4 ms·
I went through it to register just now. No QR code required. Same flow as it has been for years: 1. Personal/Child/Business 2. First/Last 3. Pick email 4. D
by arjie 6mo ago
I went through it to register just now. No QR code required. Same flow as it has been for years:
1. Personal/Child/Business
2. First/Last
3. Pick email
4. Date of Birth
5. Backup email / Skip
6. Password
7. Enter phone number
8. Confirm with 2FA code
9. Done.
I just made the email testregistrationflow@gmail.com and have since forgotten the password. So that’s one burned. But feel free to try testregistrationflow1@gmail.com and see if it works without a QR code.
The headline is clearly a misstatement of what is a specific flow for someone to make many Gmail accounts programmatically.
- cute_boi 6mo agoI just checked and it asked me to scan QR code and after opening QR code it will attempt to send some random token.. Google is probably doing A/B testing or they are using some sort of ML algorithm....
- guidedlight 6mo agoThey should probably go back to the original invite only flow they used when Gmail launched. Every account having the ability to invite an only small finite number of new accounts is one way to thwart scammers.
- sixhobbits 6mo agoNot really, even "legit" marketing providers have massive automation rigs to warm email addresses, make them behave naturally and email each other in rings for a bit before using them for cold outreach. So they'd just do this to farm invites if they needed
- lokar 6mo agoIt was not finite, or uniform. I refilled the invites every week or so based on user behavior.
- saltcured 6mo agoNot without some kind of delay function and probably filtering/evaluation of which new accounts get this capability... Everyone here should be familiar with exponential growth of n-ary trees. If you can get one of these accounts and each new invitee gets to invite 2 more, you can already have accounts gone wild.
- sowbug 6mo agoIf it's a tree, it's easier to prune an entire branch that's gone bad.
- hedora 6mo agoSo, the scammer should send an invite to a real person from one percent of the accounts in the tree, wait a few months, then flip the evil bit on 90-95% of the accounts they registered. If the whole tree is cut off the reputational damage is really high (10,000 valid users nuked because of actions other accounts took...)
- sowbug 6mo agoYep, it's a never-ending escalation.
- tomjen3 6mo agoThat's certainly an interesting idea - mostly everybody should know someone who has a gmail account, so if you get a couple invites a month, that should be plenty and the setup would Well I was about to say destroy scammers, but I just realized that they would send out spam to places where you could gamble your invites for Real Cash(TM) or just straight up buy them. This would lower the creation of accounts, but then they would be rarer and worth more to spammers, since a spamming gmail would be rare. And we would hear sob stories of people getting their accounts closed for inviting spammers.
- Almondsetat 6mo ago"A tester in A/B testing situation swears that B tester is not telling the truth"
- arjie 6mo agoIt certainly disproves a headline saying “Gmail now requires scanning a QR code”.
- warkdarrior 6mo agoWell, a headline that states that “Gmail now requires scanning a QR code for some people some of the time” is not too exciting.
- traderj0e 6mo agoThis is why I always ignore these headlines until I see the change firsthand. In this case it wasn't even an article, only a brief forum comment, for a topic as complex as spam protection. Might not be an A/B test, could just be someone with a low-trust profile (eg Arch Linux ipv6 in Singapore with multiple Gmails).
- flumes_whims_ 6mo agoProbably depends on how "trust worthy" you seem to Google for them to trigger this requirement. Things like using Linux, using Firefox, using a VPN, etc.
- greentea23 6mo agoThe irony is that no real scammer would use this setup because they know it would stand out.
- traderj0e 6mo agoDenying scammers the ability to use VPNs and virtual phone farms without standing out does make their job harder
- Gigachad 6mo agoOr it's just being A/B tested right now.
- Gander5739 6mo agoWhen you create an account through google services on a phone, you don't even need a phone number.
- sevenseacat 6mo agoYeah I set one up a few weeks ago for testing, same process.
- pier25 6mo agoMaybe it depends on the country?
- prodigycorp 6mo agoI hit both a google QR captcha and traditional captcha today. They're phasing it in.
- chrsstrm 6mo agoYou can reach a point where the phone number you used for 2FA has been "used too many times" and then you're stuck in the middle of registration. There doesn't seem to be any documented limit anywhere and the only solution people have been able to use is find someone else to help you verify with their phone number. What makes this more difficult is when you get logged out of one of your accounts, they ask for a phone number for 2FA to login, you provide the same phone number you used originally (even though it is not officially associated with your account, just to verify registration), but that fails because your number has apparently been used too often. So now you can't even log in to your valid account that already exists. Sure, should have added some other form of 2FA or a passkey to the account, but why can't I verify with the same number I used originally? And just to top things off, you can't use your Google Voice number for 2FA account verification when signing up for another Google service.
- cube00 6mo ago>find someone else to help you verify with their phone number Very risky, either of you gets banned (it's a risk given now ban happy Google are) you'll both lose your accounts.
- chrsstrm 6mo agoThe number is not associated with your account, it is just used to verify legit account creations. Retroactively nuking an account due to using a "banned" phone for account creation verification would be wild and not in Google's best interests.
- fireant 6mo agoYou can totally get a random "we've detected a suspicious activity, please verify the phone number you've used during registration" form during login.
- tardedmeme 6mo agoIIRC the limit is 4 accounts and it's documented somewhere.