Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#61

Post by abawany »

vort3 wrote: post #3
14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

Can you recommend me any real working website where I could buy cheap one time virtual number that could be used to enable 2FA for my account? And I hope they will never ever again ask me to confirm anything using that number.

I have used voip.ms for years. The basic plan costs approx 1 usd/m with no contracts, etc. and any messages received can be forwarded to and responded from email.

Re: Google's most ridiculous trick to force users into adding phone number

#62

Post by turdnagel »

Just one thing keeping me on Google for email/calendars: Search. I recently switched back to the Gmail app away from Spark for this. Don't have any examples off the top of my head, but I routinely encountered situations where I'd search for something in Spark or the Apple Mail client and couldn't find it out without using Gmail desktop/app.

Re: Google's most ridiculous trick to force users into adding phone number

#63

Post by 0daystock »

butz wrote: post #34

Does using 2FA for GMail login actually add more security? Especially considered that to enable it, first you have to use dubiously secure SMS 2FA.

It's still an additional authentication factor, so in most circumstances, yes it would benefit security. However, you can (and should) use U2F for 2FA, which involves hardware making cryptographic assertions that cannot be phished or man-in-the-middle'd. It's possible to remove SMS as an option after turning this on in Google settings, but unfortunately not so with many other providers.

Re: Google's most ridiculous trick to force users into adding phone number

#64

Post by accuratefud »

nagisa wrote: post #46
loosescrews wrote: post #39

Earlier quoted context omitted.

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

Google used to give more options before. Today if you want to set-up 2FA you must either give them a phone number or use a phone. Only then you can add other authentication methods (this a hardware key) and remove your phone as an option. Source: went through this nonsense a couple years ago and then again a couple months ago with a different account.

Man, this thread is such a shinning example of why "trust, but verify" is a phrase.

There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.

Re: Google's most ridiculous trick to force users into adding phone number

#65

Post by Ourgon »

sergiotapia wrote: post #26
jqpabc123 wrote: post #7

I guess I'll just have to stop using google. Welcome to the club. The fastest way to convince me *not* to use a product is to attach a "Google" label to it. Nothing Google has to offer justifies the drawbacks. NOTE: I do use an Android phone --- but only after it has been thoroughly de-Googled --- starting from a stripped down, bare metal device that won't even power up.

I bought Pixel phones for my wife and I because the price and ease of use to save my kids pictures was absolutely worth it. I haven't found a service that functions as well as Google Photos. She takes pics and I take pics, and we have a shared account that backs it all up without any messing about. I have done precisely ZERO tech support for my wife since buying this service and phones and I will probably never leave…

If ever you get tired of Google - and for those who get tired of Apple or Amazon or whomever they have entrusted their digital photo archiving needs to...

Any of the personal cloud things - Nexcloud, Owncloud, Seafile, Syncthing and others - can be used to sync files - and with that photos and videos - from mobile devices to some server somewhere. This can be the server-under-the-stairs, your NAS at home, a wall-wart with a Raspberry Pi and a drive taped together, a VPS or a commercial entity offering these as SaaS. You can keep using your phones with or without Google, that is up to you. If you run the stuff yourself you'll need to install and configure the parts which make it work, if you use a commercial instance you just have to install the relevant app and tell it to sync your data. You can do this in parallel to using Google Photos, just to make sure you have a backup in case Google wants just that one extra piece of personal data to allow you to access your photos which makes you give up on them. Just one more piece... and one more please...

Re: Google's most ridiculous trick to force users into adding phone number

#66

Post by bxparks »

14 wrote: post #2

The only solution I can see is buying a burner phone to avoid these situations. Yesterday tried to set up a new to me used iPhone 7 for my son. It too forces a phone number from you. I had to link my phone number to his phone which I didn’t really want to do.

The problem with using a burner phone is that you could be assigned a phone number that has been blacklisted due to its abuse by a previous owner. Then Google terminates your account as soon as you use the banned number.

Re: Google's most ridiculous trick to force users into adding phone number

#67

Post by negative_zero »

Thank you for posting this. I have had a second email account setup at the company I work for, and hit this exact problem. I thought I was going mad! Especially because I had enabled 2FA with TOTP with an existing company account just a few months ago.

Re: Google's most ridiculous trick to force users into adding phone number

#68

Post by pid-1 »

loosescrews wrote: post #39
vort3 wrote: post #6

It's not even about not willing to spend 1$ for a random phone number. Here's a list of things that are wrong with what Google does: - If you want to read your email, you have to use app specific password. I'm ok with that. - You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account. - You can't use authenticat…

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

I've tried that a few days ago.

You always need to add a phone as your first MFA method.

A simple hack though:you can add other methods, then remove phone.

Your account was likely created before phone MFA was mandatory (as the first method).

Re: Google's most ridiculous trick to force users into adding phone number

#69

Post by accuratefud »

browningstreet wrote: post #56

They call me about my car’s extended warranty every day whether google has my number or not. I also get a call, every day, precisely at 9:04am, from random numbers matching the first 6 digits of my phone number. Protecting my phone number is a dead effort on my end.

No post body was provided.

Re: Google's most ridiculous trick to force users into adding phone number

#70

Post by throw10920 »

bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

There are far better ways to stop credential stuffing than requiring a phone number that would be immediately obvious to the people at Google - Hashcash, for instance[1].

250M login attempts times a few seconds of CPU time is a lot of compute cost to inflict on an attacker who is carrying out the same attack against a bunch of other services at once, and virtually nothing to the few thousands of active users who should only be logging in once every few months each.

And yes, a few extra seconds of logon time is viable, because people are used to the login process taking a few seconds and they don't do it very frequently.

"Credential stuffing" is straight-up an invalid excuse for asking for someone's phone number.

[1] https://en.wikipedia.org/wiki/Hashcash

Post reply on HN