Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#171

Post by JADev62096 »

rsync wrote: post #104
14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

A "2FA Mule" is a special kind of burner phone that forwards the authentication to the endpoint of your choice - in my case, email: https://news.ycombinator.com/item?id=29710908

How much do you pay monthly to keep the extra number? Is it worth that?

Re: Google's most ridiculous trick to force users into adding phone number

#172

Post by yjftsjthsd-h »

QuikAccount wrote: post #25
jqpabc123 wrote: post #7

I guess I'll just have to stop using google. Welcome to the club. The fastest way to convince me *not* to use a product is to attach a "Google" label to it. Nothing Google has to offer justifies the drawbacks. NOTE: I do use an Android phone --- but only after it has been thoroughly de-Googled --- starting from a stripped down, bare metal device that won't even power up.

> NOTE: I do use an Android phone --- but only after it has been thoroughly de-Googled --- starting from a stripped down, bare metal device that won't even power up. You're going to have to explain to me. Particularly the "starting from a stripped down, bare metal device that won't even power up. Because this sounds excessive and a bit over the top.

It probably means something like, "buy a phone, unlock its bootloader, and wipe its data and system partition(s), after which you can flash a ROM of your choice onto the now mostly-blank machine". Depending on the device, you can probably even wipe the vendor partition. Any ways, the point is that in the middle there you have a device with no OS present (hence unable to boot) and probably no Google-ware, so if you flash a privacy-friendly ROM and don't re-add GApps it won't talk to Google.

Re: Google's most ridiculous trick to force users into adding phone number

#173

Post by PeterisP »

bbbbbr wrote: post #89
loosescrews wrote: post #39

Earlier quoted context omitted.

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

This is correct. A phone number is NOT required to enable 2FA, at least in my experience within the last few months. I set up 2FA to use Yubikey hardware keys for a google account, and was then allowed to generated app passwords. No phone number has ever been attached to the account. I do agree that not allowing app-passwords to be generated without setting up 2FA is coercive and seems hard to justify, and it is plau…

This may be a recent change, a few years ago when I tried this, I was definitely unable to add Yubikeys to a Google account until I added phone-based 2FA first.

If now it's just 'not recommended' then this is an improvement.

Re: Google's most ridiculous trick to force users into adding phone number

#175

Post by tatersolid »

kevin_thibedeau wrote: post #137
lnxg33k1 wrote: post #93

Earlier quoted context omitted.

Yeah I am sure too, my last company used google apps and I didn't want to use my personal number for google, but they forced me to insert a number in order to use 2FA, so I had to ask for a work SIM just so that google would STFU, it was said to be a backup method for google authenticator, f*uck google Companies using google apps, keep in mind, you pay money for a service but if there's google involved, you're still…

Microsoft plays the same games with their authenticator app.

No they don’t. I run an M365/Azure shop and not a single user out of hundreds has given their mobile number to Microsoft.

My personal consumer MSFT/Xbox account also has no mobile number attached.

Re: Google's most ridiculous trick to force users into adding phone number

#176

Post by kevin_thibedeau »

tatersolid wrote: post #175
kevin_thibedeau wrote: post #137

Earlier quoted context omitted.

Microsoft plays the same games with their authenticator app.

No they don’t. I run an M365/Azure shop and not a single user out of hundreds has given their mobile number to Microsoft. My personal consumer MSFT/Xbox account also has no mobile number attached.

Yes they do when your M365 using employer insists that you have to use the authenticator app on your personal phone and won't provide an alternative option.

Re: Google's most ridiculous trick to force users into adding phone number

#177

Post by jqpabc123 »

QuikAccount wrote: post #148
jqpabc123 wrote: post #129

Earlier quoted context omitted.

Unfortunately, what Google embeds into Android software is significantly more adverse than just "shellac". A standard Android phone sends your IMEI and SIM card info to Google servers on boot up before you even have a chance to login.

Citation for this?

https://www.scss.tcd.ie/doug.leith/apple_google.pdf

Re: Google's most ridiculous trick to force users into adding phone number

#178

Post by sergiotapia »

29athrowaway wrote: post #49
sergiotapia wrote: post #26

Earlier quoted context omitted.

I bought Pixel phones for my wife and I because the price and ease of use to save my kids pictures was absolutely worth it. I haven't found a service that functions as well as Google Photos. She takes pics and I take pics, and we have a shared account that backs it all up without any messing about. I have done precisely ZERO tech support for my wife since buying this service and phones and I will probably never leave…

Amazon Photos

Used it before the pixel. It sucks and has this sheen of cobbled together and just good enough to launch but not a great experience.

Re: Google's most ridiculous trick to force users into adding phone number

#179

Post by sergiotapia »

Graffur wrote: post #87
sergiotapia wrote: post #26

Earlier quoted context omitted.

I bought Pixel phones for my wife and I because the price and ease of use to save my kids pictures was absolutely worth it. I haven't found a service that functions as well as Google Photos. She takes pics and I take pics, and we have a shared account that backs it all up without any messing about. I have done precisely ZERO tech support for my wife since buying this service and phones and I will probably never leave…

How do you see eachothers photos though?

We're in a family plan and share all pics. My wife and I have total access to each others phones as well so it just made sense to share all pics to our "family plan".

Re: Google's most ridiculous trick to force users into adding phone number

#180

Post by TheDong »

throw10920 wrote: post #130
FrenchDevRemote wrote: post #107

Earlier quoted context omitted.

the average person don't have any idea what's a hardware token. google is not catering to HN readers, they're catering to your grandma, your parents, your little brother/sister, your tech illiterate neighbor. They couldn't care less about the habits of a nerd on archlinux with ublock, noscript, firefork a vpn, hardware tokens and 2FA everywhere with recovery code split in 7 different location.

This is a straw-man. The problem is not that Google is designing their services to cater to the average tech-illiterate user, it's that they're preventing the tech-literate users from opting out of phone recovery and/or using something more sane, like what's been listed above. That's clearly malice. Like, there's no good reason that Google would require you to hand over a phone number.

> That's clearly malice. Like, there's no good reason that Google would require you to hand over a phone number.

Let me give you a reasonable non-malicious reason:

Googler A: "We have this new attack. People are creating accounts from compromised IPs, and then creating app passwords to send huge amounts of gmail spam through SMTP directly, thus avoiding our browser-based spam mechanisms"

Googler B: "Can we ban them?"

A: "We can't ban them because we have no info on them, just sign-up IP, and the botnet has practically unlimited IPs"

B: "What about forcing them to have a phone number so we can do anti-spam on that, and perma-ban compromised phone numbers from making new accounts?"

A: "Good idea, that'll stop such a huge quantity of phishing emails and spam. That'll be good for the internet as a whole"

----

See, a non-malicious explanation.

Post reply on HN