13 ms·
Phone number has been used too many times
- sct202 5y agoI don't know why Google thinks it's okay to have volunteers with official looking titles (like Diamond Product Expert) giving support when there's no validation that what they're saying is correct. There are thousands of votes on this question; it should merit an actual response at some point.
- kahrl 5y agoWhy pay for customer support when your userbase is so captive that you'll see your profits regardless?
- hn_throwaway_69 5y agoAgree. To go further, I find these "community-powered" support forums infuriating to read, when they are run by a huge company that should be remunerating support staff. Why anyone would volunteer to answer queries for free in this context is beyond me. What do they get out of it? A flashy hat to wear and a few trivial perks? Respect to those trying to help out, but when a question like this is posed in the forum, I would only be interested in hearing the response of a salaried Google employee, not a volunteer. It's even worse when the response offers trite, generic information that doesn't relate to the problem, regrettably a common occurrence on this type of forum. Edit: Note, these remarks are not applicable to the commendable people providing support in FOSS projects, and in other non-commercial contexts.
- soperj 5y agoYou mean like Stackoverflow?
- hn_throwaway_69 5y agoI mean in the context of users providing support for commercial products without being paid for it. Stack Overflow is a general Q&A site, not a support forum for a commercial product. The context is very different. Also, while I'm at it, it has its own flaws, but people providing trite and useless answers isn't one, they get downvoted to oblivion.
- mdoms 5y agoWhich companies use stack overflow as their one and only customer support channel?
- realusername 5y agoStackoverflow isn't company support, it's programmers supporting other programmers.
- TMWNN 5y ago>It's even worse when the response offers trite, generic information that doesn't relate to the problem, regrettably a common occurrence on this type of forum. Even worse worse when the response is actively hostile. Previously discussed: <https://news.ycombinator.com/item?id=28216896 https://news.ycombinator.com/item?id=28216896>
- hermanradtke 5y agoThat would cost money!!! Google, as a company, has still not figured out customer support. It is evident in their Google Suite products, GCP and Pixel phones.
- rezonant 5y agoActually support for Pixel phones is good. Not for Gsuite/GCP though.
- unshi 5y agoDropping updates for 3 year old phones isn’t something I would call “good”
- rezonant 5y agoI agree here, but really only Apple is doing okay on this front, with Samsung very slightly better than Google.
- tkanarsky 5y agoAnecdotal, but I've seen figures like "number 263 in line for representative, estimated wait time 8 hours" in the weeks after I got my lemon Pixel 6 and had to get it RMA'd. Even after I got through to a human, it took tons of effort to escalate away from the song-and-dance "troubleshooting support" to a person who actually had the ability to get a replacement mailed out. Contrast with Apple, where I've gotten knowledgeable humans on the line within a minute or two, and scheduled a service appointment at a nearby store. If Google wants its Pixels to be the iPhone of the Android world, then they should provide more than the bottom-of-the-barrel outsourced support they currently offer.
- rezonant 5y agoI literally smashed my Pixel XL with a beer bottle (it tipped into the phone, there's no way a phone can survive that), swapped my sim to my old phone and called their 1-800. Was on the phone with support within 15m, they overnighted me a new one (under the protection plan) without me having to send in the old one, and then the new one had an issue with the proximity sensor, so I used the on-phone support to have them call me instead of waiting on hold. Explained the situation and they overnighted a third one which worked great without needing to return anything. I then sent the other two back. It was very good support actually given the circumstances, and I used that phone for two or three years before getting the Pixel 3XL. After having the 3XL for a little less than two years, I randomly took off the case to show off how nice the phone was without one (it was the white model), and realized the battery was swelling a slight but noticeable amount. It was a day or two before the protection plan expired, I called them via the builtin support functionality, again in a few minutes to check if the claim would be honored, hopped off that call after investing about 15-30m of my time, did a pretty easy claim process (another 5-10m) and had a new phone delivered in about 3 days. Swapped my SIM in, transferred all of my stuff, and shipped the old one. It was seamless and easy. In general, Google's support is mostly nonexistent. There are harrowing stories of Pixel support, but I have not had them, so ehh. On the other hand, I have had humorous kerfuffles with Dell in trying to stop them from sending me a replacement unit that turned out to be unnecessary (even though the support rep had issued a replacement ahead of arrival due to a report of damage by UPS). They said we'll ship you one, just let us know if the one that arrives is not damaged and we'll cancel it. Despite me doing that in triplicate they still sent it to me. And then after I spent a bunch more time getting support to understand this, I was able to ship it back via FedEx, and about a month later I got a notice that I never did... Again, was able to remedy this with a chat with support and sending over some proof, but it left much to be desired.
