate information in your gadget, corresponding to in notes apps or your picture library. This would possibly embody social safety numbers, passport photos, or different types of ID, as these criminals can do much more injury if they’ve quick access to that info.

Next, you’ll be able to strengthen your phone’s safety. By default, Android solely asks for a four-digit PIN, however you may make that for much longer. Pixel telephones help PIN codes so long as 17 digits. Android’s sample unlock can be more durable for somebody to steal by wanting, and you should utilize a full password to make a very advanced code.

Other methods of securing apps would possibly embody turning off biometric/PIN login for these apps, or a minimum of making these PINs completely different from the one used to unlock your telephone. A devoted password supervisor also can go a good distance over utilizing the one constructed into your gadget.

Another choice is to use Google’s “Advanced Protection” choice. This blocks the flexibility to change your password utilizing a PIN, but it surely does require that you simply use two bodily safety keys.

More on Android:

• Samsung Galaxy S23 Ultra overview: Stellar battery life, disappointing digicam
• Google reiterates that Assistant mild mode is gone on Android
• MediaTek can be bringing satellite tv for pc connectivity to Android telephones

Check out 9to5Google on YouTube for extra information: