4 ms·

> The court orders show the government telling Google to provide the names, addresses, telephone numbers and user activity for all Google account users who acce

> The court orders show the government telling Google to provide the names, addresses, telephone numbers and user activity for all Google account users who accessed the YouTube videos.. Hopefully that clarifies for some folks why these big tech/social media companies insist on having your phone number as a “2FA for security” despite all the sim-swap attacks.. simply for this moment, because you might be using a VPN, and address/name aren’t in your google account, but definitely your phone number is there, it’s even worse if you’re using an android too, as they probably will pull out all your app/browsing history..

chatmasta 3y ago
You can avoid this with Google by using a virtual WebAuthN device (ironically via Chrome devtools), and then you will unlock the ability to enroll in MFA with a QR code for an OTP URL.
- getcrunk 3y ago
  This sounds like it’s new though? And maybe is for testing/dev and will go away?
- c0pium 3y ago
  Which really underscores that all of the MFA stuff is actually about security. Because of course it is.
- crotchfire 3y ago
  You can't avoid it during account creation. So they still have the number.
  - chatmasta 3y ago
    I was able to avoid it, albeit two years ago, when signing up with Apple "Hide My Email." I never gave Google my phone number for that account.
ehhthing 3y ago
[flagged]
- diputsmonro 3y ago
  The government is literally asking for that data though? It doesn't really matter why Google wants it, the effect is the same. We should be concerned and we should resist giving them as much data as possible, because when the government comes knocking they'll ask for everything they have. And who and what the government wants can change quicker than you might imagine (see how the Texas government is going after women having miscarriages, for example)
  - ehhthing 3y ago
    This is your choice obviously, you get to choose how much data you give to them. You can also choose not to give any data at all if you wish.
  - andsoitis 3y ago
    > The government is literally asking for that data though? It doesn't really matter why Google wants it, the effect is the same But it DOES matter, because a conspiracy (which you’re arguing is happening) is when parties make secret plans jointly to commit an unlawful or harmful act. They have to make hose secret plans jointly for it to be a conspiracy. Weaving that narrative without evidence is the definition of a conspiracy theorist.
- mrtksn 3y ago
  Certainly it's better to stick with the factual conspiracies like NSA's PRISM program: https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM or Room 641A: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A If they can install hardware in companies and run data collection programs, I don't see why wouldn't they be directing the data collection policies too.
  - ehhthing 3y ago
    You're delusional if you think the landscape 10 years ago is the same now. Companies are much less likely to simply capitulate to governments now. In fact, the references you make here are why they're less likely to allow these kinds of things. It looks really bad for them, and it affects their bottom line when these things come out. When public trust in your service is crucial to its existence, you can spend more on lawyers to fight the government about it.
caskstrength 3y ago
No, it doesn't "clarify" anything like that. If google doesn't have phone numbers of some subset of the accounts requested... they will just specify so in their response to law enforcement since it is completely legal and google is not currently obligated by law to have phone numbers of all users of Youtube. Sundar isn't going to prison because of that or anything. Saying that some PM at Google decided decade ago something like "hey guys let's build a database of our user's phone numbers to satisfy some theoretical future dragnet surveillance request from law enforcement and tell our users that it is for their own security" is actually quite ridiculous conspiracy theory if you think about it.
kevincox 3y ago
I'm not saying that there aren't other motives, but there are legitimate security concerns. Credential stuffing is a huge issue for large providers and requiring 2FA is a huge mitigation. Sure, a targeting attack will make the SIM swap, but that is a huge difficulty upgrade from generic credential stuffing.
- dogman144 3y ago
  Source - am a fairly experienced security engineer. It’s a nonsense argument to say Google can’t handle credential stuffing without SMS 2FA in place, as in not pushing all 2FA via Google Authenticator and using the very wide reach and talented security team for baseline cred stuffing. Sec tools for this, even without being Google and their very talented sec team, are pretty good. Wanting a hard phone number is a pure identification play and also about the more likely pragmatic concern (than cred stuffing) of using Google for burner accounts.
  - kevincox 3y ago
    How do you handle credential stuffing? Attackers will use a huge number of regular residential IPs or VPNs that you would expect to see logins from. How do you tell a credential stuff from a regular login? They are both coming from unknown IPs with normal login rates and they have valid credentials.
    - dogman144 3y ago
      Because there’s a bit more to it than just tracking IPs and rates.
IshKebab 3y ago
"Guys, we know our users' names, addresses, all of their emails, browsing history, location history and contacts... but we're missing the critical information! Their phone numbers! Can anyone come up with a security justification for asking for it?" -Nobody ever. Come on, use your brain. Even if you are talking about smaller entities who might otherwise only have names and emails, why would they want phone numbers? They don't care about identifying you. And even if they did they already have your email and name. Step away from the tin foil...
- dogman144 3y ago
  Brief counter, based on adtech knowledge. Fingerprinting to a user, especially for a bulk request, without something to anchor on like a device id (or phone number), is harder than you make it out to be. End of third party cookies and so on has had an effect.
- Nextgrid 3y ago
  > why would they want phone numbers Because it is trivial to make a burner/secondary email address, but much less trivial to do the same with a phone number. Furthermore, everyone adds phone numbers to their contacts but very few add emails, so phone numbers are much more valuable from the perspective of inferring social graphs. Both of these are extremely valuable for adtech and generic "growth & engagement" scum, thus why all companies matching this criteria started effectively requiring phone numbers. The 2FA/security angle is just an excuse for the true reason behind it.
  - IshKebab 3y ago
    None of that is related to providing identities to the government, which was his tin foil hat conspiracy theory for why 2FA is used. I'd buy the spam reduction angle - it's a bit easier to get an email address than a phone number. But I have never seen a service require 2FA (except things like NPM and PyPI; but that's clearly for security) so I don't think it's that either. I think it's pretty clear that the reason really is security. There's no conspiracy.
    - 3y ago

chatmasta 3y ago

You can avoid this with Google by using a virtual WebAuthN device (ironically via Chrome devtools), and then you will unlock the ability to enroll in MFA with a QR code for an OTP URL.

