Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#221

Post by tatersolid »

kevin_thibedeau wrote: post #176
tatersolid wrote: post #175

Earlier quoted context omitted.

No they don’t. I run an M365/Azure shop and not a single user out of hundreds has given their mobile number to Microsoft. My personal consumer MSFT/Xbox account also has no mobile number attached.

Yes they do when your M365 using employer insists that you have to use the authenticator app on your personal phone and won't provide an alternative option.

At no point during setup does Microsoft Authenticator app collect your mobile number. That is in fact the whole point of the app: SMS is insecure for 2FA so collecting a mobile number makes no sense.

Most of our people including myself choose to enroll a personal phone rather than carry two devices, and somehow none of these hundreds of people ever provided their mobile numbers to Microsoft. I think you are mis-remembering the setup experience, or your employer chose to enable some non-default options that uses SMS as a backup option to the app.

Re: Google's most ridiculous trick to force users into adding phone number

#222

Post by medstrom »

ryantgtg wrote: post #141
QuikAccount wrote: post #51

Earlier quoted context omitted.

> Google Smart Shellac No idea what this is and searching yields nail polish as the result.

I was making a (funny) joke that they put magic google paint on the phone, in addition to their software in the phone.

I like how you had to specify that it was funny.

Re: Google's most ridiculous trick to force users into adding phone number

#223

Post by pferde »

mid-kid wrote: post #212
pferde wrote: post #55

I too was hit by this a few months ago, after having to create a Google account for work, and worked around it by running an android emulator where I installed their authenticator app. This was enough to get past the stupid "you have to have a phone" requirement, and gave me access to the TOTP secret, which I then promptly added to my favourite open source 2FA utility. Screw you, Google, you're not getting my phone n…

You can just scan the QR code instead... The TOTP secret is contained in there, and can be copied into just about any password manager.

Please read the original post - the QR code (nor the TOTP secret in any other format) is simply not available until you enable either SMS authentication or the authentication app.

Afterwards, yes, you have the TOTP secret available for use in any tool you want - but I am repeating myself.

Re: Google's most ridiculous trick to force users into adding phone number

#224

Post by FDSGSG »

vort3 wrote: post #188
accuratefud wrote: post #64

Earlier quoted context omitted.

Man, this thread is such a shinning example of why "trust, but verify" is a phrase. There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.

True, I just didn't write that because physical security key is not an option where I live. Other than security key, it's only phone number or adding account to the phone. I'm sorry I didn't mention that in my post, I wasn't trying to lie, I just can't obtain physical key and I don't think I have to have physical key to read my emails.

Where is that? Judging by your comment history, maybe Kazakhstan? I can easily find physical security keys for sale in Kazakhstan. For example miningshop.kz in Almaty has Ledger Nano S in stock.

Besides, you don't need an actual physical key for U2F.

Re: Google's most ridiculous trick to force users into adding phone number

#225

Post by commonalitydev »

cheriot wrote: post #128
throw10920 wrote: post #113

Earlier quoted context omitted.

Google is, uh, not just email. https://about.google/products/

The topic of the post was email. Even expanding to every other product, which ones are you forced to use? Just pick another one. Calling this feudalism is a bit much.

If I understood his post and overall point correctly, he doesn’t think that it’s that second possibility — that Google is a benevolent tyrant, essentially — but that that’s the only other explanation, which is bad.

(I agree that the language he used was a bit much, but I think he was using exaggeration as a legitimate literary device to make his point, not in an attempt to actually mischaracterize that scenario.)

He think it’s the first possibility — that Google is doing it for reasons other than the users’ best interests (i.e. “nefarious purposes”) — which is even worse.

Re: Google's most ridiculous trick to force users into adding phone number

#226

Post by jqpabc123 »

pb7 wrote: post #153
nprateem wrote: post #138

Shame HN is 80% tropes now from paranoid introverts who don't want to go back to the office and who could write Dropbox in half an hour

It's painfully obvious that a non trivial number of users here maintain little contact to ordinary people who make up 99% of the user base.

Most of the user base are "sheeple" who subscribe to whichever corporate marketing program has the largest budget. Google itself is a major player in this game.

  "You laugh because I'm different.
   I laugh because you're *normal."
*normal - Average, ordinary, unremarkable, the same

Re: Google's most ridiculous trick to force users into adding phone number

#227

Post by antifa »

mid-kid wrote: post #212
pferde wrote: post #55

I too was hit by this a few months ago, after having to create a Google account for work, and worked around it by running an android emulator where I installed their authenticator app. This was enough to get past the stupid "you have to have a phone" requirement, and gave me access to the TOTP secret, which I then promptly added to my favourite open source 2FA utility. Screw you, Google, you're not getting my phone n…

You can just scan the QR code instead... The TOTP secret is contained in there, and can be copied into just about any password manager.

Google never offered a QR code like 99% of other MFAs.

Re: Google's most ridiculous trick to force users into adding phone number

#230

Post by jqpabc123 »

loosescrews wrote: post #39
vort3 wrote: post #6

It's not even about not willing to spend 1$ for a random phone number. Here's a list of things that are wrong with what Google does: - If you want to read your email, you have to use app specific password. I'm ok with that. - You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account. - You can't use authenticat…

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

I definitely don't have a phone number linked to my Google Account ...

If you use an Android phone, you most definitely do have a phone number associated with your Google Account. Android sends your IMEI and SIM card info to Google servers.

Post reply on HN