4 ms·
Do you have 2FA enabled? I suspect that if you have either an authenticator app or a security key, it will use that instead of random heuristics. (This isn't a
by geofft 6y ago
Do you have 2FA enabled? I suspect that if you have either an authenticator app or a security key, it will use that instead of random heuristics.
(This isn't a defense of Google's behavior, just a comment on things that are actually within the end user's control.)
- Triv888 6y agoI don't want 2FA and I have it disabled but they often ask me for more than my password which is like forcing 2FA on me (but what you say may be true).
- yspeak 6y agoWhy don't you want 2fa? What concern do you have? You can use fido key if you have concerns about the software authenticator. and you don't need to use your phone number.
- Can_Not 6y agoI tried to setup 2FA, Google would not let me setup an authenticator app without first giving Google a phone number.
- katbyte 6y agoIt’s phone number -> auth app -> umbikey -> remove phone number. None of my google accounts use my number for 2fa anymore
- TeMPOraL 6y agoI wonder if that last step shouldn't be followed by a GDPR notice to stop processing your phone number, if you're in Europe - because I don't imagine they aren't storing your number anyway, after you remove it from auth options.
- kelnos 6y agoI have a Twilio number I use as my Google recovery number (which is only used for that purpose). In my case, it's because I want to protect against SIM swapping attacks on my real phone number, but it also works for people who don't want to give out their real number. This doesn't work for services that send SMS 2FA codes and the like from a shortcode (as Twilio does not support receiving those), but Google appears to send from a longcode, so it works there.