- caboteria 5y agoBy the same token I don't know why jp88 thinks it's okay to spend their time volunteering on behalf of Google. Is there some angle that I don't see or is there a subculture of people who enjoy providing free services to huge highly-profitable companies?
- moonshinefe 5y agoThey learned from the best: the Microsoft community forums.
- deleted 5y ago[deleted]
- ameminator 5y agoHoly crap - I guess the days of just going online and making an account are over. I hope it's not the case (and I am enjoying my alternate, non-google emails) - but it seems that "so goes Google, so goes the web" has happened often enough that I worry
- closetohome 5y agoIt's awfully hard to establish any kind of online presence without a mobile phone number these days. Google used to have the option to get a confirmation code by voice if you couldn't receive texts, but they discontinued it, and nobody will accept a Google Voice (or most VOIP really) number as valid. If you ever want to get a feel for how truly not-free the Internet is, try browsing through a VPN for a few days. Lots of stuff doesn't load, period. And you'll get constant "we've detected suspicious behavior from your IP" warnings, followed by endless capchas.
- Scoundreller 5y agoOr use Tor. Nobody likes it when you blend in too well, even just for reading.
- wlesieutre 5y agoiCloud Private Relay tends to work better than your average VPN, I suspect because it has a big enough non-technical userbase that just blocking it would lose customers
- dhess 5y ago> and nobody will accept a Google Voice (or most VOIP really) number as valid. Apple will accept a Google Voice number as a trusted phone number on your iCloud account, and it even works with their SMS 2FA, in the few places where they still support that.
- not2b 5y agoVOIP has been ruined by the crooks (including the crooked extended warranty people who spam my phone from a different fake number almost every day); it was broken as designed.
- iam-TJ 5y agoI wonder if this is a potential denial-of-service bug? There are two scenarios: 1. The expected use-case: Create account(s), assign number for verification, verify, account active, number remains assigned to account(s) 2. The unexpected: Attempt to create account(s), assign number for verification, ignore or fail verification, no account created If the attempted use of the number in (2) is counted and remembered then there's an anonymous potential DOS against any number
- malka 5y agoyou could use a lot of different cheap pre-paid sim card to burn a lot of numbers too.
- iam-TJ 5y agoYes, but my thought with (2) is you can use someone else's telephone number without their permission or knowledge until it is permanently blocked as a method of verification and authentication.
- djbusby 5y agoSo, what is the count that triggers this?
- cronix 5y agoDamn, they finally figured out that 867-5309 isn't our phone number.
- dylan604 5y agoSee, you've gone and ruined Jenny's chance of legitimately getting any online presence. Hopefully, she never forgets her password and needs to verify her identity.
- strathmeyer 5y agoTheir solution is to ruin someone else's access, too. I guess this is an important security alert: don't let people borrow your number to create a Google account.
- juliand 5y agoIt is fair to say that the answer came from a volunteer, although supervised by Google.
- deleted 5y ago[deleted]
- eli 5y agoMakes sense, but 1) Google still has a HUGE spam account problem and 2) this is going to hurt a whole lot of innocent people. Phone number as unique person identifier is hugely problematic for a lot of reasons. I wonder how many accounts you could hack just by constantly acquiring new numbers in area codes where the supply is small and then trying to reset various things by phone number.
- johndfsgdgdfg 5y agoThat's my impression too. This is a developer's forum. Readers here should have better undertanding than normal population that why this feature has been implemented. I am very surprised to see all these very negative and hostile comments. Instead a better discussion should be what's a better way to handle tricky situations like this, if there's any.
- malka 5y agoThe negative reactions are not about the feature. It is about the crappy Google support. > if there's any. Have support.
- BitwiseFool 5y agoI'd also like to add that Google has atrocious customer service. In fact, the help forums are often just volunteers who don't even have the power to relay information to an actual support engineer. I recall seeing a few submissions here on HN about paying customers of Google's services getting banned or flagged by some algorithm by accident and then having no way whatsoever to actually get the situation straightened out. They even contacted Sales and those employees had no way of sending a ticket to anyone inside google capable of helping them. So I sense some of the anger is due to google's reputation in this regard.
