Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 250 posts

Google's most ridiculous trick to force users into adding phone number

#1

Post by vort3 »

"To help keep your account secure, starting May 30, 2022, Google will no longer support the use of third-party apps or devices which ask you to sign in to your Google Account using only your username and password."

What does it have to do with phone numbers, you might think? Well, it's not that obvious.

I have beed using FairEmail app to read emails on my phone for many years. Recently, Google made this change, so I thought I need to take some actions to make sure I can continue using my favourite email app. After reading a bit, everything looked pretty simple:

- I could add my email account to my phone and login using google's native authentication methods, or

- «you can use an app password, please see below.»

Sure I don't want to add google's account to my phone just to be able to receive emails via IMAP, so I'll just generate separate app password for my email app, right?

Well, for some reason it's not possible to generate app passwords unless you have 2FA enabled. The option is just not there.

What can be simpler than adding 2FA to my account? I use password managers and my passwords are super strong, but I have no other choice, I'll have to use an authenticator app to continue reading emails on my phone, doesn't make much sense but anyway…

You can't just scan a QR with TOTP secret and enable 2FA for your account. Well, you can, after you enable 2FA by SMS using your phone number, or 2FA by notification on the phone, after you add google account to your phone. But using an authenticator is an «additional method» which is not available until «primary» 2FA method (SMS / phone number) is added. Oh, you can give away your phone number first, enable 2FA, after 2FA is already enabled you can remove 2FA by SMS and keep using authenticator app as your 2FA method, it's simple.

I guess I'll just have to stop using google. Thanks for making my life more difficult and caring about my security, Google.

TL:DR; You can't use «less secure» apps (apps other than official gmail app) to sync emails if you don't want to link your account to your phone number or add google account to your phone.

Re: Google's most ridiculous trick to force users into adding phone number

#2

Post by 14 »

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

Re: Google's most ridiculous trick to force users into adding phone number

#3

Post by vort3 »

14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

Can you recommend me any real working website where I could buy cheap one time virtual number that could be used to enable 2FA for my account?

And I hope they will never ever again ask me to confirm anything using that number.

Re: Google's most ridiculous trick to force users into adding phone number

#4

Post by metadat »

14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

Twilio? Google voice?

Re: Google's most ridiculous trick to force users into adding phone number

#5

Post by craftyguy »

14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

> The only solution I can see is buying a burner phone to avoid these situation

Or, you know, stop fucking using google.

Re: Google's most ridiculous trick to force users into adding phone number

#6

Post by vort3 »

It's not even about not willing to spend 1$ for a random phone number.

Here's a list of things that are wrong with what Google does:

- If you want to read your email, you have to use app specific password. I'm ok with that.

- You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account.

- You can't use authenticator app to enable 2FA. I have no idea why SMS which is the least secure way to send information is a primary method and authenticator app which can be set up by scanning QR from the screen without sending any information at all is «secondary» and can only be used after you give your phone number.

- You can use «notification» to confirm it's you, but you can only do that on the phone. I'm currently logged in in my browser, certainly I could confirm any login attempt from that same browser, wouldn't that be a second factor?

- Nowhere in announcements or help pages or in the Google Account interface they tell you that you can't generate app passwords if you don't have 2FA. The button is just missing and you wouldn't even know it should be there unless you search on the internet.

- Nowhere they tell you the only way to enable 2FA is to link your account to your phone number or to your android/iphone device, the options are just not there.

All of this is just bizarre and ugly. I have no idea why other people are not complaining, probably most of them just accepted that and added phone numbers.

Re: Google's most ridiculous trick to force users into adding phone number

#7

Post by jqpabc123 »

I guess I'll just have to stop using google.

Welcome to the club. The fastest way to convince me *not* to use a product is to attach a "Google" label to it. Nothing Google has to offer justifies the drawbacks.

NOTE: I do use an Android phone --- but only after it has been thoroughly de-Googled --- starting from a stripped down, bare metal device that won't even power up.

Re: Google's most ridiculous trick to force users into adding phone number

#8

Post by superkuh »

Good thing I switched to running my own mailserver in 2013. Now I'm completely independent of google and google accounts. If my @gmail.com email stops working with Thunderbird or other imap clients then that's that. I'm done using gmail.

Google hates open protocols. Don't let their claims of OAuth being open fool you. They don't use OAuth, they use OAuth 2 which is the mega-corp version shoved down the IETF's throat where every single corporate implementation is different and not-interchangable. You need a different OAuth2 plugin for every mega-corp.

Re: Google's most ridiculous trick to force users into adding phone number

#9

Post by more_corn »

One of the Google cofounders read the book “Nudge” and loved it so hard they invented a process I call “Shove”. You’ll do what we want or we’ll push you into traffic.

This is a prime example of using dark patterns to achieve a short term goal at the cost of creating a world none of us want.

We must all remain vigilant of this trap both as creators and as users.

I applaud you for calling it out. I wish there was something more we could do about it.

Re: Google's most ridiculous trick to force users into adding phone number

#10

Post by vort3 »

superkuh wrote: post #8

Good thing I switched to running my own mailserver in 2013. Now I'm completely independent of google and google accounts. If my @gmail.com email stops working with Thunderbird or other imap clients then that's that. I'm done using gmail. Google hates open protocols. Don't let their claims of OAuth being open fool you. They don't use OAuth, they use OAuth 2 which is the mega-corp version shoved down the IETF's throat…

I have a small free VPS and free domain name (whatever.duckdns.org). Do you think I can make a mail server that works, that could send emails that won't end up in spam folder of other people, and that I could use to create accounts?

I have thoughts of running my own mail server, but a lot of sites just won't let you create an account if you don't provide «trusted» email, and by «trusted» most of the time they mean gmail.

Post reply on HN