Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#231

Post by smaryjerry »

throw10920 wrote: post #122
bsamuels wrote: post #83

Earlier quoted context omitted.

Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. Attackers do not use their own hardware, and don't care about how much energy is used by their bot devices. In a normal attack, there are maybe 2-3 requests per hour that come from each hacker-owned device. The only thing that hashcat would do is drastically increase power consump…

> Attackers are using hacked IoT devices to do these attacks. These devices have roughly the same computing power as a mid level smartphone. False for a very large variety of low-power IoT devices using chips like the ESP32, which are multiple decimal orders of magnitude slower than a modern computer (or high-end smartphone) and will absolutely take far longer to compute a Hash cash challenge than one of those device…

This is ab irrelevant tangent on the mid level phone comment. We all know you don’t need any compute power at all to make “2-3 login attempts per hour” even on the slowest of IOT devices.

Re: Google's most ridiculous trick to force users into adding phone number

#232

Post by kevin_thibedeau »

tatersolid wrote: post #221
kevin_thibedeau wrote: post #176

Earlier quoted context omitted.

Yes they do when your M365 using employer insists that you have to use the authenticator app on your personal phone and won't provide an alternative option.

At no point during setup does Microsoft Authenticator app collect your mobile number. That is in fact the whole point of the app: SMS is insecure for 2FA so collecting a mobile number makes no sense. Most of our people including myself choose to enroll a personal phone rather than carry two devices, and somehow none of these hundreds of people ever provided their mobile numbers to Microsoft. I think you are mis-remem…

Prior to Android 11 no permission was required to retrieve a phone number via the API.

Re: Google's most ridiculous trick to force users into adding phone number

#233

Post by pb7 »

jqpabc123 wrote: post #226
pb7 wrote: post #153

Earlier quoted context omitted.

It's painfully obvious that a non trivial number of users here maintain little contact to ordinary people who make up 99% of the user base.

Most of the user base are "sheeple" who subscribe to whichever corporate marketing program has the largest budget. Google itself is a major player in this game. "You laugh because I'm different. I laugh because you're *normal." *normal - Average, ordinary, unremarkable, the same

Using "sheeple" unironically says more about you than it does about them. There's nothing remarkable about being too socially stunted to be able to acknowledge groups beyond your own.

Re: Google's most ridiculous trick to force users into adding phone number

#234

Post by Handytinge »

accuratefud wrote: post #64
nagisa wrote: post #46

Earlier quoted context omitted.

Google used to give more options before. Today if you want to set-up 2FA you must either give them a phone number or use a phone. Only then you can add other authentication methods (this a hardware key) and remove your phone as an option. Source: went through this nonsense a couple years ago and then again a couple months ago with a different account.

Man, this thread is such a shinning example of why "trust, but verify" is a phrase. There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.

This may vary regionally. I went through this with an account recently and did not have this option, despite looking for it (as I do have a hardware key).

Re: Google's most ridiculous trick to force users into adding phone number

#235

Post by throw10920 »

michaelt wrote: post #135
throw10920 wrote: post #70

Earlier quoted context omitted.

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1]. 250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who shou…

The problem with proof-of-work-for-login is: Some of your attackers are going to run your proof-of-work algorithm on a 3090 Ti GPU and put loads of work into optimising their setup. Some of your legitimate users are going to run it on a Raspberry Pi 1 with an ancient browser that only runs wasm through a javascript polyfill. Tough to make up for a 1000x performance difference.

3090 Ti's are very hard to come by - an attacker will need to either have malware on gaming rigs (which are user-facing devices and so have higher odds of detection, especially if you're loading those GPUs), be paying for cloud compute (money out of their pockets), or own the GPU themselves (more money out of their pockets) - so that's a significant cost imposed on them - which is greatly amplified given the above figure of 25k login attempts per month per user per service.

Those legitimate users logging in on a Raspberry Pi 1 are going to be in the vast minority (probably about 0.001%, if not less, as evidenced by the relative marketshares of Windows vs Linux, and how rare Raspberry Pi's are for desktop use relative to normal x86 machines) of users of your service - it's OK for them to have 20s-30s logon times in exchange for (1) not requiring PII from users and (2) less credential stuffing.

Certainly, Raspberry Pi users are more rare than Internet Explorer users, which many developers simply refuse to support at all.

In particular, I am ok with having 30s logon times for services for my desktop computers (assuming that I only have to log on once every few months and not every few minutes like my brain-dead bank requires), so it's more than reasonable to expect those with an extremely niche and underpowered setup to have to wait that long for a very infrequent login process - again, for the sake of security and privacy.

Re: Google's most ridiculous trick to force users into adding phone number

#236

Post by [deleted] »

wolverine876 wrote: post #160
bsamuels wrote: post #134

Earlier quoted context omitted.

You have no idea what you're talking about. Botnets are almost entirely ISP router/modem combo devices. Hashcat was proposed over 20 years ago. You really think out of all the tens of thousands of security engineers working on this problem, nobody has ever considered it? Get a grip. I hate how this website incentivizes people to try to make posts that sound smart instead of posting stuff they're actually knowledgeabl…

> Botnets are almost entirely ISP router/modem combo devices. Above you say they are IoT devices. I don't mean 'gotcha', but to learn: What does the population of botnet devices consist of?

[deleted]

Re: Google's most ridiculous trick to force users into adding phone number

#237

Post by abawany »

jqpabc123 wrote: post #191
abawany wrote: post #61

Earlier quoted context omitted.

I have used voip.ms for years. The basic plan costs approx 1 usd/m with no contracts, etc. and any messages received can be forwarded to and responded from email.

Nice try but this won't work with a lot of security providers. Lookup APIs are available to identify line type and most will specifically reject voip numbers. The more obstinate providers I have encountered (some banks for example) will actually have a real human place a call to any number provided at sign up and reject it if they can't verbally talk to you.

It supports voice as well at this price - I use it with Linphone to receive and place calls plus I was also able to setup a forward rule where any calls to voip.ms numbers will be forwarded to my cellphone. Edit: you are right though that plenty of providers reject it as being a voip number.

Re: Google's most ridiculous trick to force users into adding phone number

#238

Post by lxgr »

justinclift wrote: post #192
lxgr wrote: post #133

Earlier quoted context omitted.

Just put it in your wallet and/or luggage. Without your account name and password, it's useless to any potential thief.

Lots of people's luggage include enough info to work out their name and likely home location, which is commonly enough to work out their username for a lot of popular services. That makes the whole "stolen luggage" thing even far riskier. :/

But hopefully your luggage does not contain your Google account password.

Again, the recovery code is one factor.

Re: Google's most ridiculous trick to force users into adding phone number

#239

Post by fsflover »

mxuribe wrote: post #16

So, at what point will there be a legitimate third option other than Google android phones (and associated ecosystem) and Apple iphones (and associatyed ecosystem)??? And, no, i don't mean rooting a phone, etc. to install Lineage or other alternative operating systems on it. I mean, i want to go out, buy a phone that is decent enough for the basics of what i need to do and is de-googled...not too crazy expensive like…

Here you go: https://puri.sm/products/librem-5 and https://pine64.org/pinephone.
Post reply on HN