Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#211

Post by mid-kid »

kybernetikos wrote: post #41
sergiotapia wrote: post #26

Earlier quoted context omitted.

I bought Pixel phones for my wife and I because the price and ease of use to save my kids pictures was absolutely worth it. I haven't found a service that functions as well as Google Photos. She takes pics and I take pics, and we have a shared account that backs it all up without any messing about. I have done precisely ZERO tech support for my wife since buying this service and phones and I will probably never leave…

I have a system involving syncthing fork set up on my families phones and computers. I have to admit it was fiddly to set up but it has run very smoothly with no maintainence since then.

Why a fork? What's the fork do?

Re: Google's most ridiculous trick to force users into adding phone number

#212

Post by mid-kid »

pferde wrote: post #55

I too was hit by this a few months ago, after having to create a Google account for work, and worked around it by running an android emulator where I installed their authenticator app. This was enough to get past the stupid "you have to have a phone" requirement, and gave me access to the TOTP secret, which I then promptly added to my favourite open source 2FA utility. Screw you, Google, you're not getting my phone n…

You can just scan the QR code instead... The TOTP secret is contained in there, and can be copied into just about any password manager.

Re: Google's most ridiculous trick to force users into adding phone number

#213

Post by no_time »

drsh2k wrote: post #199
accuratefud wrote: post #64

Earlier quoted context omitted.

Man, this thread is such a shinning example of why "trust, but verify" is a phrase. There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.

use virtual authenticator ( https://developer.chrome.com/docs/devtools/webauthn/ )

Does that actually work? I assume google verifies the authenticity keypair(I forgot the specific term) that cannot be extracted authentic devices.

Re: Google's most ridiculous trick to force users into adding phone number

#214

Post by throwaway81523 »

nunez wrote: post #186
throwaway81523 wrote: post #164

Earlier quoted context omitted.

> It's not even about not willing to spend 1$ for a random phone number. Some sites (e.g. Scaleway.com) won't accept VOIP numbers: they require numbers from actual mobile networks. That is a pain for me since my main phone# is a VOIP number that forwards to my mobile. I do that so I can change my mobile number and just update the forwarding target, or can forward to a landline if I'm someplace with a lousy mobile sig…

get an ultra cheap prepaid line then cancel some (like visible) allow you to sign up without providing any of your own PII

That defeats the purpose, which is to give them a number that works in case they have to contact me. I have a stable VOIP number that forwards to one of various ephemeral numbers at any given time. The VOIP number really is the right one to give them and for them to use. But they are too smart for their own good.

Re: Google's most ridiculous trick to force users into adding phone number

#215

Post by no_time »

kevin_thibedeau wrote: post #137
lnxg33k1 wrote: post #93

Earlier quoted context omitted.

Yeah I am sure too, my last company used google apps and I didn't want to use my personal number for google, but they forced me to insert a number in order to use 2FA, so I had to ask for a work SIM just so that google would STFU, it was said to be a backup method for google authenticator, f*uck google Companies using google apps, keep in mind, you pay money for a service but if there's google involved, you're still…

Microsoft plays the same games with their authenticator app.

So far all the services that required MS authenticator for me turned out to be perfectly fine standard TOTP.

Re: Google's most ridiculous trick to force users into adding phone number

#216

Post by kybernetikos »

mid-kid wrote: post #211
kybernetikos wrote: post #41

Earlier quoted context omitted.

I have a system involving syncthing fork set up on my families phones and computers. I have to admit it was fiddly to set up but it has run very smoothly with no maintainence since then.

Why a fork? What's the fork do?

https://github.com/Catfriend1/syncthing-android/blob/main/RE...

When I set it all up, I think the fork had much better behaviour around folder permissions for non-root users, I'm not sure if that's true any more.

Re: Google's most ridiculous trick to force users into adding phone number

#217

Post by elric »

Nextgrid wrote: post #125
elric wrote: post #22

Earlier quoted context omitted.

Depends on where you live. In my neck of the woods, burner phones are illegal. It's (nominally) impossible to get a phone number without getting ID verification. This applies to physical sims, but also to online services à la Twilio.

Providing ID verification to the carrier/government is one thing, providing it to Google is another. I'm personally much more comfortable with the government or carrier knowing my number than Google.

Sure, but that wasn't my point. My point was that it's very difficult to use a burner phone to bypass Google's data-guzzling.

Re: Google's most ridiculous trick to force users into adding phone number

#218

Post by fennecfoxy »

throw10920 wrote: post #122
bsamuels wrote: post #83

Earlier quoted context omitted.

Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. Attackers do not use their own hardware, and don't care about how much energy is used by their bot devices. In a normal attack, there are maybe 2-3 requests per hour that come from each hacker-owned device. The only thing that hashcat would do is drastically increase power consump…

> Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. False for a very large variety of low-power IoT devices using chips like the ESP32, which are multiple decimal orders of magnitude slower than a modern computer (or high-end smartphone) and will absolutely take far longer to compute a Hash cash challenge than one of those device…

Yeah the majority of them aren't Wifi lightbulbs afaik it's mostly routers and other similar devices, so they really do have the power of a low-mid range smartphone.

Realistically though as long as it can send a request I think attackers would prefer lower power devices someone's computer may be able to send many more r/s but much harder to gain control of versus the $30 iot device.

Re: Google's most ridiculous trick to force users into adding phone number

#219

Post by fmajid »

birksherty wrote: post #170
accuratefud wrote: post #64

Earlier quoted context omitted.

Man, this thread is such a shinning example of why "trust, but verify" is a phrase. There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.

Almost nobody in the world have physical key and they shouldn't need to buy one when 2fa apps are sufficient for most people.

TOTP doesn’t protect against phishing, U2F keys do. Sadly very few companies have them as an option, which goes to show how 2FA is mostly security theater at all but a handful of companies.

Re: Google's most ridiculous trick to force users into adding phone number

#220

Post by tinus_hn »

loosescrews wrote: post #39
vort3 wrote: post #6

It's not even about not willing to spend 1$ for a random phone number. Here's a list of things that are wrong with what Google does: - If you want to read your email, you have to use app specific password. I'm ok with that. - You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account. - You can't use authenticat…

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

Unfortunately because their Google Authenticator app refuses to backup half of the codes they have to make sure there is an escape hatch if you lose your phone.
Post reply on HN