Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#151

Post by kevin_thibedeau »

momirlan wrote: post #45
mxuribe wrote: post #16

So, at what point will there be a legitimate third option other than Google android phones (and associated ecosystem) and Apple iphones (and associatyed ecosystem)??? And, no, i don't mean rooting a phone, etc. to install Lineage or other alternative operating systems on it. I mean, i want to go out, buy a phone that is decent enough for the basics of what i need to do and is de-googled...not too crazy expensive like…

nokia 3220

With any new employer be sure to show up with just a featurephone so you can shoot down any brain dead attempt to force you to link your personal property to corporate authentication.

Re: Google's most ridiculous trick to force users into adding phone number

#152

Post by prirun »

pid-1 wrote: post #68
loosescrews wrote: post #39

Earlier quoted context omitted.

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

I've tried that a few days ago. You always need to add a phone as your first MFA method. A simple hack though:you can add other methods, then remove phone. Your account was likely created before phone MFA was mandatory (as the first method).

> A simple hack though:you can add other methods, then remove phone.

Sure. That's like when I deleted my DigitalOcean account. They still send me notices about their service. Just because something is deleted for you doesn't mean it's deleted for them.

Re: Google's most ridiculous trick to force users into adding phone number

#153

Post by pb7 »

nprateem wrote: post #138

Shame HN is 80% tropes now from paranoid introverts who don't want to go back to the office and who could write Dropbox in half an hour

It's painfully obvious that a non trivial number of users here maintain little contact to ordinary people who make up 99% of the user base.

Re: Google's most ridiculous trick to force users into adding phone number

#154

Post by [deleted] »

michaelt wrote: post #135
throw10920 wrote: post #70

Earlier quoted context omitted.

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1]. 250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who shou…

The problem with proof-of-work-for-login is: Some of your attackers are going to run your proof-of-work algorithm on a 3090 Ti GPU and put loads of work into optimising their setup. Some of your legitimate users are going to run it on a Raspberry Pi 1 with an ancient browser that only runs wasm through a javascript polyfill. Tough to make up for a 1000x performance difference.

[deleted]

Re: Google's most ridiculous trick to force users into adding phone number

#155

Post by xur17 »

bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

> Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with I ran into a similar situation (small, growing startup dealing with credential stuffing attacks). We have since implemented a few different solutions, but one of the most successful was rejecting reused passwords at signup using this service [0].

Some other effective solutions include captchas, emailing a verification code, etc. Aggressive rate limiting was not at all successful, as the botnets seem to have endless piles of residential ip addresses to send requests from.

[0] https://haveibeenpwned.com/Passwords

Re: Google's most ridiculous trick to force users into adding phone number

#156

Post by mxuribe »

momirlan wrote: post #45
mxuribe wrote: post #16

So, at what point will there be a legitimate third option other than Google android phones (and associated ecosystem) and Apple iphones (and associatyed ecosystem)??? And, no, i don't mean rooting a phone, etc. to install Lineage or other alternative operating systems on it. I mean, i want to go out, buy a phone that is decent enough for the basics of what i need to do and is de-googled...not too crazy expensive like…

nokia 3220

I guess i did walk into that one! :-)

Re: Google's most ridiculous trick to force users into adding phone number

#157

Post by mxuribe »

kevin_thibedeau wrote: post #151
momirlan wrote: post #45

Earlier quoted context omitted.

nokia 3220

With any new employer be sure to show up with just a featurephone so you can shoot down any brain dead attempt to force you to link your personal property to corporate authentication.

This is a great idea! :-)

Re: Google's most ridiculous trick to force users into adding phone number

#159

Post by eps »

Nextgrid wrote: post #111
zerocrates wrote: post #106

Earlier quoted context omitted.

Pretty sure they do support hardware tokens.

Only after you give them a phone number. In fact, they allow you to remove the phone number afterwards, so clearly they're happy with non-SMS 2FA being the only 2FA method on the account, as long as they first get the opportunity to stalk you beforehand.

Do they accept burner phone #s?

Re: Google's most ridiculous trick to force users into adding phone number

#160

Post by wolverine876 »

bsamuels wrote: post #134
throw10920 wrote: post #122

Earlier quoted context omitted.

> Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. False for a very large variety of low-power IoT devices using chips like the ESP32, which are multiple decimal orders of magnitude slower than a modern computer (or high-end smartphone) and will absolutely take far longer to compute a Hash cash challenge than one of those device…

You have no idea what you're talking about. Botnets are almost entirely ISP router/modem combo devices. Hashcat was proposed over 20 years ago. You really think out of all the tens of thousands of security engineers working on this problem, nobody has ever considered it? Get a grip. I hate how this website incentivizes people to try to make posts that sound smart instead of posting stuff they're actually knowledgeabl…

> Botnets are almost entirely ISP router/modem combo devices.

Above you say they are IoT devices. I don't mean 'gotcha', but to learn: What does the population of botnet devices consist of?

Post reply on HN