6 ms·

> Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily. I finally set up 2FA on my Goo

> Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily. I finally set up 2FA on my Google account this weekend. It struck me as incredibly odd that Google requires a phone number to enable 2FA. NIST recently advocated against using SMS for OoB auth. [0] If I had been an account hijacker with the password (e.g. obtained via phishing) it would have been ludicrously simple for me to enable 2FA on someone else's account. I don't understand, I already have an Android phone with Google Play Services installed. Why isn't pressing "Okay" on my phone sufficient? It's certainly not any more insecure than an SMS. What I view as even worse is on the first attempt the SMS didn't go through, so I asked Google to give me a call. Evidently my provider blocks whatever number they're using to call out of, so my phone never rang. But Google left the verification code anyway, AS A VOICEMAIL! My inner tin foil hat says Google wants a phone number for other purposes. [0] www.securityweek.com/nist-denounces-sms-2fa-what-are-alternatives

mark242 10y ago
"My inner tin foil hat says Google wants a phone number for other purposes." "I already have an Android phone with Google Play Services installed." Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users.
- kogepathic 10y ago
  > Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users. Only if the phone number is the same one I use for my Android phone. But yes, I realize that any SIM I put into my phone will also be known by Google. It's just an incredibly shit onboarding method. They already have a more secure way than SMS to determine the account owner, so why not offer it as an option?
herbst 10y ago
> My inner tin foil hat says Google wants a phone number for other purposes. Just like Twitter these days. "Telephone number is optional and for your security". 2 minutes later my new accounts are always locked and i need to provide a telephone number to enable it again. They used SMS until recently, now they use a call service which only works with a fraction of numbers. (Tried 2 thai, 1 cambodian number, none accepted) I seriously dont get what they are trying to do other than creating a database of telephone numbers and locking users in third world countries out. Also agree with that Google actually knows enough to just verifiy it based on my phone. Telephone number is not necessary, especially i "verified" my account in the past with a phone call, why again?
- Freak_NL 10y ago
  Steam does this as well. Even if you add your phone number after a lot of nagging, Steam still keeps bothering you to install their Android or IOS authenticator software (even if you can't). I wish Steam would consider Fido U2F as well, but getting through to anyone who can influence this at Valve is nigh impossible. It seems to be the industry status quo now to assume that everyone uses a smartphone running either Android or IOS, and that everyone wants to use that device for authentication. Meanwhile the tech giants (especially those involved in advertising) probably like having that nice unique alphanumerical identifier for your profile — it tends to be the same for all services you use. I really hope Fido U2F becomes a de facto alternative for 2FA.
  - herbst 10y ago
    Steam, at least, does not seem to have a issue sending me emails. Sure it annoys me to use their app or whatever, but i can choose to only receive emails. Which is really all i actually want :) But i agree on everything said
  - Jordrok 10y ago
    Yeah, I just ran into something similar a few days ago. Every once in a while I used to go through all my trading cards and bulk sell all my duplicates for a few cents each, but apparently now they require you to use some combination of SMS and mobile app authentication to post anything on the market. Clicking through the confirmation email they send you isn't enough on its own. So now I just don't bother with trading cards at all.

mark242 10y ago

"My inner tin foil hat says Google wants a phone number for other purposes." "I already have an Android phone with Google Play Services installed." Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users.

kogepathic 10y ago
> Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users. Only if the phone number is the same one I use for my Android phone. But yes, I realize that any SIM I put into my phone will also be known by Google. It's just an incredibly shit onboarding method. They already have a more secure way than SMS to determine the account owner, so why not offer it as an option?

herbst 10y ago

> My inner tin foil hat says Google wants a phone number for other purposes. Just like Twitter these days. "Telephone number is optional and for your security". 2 minutes later my new accounts are always locked and i need to provide a telephone number to enable it again. They used SMS until recently, now they use a call service which only works with a fraction of numbers. (Tried 2 thai, 1 cambodian number, none accepted) I seriously dont get what they are trying to do other than creating a database of telephone numbers and locking users in third world countries out. Also agree with that Google actually knows enough to just verifiy it based on my phone. Telephone number is not necessary, especially i "verified" my account in the past with a phone call, why again?

Freak_NL 10y ago
Steam does this as well. Even if you add your phone number after a lot of nagging, Steam still keeps bothering you to install their Android or IOS authenticator software (even if you can't). I wish Steam would consider Fido U2F as well, but getting through to anyone who can influence this at Valve is nigh impossible. It seems to be the industry status quo now to assume that everyone uses a smartphone running either Android or IOS, and that everyone wants to use that device for authentication. Meanwhile the tech giants (especially those involved in advertising) probably like having that nice unique alphanumerical identifier for your profile — it tends to be the same for all services you use. I really hope Fido U2F becomes a de facto alternative for 2FA.
- herbst 10y ago
  Steam, at least, does not seem to have a issue sending me emails. Sure it annoys me to use their app or whatever, but i can choose to only receive emails. Which is really all i actually want :) But i agree on everything said
- Jordrok 10y ago
  Yeah, I just ran into something similar a few days ago. Every once in a while I used to go through all my trading cards and bulk sell all my duplicates for a few cents each, but apparently now they require you to use some combination of SMS and mobile app authentication to post anything on the market. Clicking through the confirmation email they send you isn't enough on its own. So now I just don't bother with trading cards at all.