- abluecloud 5y agosolution: there isn't a good one
- coder1001 5y agoThis is just a sad consequence of some merchants creating accounts in the thousands/hundreds of thousands and selling them to SEO/Marketing blackhats to use.
- willhinsa 5y agoAnd they will figure out ways around this, while the average user will get screwed out of being able to make a new account.
- zozbot234 5y agoGoogle should simply have paid, in-person support for these issues. Cuts off the spam merchants, while still letting Joe Average create an account with their usual phone number once they've been verified as an actual person. That's got to have some value, even to Google themselves.
- tester756 5y ago>While still letting Joe Average create an account with their usual phone number once they've been verified as an actual person. so, how?
- pjerem 5y agoBy talking on the phone.
- coder1001 5y agocredit card matching the User's name/location?
- Rebelgecko 5y agoI don't think that would go over well. When Google asked people to share a national ID or credit card in the EU (age verification is legally required to be compliant with the new "think of the children" regulations in the EU's Audiovisual Media Services Directive), people online freaked out. (disclaimer, work for Google but not on this)
- rvz 5y ago> The count cannot be reset. Another reason why phone number login is a ridiculous idea. Now this user is locked out and has to contact the CEO of Google for support. (Since there is no Google customer support) We haven't even gotten to talk about SIM swapping and SS7 attacks yet. [0] Complete hell-hole of account takeovers. [0] https://news.ycombinator.com/item?id=27447206 https://news.ycombinator.com/item?id=27447206
- endisneigh 5y agoI’m curious what (free) solution exists here that won’t be abused by spammers.
- derbOac 5y agoA security key? Depends on why they really want a phone number.
- endisneigh 5y agoA security key wouldn’t prevent spam since you can buy multiple. It would increase the cost of spamming, but it’s unclear of the relatively affordable price of security keys would love the needle enough vs attrition from legit users
- floodle 5y agoSecurity keys are typically $20, that seems pretty expensive to me if you are a spammer opening hundreds or thousands of accounts.
- tkanarsky 5y agohttps://github.com/MattGorko/libu2f-emu https://github.com/MattGorko/libu2f-emu can spin up virtual U2F tokens which are indistinguishable (in my experience) from real ones plugged into a USB port
- kam 5y agoWebAuthn deliberately doesn't give relying parties a way to tell if two registrations are from the same device.
- mattnewton 5y agoYou can buy more phones too, though presumably the phone companies don't sell bulk phone numbers for short term use and make it prohibitively expensive and time consuming to do so. Basically seems like it works by outsourcing those spam combating efforts to the local phone companies.
- danlugo92 5y agoGet your own domain with a safe registrar, have your own email. Not your domain not your mail.
- dredmorbius 5y agoThat's ... something of an improvement, but domain transfers and loss are in fact A Thing.
- cobertos 5y agoWho qualifies as a "safe registrar"?
- danlugo92 5y agoI don't know yet, I'm in search for one. But I've heard they exist.
- jijji 5y agosounds like a train wreck in 2FA hell
- EnKopVand 5y agoI had this problem when I was still using gmail. These days I have my own domain and pay for my email services, so I can create aliases without creating accounts. But when I was using gmail I had a few accounts for different things, and at around 5 I couldn’t create more. Which is perfectly reasonable to be fair. I fixed it by deleting some of the accounts. If the authors problem is similar that would probably be the easy solution. If it’s because the author has “inherited” a phone number that has previously been used by other people to create Google accounts then I think the author is going to depend on this HN post catching enough traffic for real people at Google to care. Because I sure didn’t find any help through their support system back then, and simply fixed the issue as a “happy accident”.
- ugjka 5y agofuck google
- Digory 5y agoTwitter won't verify phone numbers that are assigned to voip providers, even if they receive SMS. I'm not sure how you get a number from Ma Bell anymore, and I'm not going to do it for Twitter. FAANG isn't quite as bad as WeChat, but it's getting there.
- vmoore 5y agoI managed to successfully register a Twitter account without having to verify myself with a phone number. Not sure how I managed to do that, but I have a number ready to provide them if they randomly decide to ask for it. You can get away with using the same number for about five accounts (at least this was my experience).
- ringworld 5y agoIn the USA, the cheapest option I've found is Tello (T-Mobile MVNO) - $5-6/mo for the absolute basic tier, real SIM with a real (non VOIP) number. Accepts number port-in after initial activation.
- projektfu 5y agoIf you just need to receive the occasional text message, you can get a free one from FreedomPop.
