Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's most ridiculous trick to force users into adding phone number

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 250 posts

Re: Google's most ridiculous trick to force users into adding phone number

#71

Post by antisthenes »

bsamuels wrote: post #52

Every tech company is losing the war against credential stuffing. I have a friend working at a series B startup with None of the service providers who claim to fix the issue are worth their weight in salt. Shape, Akamai, none of them have a grip on the problem because the attackers are constantly evolving. As you can see, even Google is capitulating despite all the fud that people on HN spread about the company being…

> Anyone who thinks this is about advertising/collecting personal data is out of their minds.

For the end user it is absolutely about collecting additional personal data. My concerns as a user are not the concerns of Alphabet, the company, period.

Re: Google's most ridiculous trick to force users into adding phone number

#72

Post by malux85 »

loosescrews wrote: post #39
vort3 wrote: post #6

It's not even about not willing to spend 1$ for a random phone number. Here's a list of things that are wrong with what Google does: - If you want to read your email, you have to use app specific password. I'm ok with that. - You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account. - You can't use authenticat…

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

I've seen different authentication methods for different countries etc, for example there are some countries that if you put in your age as > 70 when signing up, the combination of being old and in a poorer country means google never asks you for a phone number, because it's likely you don't have a cellphone.

So the rules can vary by region

Re: Google's most ridiculous trick to force users into adding phone number

#73

Post by accuratefud »

pid-1 wrote: post #68
loosescrews wrote: post #39

Earlier quoted context omitted.

> You can't use authenticator app to enable 2FA Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app. Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.

I've tried that a few days ago. You always need to add a phone as your first MFA method. A simple hack though:you can add other methods, then remove phone. Your account was likely created before phone MFA was mandatory (as the first method).

No post body was provided.

Re: Google's most ridiculous trick to force users into adding phone number

#74

Post by Melatonic »

Couldn't you just install the Google Profile on any android tablet or spare phone or something, set it up, switch to authenticator (on your normal phone) and then remove the accounts and whatnot from the tablet? Never use SMS at all?

The real head scratcher for me here though is that you are fine with Google hosting all of your emails and whatnot but knowing the phone number is a huge problem? If you do not trust Google with your phone number it seems like going with another email service would probably already be a good decision.....

Re: Google's most ridiculous trick to force users into adding phone number

#75

Post by eternityforest »

vort3 wrote: post #6

It's not even about not willing to spend 1$ for a random phone number. Here's a list of things that are wrong with what Google does: - If you want to read your email, you have to use app specific password. I'm ok with that. - You can't generate app specific passwords if you don't have 2FA enabled. That's some artificial limitation made to force you into adding phone number to your account. - You can't use authenticat…

I never thought of the whole idea of wanting to hide my number from them, and I suspect most other users haven't either, but it does seem like an issue once you think about it.

It might have something to do with not wanting to have tons of spam accounts out there? Do they have code to keep a closer eye on unverified accounts?

Or preventing broken devices from locking people out, in a "We must protect users from themselves" kind of way?

Google is a mass market company, clearly not a privacy company, anyone who really wants to not be constantly tracked should probably stay away for many more reasons than this.

Re: Google's most ridiculous trick to force users into adding phone number

#76

Post by throw10920 »

markdown wrote: post #13
jqpabc123 wrote: post #7

I guess I'll just have to stop using google. Welcome to the club. The fastest way to convince me *not* to use a product is to attach a "Google" label to it. Nothing Google has to offer justifies the drawbacks. NOTE: I do use an Android phone --- but only after it has been thoroughly de-Googled --- starting from a stripped down, bare metal device that won't even power up.

HN needs a bot that posts an inb4 comment every time there's a post about Google or a Google product. These predictable responses don't add any value whatsoever, and they're tiring to read.

Downvote and move on - adding a low-value comment of your own worsens the problem in some ways.

Re: Google's most ridiculous trick to force users into adding phone number

#77

Post by throw10920 »

snihalani wrote: post #20
ad404b8a372f2b9 wrote: post #15

Every new feature from Google is a middle finger to their users, then you get some corporate double speak about how it's all well and good and how it makes the product better. Get a Fastmail account, I got one after I got tired of google breaking my IMAP settings every other week. They're cheap, they have most everything you'd need from an email provider, and they don't require a special app like proton.

I tried fastmail and then there was no search on the drive aspect. had to move back to google

Fastmail is great at email. If you want a G Suite experience, then you'll need...well, Google.

Re: Google's most ridiculous trick to force users into adding phone number

#78

Post by eternityforest »

Szpadel wrote: post #30
im3w1l wrote: post #18

Earlier quoted context omitted.

> That's some artificial limitation made to force you into adding phone number to your account. Agreed > You can't use authenticator app to enable 2FA. I have no idea why SMS which is the least secure way to send information is a primary method and authenticator app which can be set up by scanning QR from the screen without sending any information at all is «secondary» and can only be used after you give your phone n…

not only lost phone, but damaged phone is enough, as you can easily swap sim card but authenticator need to be set up again. BUT there are also one time recovery codes, they could add you option to use those to recover after clicking through few screens of warnings to make sure that you know what consequences does it have

That's one reason I definitely prefer SMS auth to any other method at the moment.

What if your phone is damaged while traveling and you are away from where you stored your recovery keys?

Re: Google's most ridiculous trick to force users into adding phone number

#79

Post by 0daystock »

walrus01 wrote: post #47

the thing about 'adding a phone number' is that hijacking somebody's DID is fairly trivial these days for a good social engineer, you get the customer service department at somebody's cellular carrier to port out the number, or activate it on a new SIM card put into a burner. the SS7/PSTN is horribly broken. SMS based "2FA" is not actual 2FA

I think "trivial" is generous. For context, the current market rates for a SIM swap ranges from several thousand USD (T-Mobile) to well over fifty thousand USD (Verizon). It is not really something most people should lose sleep over, in my opinion.

Re: Google's most ridiculous trick to force users into adding phone number

#80

Post by throw10920 »

0daystock wrote: post #54

Google is no saint, but there's absolutely no reason to ascribe ill intent to collecting phone numbers of 2FA setup. The reason is simple: Google has billions of users, and at any given time, a lot of them break their devices and lose access to 2FA credentials. Phone numbers, despite all their flaws, are still the most reliable long-term and mostly-immutable attributes which can service as a proxy for identity which…

This is an explanation for why Google might ask for phone numbers. This is not an explanation for why Google might require phone numbers.

The only valid reasons for the latter are (1) to collect your PII and/or (2) because they think that they know better than you and they're going to force you to do a thing because they think it's in your best interests - in other words, a tyrant ruling over a techno-feudalistic society.

If Google was really concerned only for the safety of their users, and not trying to obtain PII for their personal use, they would build an opt-out button, something that would allow users to print out a one-time-use password/encryption key, or register an alternate email address, in lieu of providing a phone number. They don't.

Your explanation doesn't hold water.

Post reply on HN