getcrunk 3y ago
This sounds like it’s new though? And maybe is for testing/dev and will go away?
c0pium 3y ago
Which really underscores that all of the MFA stuff is actually about security. Because of course it is.
crotchfire 3y ago
You can't avoid it during account creation. So they still have the number.
- chatmasta 3y ago
  I was able to avoid it, albeit two years ago, when signing up with Apple "Hide My Email." I never gave Google my phone number for that account.

ehhthing 3y ago

[flagged]

diputsmonro 3y ago
The government is literally asking for that data though? It doesn't really matter why Google wants it, the effect is the same. We should be concerned and we should resist giving them as much data as possible, because when the government comes knocking they'll ask for everything they have. And who and what the government wants can change quicker than you might imagine (see how the Texas government is going after women having miscarriages, for example)
- ehhthing 3y ago
  This is your choice obviously, you get to choose how much data you give to them. You can also choose not to give any data at all if you wish.
- andsoitis 3y ago
  > The government is literally asking for that data though? It doesn't really matter why Google wants it, the effect is the same But it DOES matter, because a conspiracy (which you’re arguing is happening) is when parties make secret plans jointly to commit an unlawful or harmful act. They have to make hose secret plans jointly for it to be a conspiracy. Weaving that narrative without evidence is the definition of a conspiracy theorist.
mrtksn 3y ago
Certainly it's better to stick with the factual conspiracies like NSA's PRISM program: https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM or Room 641A: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A If they can install hardware in companies and run data collection programs, I don't see why wouldn't they be directing the data collection policies too.
- ehhthing 3y ago
  You're delusional if you think the landscape 10 years ago is the same now. Companies are much less likely to simply capitulate to governments now. In fact, the references you make here are why they're less likely to allow these kinds of things. It looks really bad for them, and it affects their bottom line when these things come out. When public trust in your service is crucial to its existence, you can spend more on lawyers to fight the government about it.

caskstrength 3y ago

No, it doesn't "clarify" anything like that. If google doesn't have phone numbers of some subset of the accounts requested... they will just specify so in their response to law enforcement since it is completely legal and google is not currently obligated by law to have phone numbers of all users of Youtube. Sundar isn't going to prison because of that or anything. Saying that some PM at Google decided decade ago something like "hey guys let's build a database of our user's phone numbers to satisfy some theoretical future dragnet surveillance request from law enforcement and tell our users that it is for their own security" is actually quite ridiculous conspiracy theory if you think about it.

kevincox 3y ago

I'm not saying that there aren't other motives, but there are legitimate security concerns. Credential stuffing is a huge issue for large providers and requiring 2FA is a huge mitigation. Sure, a targeting attack will make the SIM swap, but that is a huge difficulty upgrade from generic credential stuffing.

dogman144 3y ago
Source - am a fairly experienced security engineer. It’s a nonsense argument to say Google can’t handle credential stuffing without SMS 2FA in place, as in not pushing all 2FA via Google Authenticator and using the very wide reach and talented security team for baseline cred stuffing. Sec tools for this, even without being Google and their very talented sec team, are pretty good. Wanting a hard phone number is a pure identification play and also about the more likely pragmatic concern (than cred stuffing) of using Google for burner accounts.
- kevincox 3y ago
  How do you handle credential stuffing? Attackers will use a huge number of regular residential IPs or VPNs that you would expect to see logins from. How do you tell a credential stuff from a regular login? They are both coming from unknown IPs with normal login rates and they have valid credentials.
  - dogman144 3y ago
    Because there’s a bit more to it than just tracking IPs and rates.

IshKebab 3y ago

"Guys, we know our users' names, addresses, all of their emails, browsing history, location history and contacts... but we're missing the critical information! Their phone numbers! Can anyone come up with a security justification for asking for it?" -Nobody ever. Come on, use your brain. Even if you are talking about smaller entities who might otherwise only have names and emails, why would they want phone numbers? They don't care about identifying you. And even if they did they already have your email and name. Step away from the tin foil...

dogman144 3y ago
Brief counter, based on adtech knowledge. Fingerprinting to a user, especially for a bulk request, without something to anchor on like a device id (or phone number), is harder than you make it out to be. End of third party cookies and so on has had an effect.
Nextgrid 3y ago
> why would they want phone numbers Because it is trivial to make a burner/secondary email address, but much less trivial to do the same with a phone number. Furthermore, everyone adds phone numbers to their contacts but very few add emails, so phone numbers are much more valuable from the perspective of inferring social graphs. Both of these are extremely valuable for adtech and generic "growth & engagement" scum, thus why all companies matching this criteria started effectively requiring phone numbers. The 2FA/security angle is just an excuse for the true reason behind it.
- IshKebab 3y ago
  None of that is related to providing identities to the government, which was his tin foil hat conspiracy theory for why 2FA is used. I'd buy the spam reduction angle - it's a bit easier to get an email address than a phone number. But I have never seen a service require 2FA (except things like NPM and PyPI; but that's clearly for security) so I don't think it's that either. I think it's pretty clear that the reason really is security. There's no conspiracy.
  - 3y ago