4 ms·
Well, it's not like it's illegal to require a phone number. Google has simply decided that a phone number is a requirement due to security considerations.
by Sharlin 5y ago
Well, it's not like it's illegal to require a phone number. Google has simply decided that a phone number is a requirement due to security considerations.
- noduerme 5y agoSecurity has nothing to do with why they want your phone number. Your account is far less secure if it can be stolen with a sim card than if there's no 2fa at all.
- Sharlin 5y agoUm, Google’s ulterior motives aside, how is it less secure to require a physical artifact in order to authenticate? SMS may not be the most secure channel ever, and SIM swap scamming is a thing, but seems to me that breaking even SMS-based 2FA requires quite a lot of effort per victim.
- idiotsecant 5y agoIf I want your account and you have SMS based password reset I can do some social engineering and get in in a couple hours (if multiple tries required). If I want your account and there is no SMS password reset I'm done unless I have previously compromised your backup email.
- Sharlin 5y agoBut SMS reset here stands opposed to other, less secure reset mechanisms, because more people have a phone number than a backup email account (especially that they can reliably access).
- noduerme 5y agoAuthenticator apps require a physical device, but not a phone number. That's what I mean: They don't need your phone number for any reason, and any 2FA based on the number is insecure.
- jusssi 5y ago> it's not like it's illegal to require a phone number I'd be very careful asserting this is universally true. Maybe to be filed under "falsehoods programmers believe about law".
- Sharlin 5y agoFair point. I just meant that the falsehoods list is written from the point of user-friendliness, accessibility and inclusivity, rather than possible legal requirements.