- deleted 5y ago[deleted]
- 5y ago
- EGreg 5y agoHow about proof of humanity? Or Apple FaceTime Attestation?
- legrande 5y agoI remember hacking together a Twilio API script for registering multiple Google accounts (since they do phone verification for each account so I needed a pool of numbers I could register with). I managed to get about 20 accounts registered before they caught on, and banned each account. And there was a twist: my main Google account got caught up in the ban (which I tried really hard to keep insulated from the en-mass account registrations). But they somehow figured out it was me (even after using several proxies/VPNs). But luckily I could appeal the ban of my main (personal) account and the copy read something like: We want you to keep communicating with Gmail, so you can appeal to get your account reinstated here using this form. Turns out Google is human after-all, and I learned my lesson. For those wondering why I wanted so many Google accounts; well at the time Google+ was happening and I wanted to promote a bunch of SaaS products and side hustles. In truth, I wanted to spam G+ with links. But the takeaway from this is: Google does let you appeal and has your best interests at heart, despite any rogue/malicious intent.
- rubatuga 5y agoWhat a rigorous deduction you have made.
- gorjusborg 5y agoTypical google policy in that it optimizes toward google scaling its efforts, and against customer expectations. It's pretty much what you might expect from a company that makes its money B2B rather than through pleasing consumers.
- deleted 5y ago[deleted]
- cookiengineer 5y agoNote that some countries have prepaid SIMs that are regularly reassigned to new SIMs...as soon as 6 months after the last "refill" of the card. This happened to a customer where their IT sysadmin got a prepaid phone and registered this as a recovery number in a critical system (read as: full control over infrastructure). And yes, the company forgot to refill the SIM card only to realize a year later that some script kiddie got the phone number by accident and was curious enough to lookup where the number was being used. DNS entries and ASN entries were enough OSINT to form an attack strategy. What you gonna do then? As it turns out, this was a shitstorm of problems to deal with through hours (probably days) of support hotline calls. Remember folks: 2FA via SMS is useless. Avoid phone numbers like the plague, everywhere.
- encryptluks2 5y agoMany providers don't give you a choice. Many major banks default to using SMS for 2FA. I'm sure if they get breached the government will bail them out so why should they change?
- iszomer 5y ago"FDIC insured".. I use a GV number for 2FA over SMS as the last mile solution.
- lxgr 5y agoMe too, but some banks/payment services don't allow that – ostensibly for security reasons... Even when I did get a "real phone number" (that concept irritates me to no end), one of these first required me to send a phone bill as a "proof of me owning that number" before they would let me set it for 2FA. I guess that's just what happens when blending/confusing the three distinct concerns of spam/fraud protection, 2FA, and user identification (for inbound P2P payments) into a single identifier.
- lxgr 5y agoCouldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel. - I can own my email address; I cannot meaningfully own a phone number. - Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.) - Email works with or without a cell signal/via mobile data. - Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.
- lykahb 5y agoZoho is even worse. They require that a phone number is used exactly once. Which is a bummer if you want to have non-personal emails, like "support@example.com".
- projektfu 5y agoCan you use an alias? I don't use Zoho email but I use lots of aliases on Fastmail for this sort of purpose.
- kagitac 5y agoThe irony. > An individual has a phone number > Some people do not own phones, or do not wish to provide you with their telephone number when asked. Do not require a user to provide a phone number unless it is essential, and whenever possible try to provide a fallback to accommodate these users. Source: https://github.com/google/libphonenumber/blob/master/FALSEHOODS.md https://github.com/google/libphonenumber/blob/master/FALSEHO...
- jedberg 5y agoDiscord told me the same thing: just use a friend’s phone number if yours doesn’t work. What exactly is the point of phone verification of the official answer is “lie to us about your identity”?
- lxgr 5y agoThe fact that VoIP numbers are declined by so many services just reveals what phone numbers are really used for, these days: Spam account creation prevention. If this was about security, SMS-2FA would be laughed out the door.
- Sebb767 5y ago> What exactly is the point of phone verification of the official answer is “lie to us about your identity”? Phone number is not about identity, but about reducing spam (they're also not at all tied to your identity, at least not unless you buy data from service providers). The point is that you need something that is very easy for your normal user to do, but very hard for bots - effectively, it's just a glorified captcha.
- jedberg 5y agoI can accept that, but at least captchas offer an alternative, like listening to audio. With the phone number, if they've decided my number is VoIP, then I have no recourse except to borrow or steal someone's phone. It's a terrible system and they probably have no metrics on how many legit customers they are losing because of it.
