3 ms·
> Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security. It can actually be both; in fa
by forward1 3y ago
> Forced phone number 2FA has the same effect; in Big G's case forcing phone number 2FA is anti-anonymity disguised as security.
It can actually be both; in fact it very likely needs to be:
1. Phone numbers are the best long-term identity most people have
2. Google has billions of users and needs to support account recovery at unbelievable scale
3. Many people lose passwords and devices, but very few lose phone numbers
It logically follows google uses phone numbers to assign and delegate identity on their platform. Is this bad for privacy? Yes, but it's also very good for security because it allows users to control their data using a third-party authenticated "credential" they don't have to manage.
- rmellow 3y agoAll of this is valid! But it would be even more secure if there was an opt-in "I don't want to use my phone as 2FA". Phone number authentication creates a weakness for anyone who is in a targeted attack. A motivated attacker can easily bribe/trick a telecom employee, or if physically accessible, swipe the phone itself to read 2FA texts.
- px43 3y agoSign up for Google's Advanced Protection Program. It's been around since 2017, and last I checked, it's the only way to fully disable the use of your phone number for authentication. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/