Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#131

Post by lxgr »

FrenchDevRemote wrote: post #100
lxgr wrote: post #84

Earlier quoted context omitted.

You can always bring a paper recovery code or FIDO authenticator (both of which are safe against SIM swapping attacks).

we've been told for decades to "not write passwords on postits" and we're really back to square one...

It's not a password, it is a secondary, single-use recovery second factor.

Carrying that around in a wallet doesn't make you any more vulnerable to physical attackers than carrying your Yubikey on a keyring, and it's much more secure against remote attacks than SMS-2FA (where you can fall victim to SIM swapping, number porting attacks etc).

Re: Google's most ridiculous trick to force users into adding phone number

#132

Post by MilaM »

Here is how I solved the same problem a couple of weeks ago. If you still have an active session in a browser, you can add a recovery e-mail address to you account security settings. After that I was able to add a Yubikey as a second factor without adding a phone number. This should also work if you want to use TOTP as a 2F instead of a Yubikey.

Re: Google's most ridiculous trick to force users into adding phone number

#133

Post by lxgr »

FrenchDevRemote wrote: post #116
charcircuit wrote: post #109

Earlier quoted context omitted.

ideally the paper would be in a safety deposit box / safe and not stuck to your monitor.

If it fits your need to have it a fixed location, then yes. But he talked about traveling. IDK about you but I don't travel with a safe in my backpack

Just put it in your wallet and/or luggage. Without your account name and password, it's useless to any potential thief.

Re: Google's most ridiculous trick to force users into adding phone number

#134

Post by bsamuels »

throw10920 wrote: post #122
bsamuels wrote: post #83

Earlier quoted context omitted.

Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. Attackers do not use their own hardware, and don't care about how much energy is used by their bot devices. In a normal attack, there are maybe 2-3 requests per hour that come from each hacker-owned device. The only thing that hashcat would do is drastically increase power consump…

> Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. False for a very large variety of low-power IoT devices using chips like the ESP32, which are multiple decimal orders of magnitude slower than a modern computer (or high-end smartphone) and will absolutely take far longer to compute a Hash cash challenge than one of those device…

You have no idea what you're talking about. Botnets are almost entirely ISP router/modem combo devices.

Hashcat was proposed over 20 years ago. You really think out of all the tens of thousands of security engineers working on this problem, nobody has ever considered it? Get a grip.

I hate how this website incentivizes people to try to make posts that sound smart instead of posting stuff they're actually knowledgeable about.

Re: Google's most ridiculous trick to force users into adding phone number

#135

Post by michaelt »

throw10920 wrote: post #70
bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1]. 250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who shou…

The problem with proof-of-work-for-login is:

Some of your attackers are going to run your proof-of-work algorithm on a 3090 Ti GPU and put loads of work into optimising their setup.

Some of your legitimate users are going to run it on a Raspberry Pi 1 with an ancient browser that only runs wasm through a javascript polyfill.

Tough to make up for a 1000x performance difference.

Re: Google's most ridiculous trick to force users into adding phone number

#136

Post by nprateem »

jjav wrote: post #126
bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

> Anyone who thinks this is about advertising/collecting personal data is out of their minds. Google is a public company, just look at their annual reports. Where do they make most revenue? Advertising. Thus, everything they do is about promoting advertising. It would be naive to think otherwise.

And how do they avoid wasting money and therefore increase their profits? By putting in automated systems, that in this case are good enough for the majority of non tech savvy, non paranoid users.

Re: Google's most ridiculous trick to force users into adding phone number

#137

Post by kevin_thibedeau »

lnxg33k1 wrote: post #93
loosescrews wrote: post #39

Earlier quoted context omitted.

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

Yeah I am sure too, my last company used google apps and I didn't want to use my personal number for google, but they forced me to insert a number in order to use 2FA, so I had to ask for a work SIM just so that google would STFU, it was said to be a backup method for google authenticator, f*uck google Companies using google apps, keep in mind, you pay money for a service but if there's google involved, you're still…

Microsoft plays the same games with their authenticator app.

Re: Google's most ridiculous trick to force users into adding phone number

#139

Post by kevin_thibedeau »

0daystock wrote: post #54

Google is no saint, but there's absolutely no reason to ascribe ill intent to collecting phone numbers of 2FA setup. The reason is simple: Google has billions of users, and at any given time, a lot of them break their devices and lose access to 2FA credentials. Phone numbers, despite all their flaws, are still the most reliable long-term and mostly-immutable attributes which can service as a proxy for identity which…

Then what happens when you change phone numbers and don't bother registering it with Google? There is a real risk of you becoming a non-person by linking things that shouldn't ever be linked.

Re: Google's most ridiculous trick to force users into adding phone number

#140

Post by doublepg23 »

superkuh wrote: post #8

Good thing I switched to running my own mailserver in 2013. Now I'm completely independent of google and google accounts. If my @gmail.com email stops working with Thunderbird or other imap clients then that's that. I'm done using gmail. Google hates open protocols. Don't let their claims of OAuth being open fool you. They don't use OAuth, they use OAuth 2 which is the mega-corp version shoved down the IETF's throat…

Linode managed to get blacklisted by Microsoft for weeks. I don't think you should expect a single mailserver to be able to survive in the current email climate.

While email may be open it was designed in a pre-spam era and we've been fighting the oversights ever since.

Post reply on HN