- outloudvi 5y agoThe problem is particularly common in China, where almost all services require a mobile number to register an account per the regulation. Recently, a service has been established in some cities that allow a mobile number owner to delete the accounts related to the number at multiple services. [1] 1. https://www.ithome.com/0/600/098.htm https://www.ithome.com/0/600/098.htm (Chinese)
- Sebb767 5y ago> You don't need a mobile phone, you can use a friend's phone, or use a landline. Sure, because what's the chance the friend also has a Google account? And who doesn't have a personal landline, especially these days? Sorry to be snarky, but responses to the point of "sorry that our systems are horrible, nothing we can do, here are a few hoops to jump through to possibly deal with it" just get me. It's not just in Googles power to change something, it's literally a problem created by Google.
- breakingcups 5y agoIt's not even a Google employee replying, just some random person who spends so much time doing Google's job that they've gotten a pretty badge for it.
- discardedrefuse 5y agoI've had the same Google account since time immemorial. About a year ago, Google started hassling me to hand over my date of birth. I had long lived without access to "mature" Youtube content. But now Google began bombarding me with pop ups on my Android phone. I kept refusing. In retaliation, Google took my ancient GMail account hostage, blocking access behind an unskippable demand for my DOB. I had no choice but to cave and provide them with a date. I was livid. Now that months have passed and my jets have cooled, I would like to take a moment and speak directly to Google: Thanks Google. You finally gave me the push I needed to pack my bags and leave. I've completely de-googled my life and encourage everyone to do the same. You're an evil company. Anything positive you may have contributed to society has been long eclipsed by the damage you've done in your quest to subjugate the web. In short; good riddance and get fucked.
- phineyes 5y agoGoogle has to do this to comply with COPPA. They had to pay a $200m fine in '19 due to users that weren't age-checked.
- mtoner23 5y agoYep, and any other company he signs up for that doesn't ask for this basic piece of information is breaking the law.
- addingnumbers 5y agoI don't remember ycombinator asking for my DOB when I created an HN account...
- skinkestek 5y agoNo, but I think it informed me in text that I had to be above a certain age?
- ipaddr 5y ago
- kylehotchkiss 5y agoI wish USA would take a stronger stance on mobile numbers being used for identity - either permanently assigning numbers to people which can't be reassigned or banning the use of phone numbers for identity verification entirely. Your life should not be identified by a sequence of numbers that are no longer yours if you don't pay your bill or somebody pretends to be you in a cell phone store. That said, Google has allowed me to use my Google Voice number for account verification for a very long time now. It probably helps that I added that number before I ported it over to Google Voice but it's nice not having accounts tied to phone bill.
- moonshinefe 5y agoThese useless responses are pretty much all you'll ever get out of Google if you have any sort of problem that isn't trivial to fix. I've seen tons of these threads. I once asked "hey, I know you can ignore single email addresses but is there any general way to prevent people from sharing porn to my Google drive or having bots message me in the gmail chat widget, because the default is anyone can do this to me regardless of privacy settings." It seemed ridiculous to me anyone could message me out of the blue or share porn with my drive that shows up (thumbnails and all) in "recent". Individually ignoring the thousands of spammers isn't a solution. The response was something like: "You can ignore individual users by right clicking their username and hitting ignore!" Thread closed. I can only imagine the responder didn't even read my question or just didn't care and was trying to make some quota or something. It's pretty clear they really don't care about supporting their products at all, and you'd probably be better served talking to a wall.
- deleted 5y ago[deleted]
- cobertos 5y agoI've gotten this message, but I also have ~8 Google accounts. I've deleted 2 so far, but 2 of the accounts have emails that are tied to one last important service that _will not_ let me change my email, no matter what I do. I'm trying, but I cannot escape.
- callesgg 5y agoRecover the old account and remove it. Or just the phone nr from it.
- Cauchy2022 5y agoIs there some sort of a common pattern in the authentication and authorization problem of the digital service: 1. I can associate a phone number/email to a bunch of online services, but to unbind any specific one, I need to visit that specific website to put a request. 2. Especially for recycled phone number: it is nearly impossible for the new owner to unbind and clean the connection made by previous owner. 3. Cancel the recurring payment on your card. You either go through the service provider or call your bank/credit card issuer. However, it is usually more complicated compared to the moment when you clicked yes button. It is super easy to start a digital service, while the other way around is not easy, and more than usual, hard as hell.