Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#121

Post by Nextgrid »

bxparks wrote: post #66
14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

The problem with using a burner phone is that you could be assigned a phone number that has been blacklisted due to its abuse by a previous owner. Then Google terminates your account as soon as you use the banned number.

To be fair, this is a risk even with a "legitimate" number. How do you know whether the previous owner did anything nefarious with it before it was recycled and assigned to you?

Of course, the real solution is to remove the leverage Google has on you so that a ban is no longer a problem.

Re: Google's most ridiculous trick to force users into adding phone number

#122

Post by throw10920 »

bsamuels wrote: post #83
throw10920 wrote: post #70

Earlier quoted context omitted.

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1]. 250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who shou…

Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. Attackers do not use their own hardware, and don't care about how much energy is used by their bot devices. In a normal attack, there are maybe 2-3 requests per hour that come from each hacker-owned device. The only thing that hashcat would do is drastically increase power consump…

> Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone.

False for a very large variety of low-power IoT devices using chips like the ESP32, which are multiple decimal orders of magnitude slower than a modern computer (or high-end smartphone) and will absolutely take far longer to compute a Hashcash challenge than one of those devices. Your smart light bulb is absolutely not hosting a Qualcomm Snapdragon 450 to change its colors.

Additionally, adding this compute+power load causes the presence of malware to become far more visible on these devices, which increases risk of discovery, which is a significant upside.

Finally, because there's now a significant computational cost to performing a login attempt, the value of individual devices are further decreased to the attacker, which reduces their likelihood of compromising these devices, and for using them for these kinds of attacks against services that use this measure.

So, yes, Hashcash is absolutely an adequate solution, and yes, there is absolutely a cost to the attacker.

Re: Google's most ridiculous trick to force users into adding phone number

#123

Post by jjav »

0daystock wrote: post #54

Google is no saint, but there's absolutely no reason to ascribe ill intent to collecting phone numbers of 2FA setup. The reason is simple: Google has billions of users, and at any given time, a lot of them break their devices and lose access to 2FA credentials. Phone numbers, despite all their flaws, are still the most reliable long-term and mostly-immutable attributes which can service as a proxy for identity which…

> Phone numbers, despite all their flaws, are still the most reliable long-term

How so? The most realiable one is email, as it doesn't need to be tied to any third party so it can exist a lifetime.

I've had the same email since the mid 90s. I've had probably a dozen or more phone numbers in that timeframe. A handful of which are still tied to various company accounts even though I've long since haven't had any acces to those phone numbers.

Re: Google's most ridiculous trick to force users into adding phone number

#124

Post by jwagenet »

QuikAccount wrote: post #51
ryantgtg wrote: post #38

Earlier quoted context omitted.

Their device might have Google Smart Shellac on it, so this user chose to strip it off for the full De-Goog experience.

> Google Smart Shellac No idea what this is and searching yields nail polish as the result.

Shellac is just a varnish/coating, so the implication is Google features are metaphorically painted on the phone hardware and software and you just need to scrape it off.

Re: Google's most ridiculous trick to force users into adding phone number

#125

Post by Nextgrid »

elric wrote: post #22
14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

Depends on where you live. In my neck of the woods, burner phones are illegal. It's (nominally) impossible to get a phone number without getting ID verification. This applies to physical sims, but also to online services à la Twilio.

Providing ID verification to the carrier/government is one thing, providing it to Google is another. I'm personally much more comfortable with the government or carrier knowing my number than Google.

Re: Google's most ridiculous trick to force users into adding phone number

#126

Post by jjav »

bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

> Anyone who thinks this is about advertising/collecting personal data is out of their minds.

Google is a public company, just look at their annual reports. Where do they make most revenue? Advertising.

Thus, everything they do is about promoting advertising. It would be naive to think otherwise.

Re: Google's most ridiculous trick to force users into adding phone number

#127

Post by throw10920 »

supertrope wrote: post #117
throw10920 wrote: post #70

Earlier quoted context omitted.

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1]. 250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who shou…

Proof of work rewards those who own fast CPUs (or are using stolen CPU time). Those who are using an non-high end Android phone, a battery powered laptop, or an older PC are punished with a long loading times. Part of why Gmail takes so long to load is the anti-bot scripts. Use rate limiting instead.

> Proof of work rewards those who own fast CPUs (or are using stolen CPU time).

Most technology rewards people who own fast CPUs or are using stolen CPU time, so this statement doesn't mean much.

What actually matters is "does this significantly negatively impact those with slower processors" (no) and "is it still effective at punishing attackers" (yes).

Impact: I'll set my Hashcash challenge so that it takes about 8 seconds on a 10-year-old middle-of-the-line Intel processor. There, login time is about doubled for people running that extremely old hardware, and that's the worst case - and this is entirely acceptable given that most people do not log in to their accounts very often - they do so once and then stay logged in for weeks or months.

Effectiveness: Even for attackers using stolen CPU time - Hashcash is still effective. If you have malware on a low-power device, that device is going to be far slower at login attempts. If you have a user-facing device, they're much more likely to notice their computer being slow, and do something that might lead to discovery. If you've stolen compute on some cloud, then the IT folks are more likely to notice, and so on.

Rate limiting is good, but is complementary to proof-of-work - if you have a large pool of IPs/devices to log in from, for instance, rate limiting isn't very effective.

Re: Google's most ridiculous trick to force users into adding phone number

#128

Post by cheriot »

throw10920 wrote: post #113
cheriot wrote: post #90

Earlier quoted context omitted.

> a tyrant ruling over a techno-feudalistic society It's an email app. There are many other options.

Google is, uh, not just email. https://about.google/products/

The topic of the post was email. Even expanding to every other product, which ones are you forced to use? Just pick another one.

Calling this feudalism is a bit much.

Re: Google's most ridiculous trick to force users into adding phone number

#129

Post by jqpabc123 »

jwagenet wrote: post #124
QuikAccount wrote: post #51

Earlier quoted context omitted.

> Google Smart Shellac No idea what this is and searching yields nail polish as the result.

Shellac is just a varnish/coating, so the implication is Google features are metaphorically painted on the phone hardware and software and you just need to scrape it off.

Unfortunately, what Google embeds into Android software is significantly more adverse than just "shellac".

A standard Android phone sends your IMEI and SIM card info to Google servers on boot up before you even have a chance to login.

Re: Google's most ridiculous trick to force users into adding phone number

#130

Post by throw10920 »

FrenchDevRemote wrote: post #107
the8472 wrote: post #92

Earlier quoted context omitted.

> Anyone who thinks this is about advertising/collecting personal data is out of their minds. Sorry, but that trust has been burned and I don't see a path to recovery. Support hardware tokens or get off my lawn. https://www.eff.org/deeplinks/2019/10/twitter-uninentionally... https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...

the average person don't have any idea what's a hardware token. google is not catering to HN readers, they're catering to your grandma, your parents, your little brother/sister, your tech illiterate neighbor. They couldn't care less about the habits of a nerd on archlinux with ublock, noscript, firefork a vpn, hardware tokens and 2FA everywhere with recovery code split in 7 different location.

This is a straw-man. The problem is not that Google is designing their services to cater to the average tech-illiterate user, it's that they're preventing the tech-literate users from opting out of phone recovery and/or using something more sane, like what's been listed above.

That's clearly malice. Like, there's no good reason that Google would require you to hand over a phone number.

Post reply on HN