Hacker News Reader

Comment by Buge | Hacker News Reader

Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily. You add the phone number as a factor, then add other factors (such as Google Authenticator and Yubikeys) then delete the phone number.

View on HN

> Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily.

I finally set up 2FA on my Google account this weekend.

It struck me as incredibly odd that Google requires a phone number to enable 2FA. NIST recently advocated against using SMS for OoB auth. [0]

If I had been an account hijacker with the password (e.g. obtained via phishing) it would have been ludicrously simple for me to enable 2FA on someone else's account.

I don't understand, I already have an Android phone with Google Play Services installed. Why isn't pressing "Okay" on my phone sufficient? It's certainly not any more insecure than an SMS.

What I view as even worse is on the first attempt the SMS didn't go through, so I asked Google to give me a call. Evidently my provider blocks whatever number they're using to call out of, so my phone never rang. But Google left the verification code anyway, AS A VOICEMAIL!

My inner tin foil hat says Google wants a phone number for other purposes.

[0] www.securityweek.com/nist-denounces-sms-2fa-what-are-alternatives

> My inner tin foil hat says Google wants a phone number for other purposes.

Just like Twitter these days. "Telephone number is optional and for your security". 2 minutes later my new accounts are always locked and i need to provide a telephone number to enable it again. They used SMS until recently, now they use a call service which only works with a fraction of numbers. (Tried 2 thai, 1 cambodian number, none accepted)

I seriously dont get what they are trying to do other than creating a database of telephone numbers and locking users in third world countries out.

Also agree with that Google actually knows enough to just verifiy it based on my phone. Telephone number is not necessary, especially i "verified" my account in the past with a phone call, why again?

Steam does this as well. Even if you add your phone number after a lot of nagging, Steam still keeps bothering you to install their Android or IOS authenticator software (even if you can't). I wish Steam would consider Fido U2F as well, but getting through to anyone who can influence this at Valve is nigh impossible.

It seems to be the industry status quo now to assume that everyone uses a smartphone running either Android or IOS, and that everyone wants to use that device for authentication. Meanwhile the tech giants (especially those involved in advertising) probably like having that nice unique alphanumerical identifier for your profile — it tends to be the same for all services you use.

I really hope Fido U2F becomes a de facto alternative for 2FA.

Steam, at least, does not seem to have a issue sending me emails. Sure it annoys me to use their app or whatever, but i can choose to only receive emails. Which is really all i actually want :)

But i agree on everything said

Yeah, I just ran into something similar a few days ago. Every once in a while I used to go through all my trading cards and bulk sell all my duplicates for a few cents each, but apparently now they require you to use some combination of SMS and mobile app authentication to post anything on the market. Clicking through the confirmation email they send you isn't enough on its own.

So now I just don't bother with trading cards at all.

My experience exactly. I used to sell those silly cards the moment I got them, just to get a little extra balance in my Steam account for the next purchase. Now I just ignore them; selling them is way to much of a hassle to be worth the €0,05 you get for a card. (Who buys those things anyway? Weird market.)

It's protection against bulk account creation. Getting a phone number costs money, so requiring a phone number makes it expensive to get 1000 accounts.

Phones are ubiquitous enough that very few customers have to pay this cost.

Obviously, this reasoning doesn't (and shouldn't) extend to using phones for authentication.

Yeah, after writing the article i also realized i dont mind verification actually. As long as they support whatever carrier i currently have. Its authentification that i bother with. (As in i have a phone number, i want internet on my phone, but i change it often monthly)

Also services like Twitter that allow any rented SMS service and multiple accounts for each number this seems not be the reason why they ask for a number.

"My inner tin foil hat says Google wants a phone number for other purposes."

"I already have an Android phone with Google Play Services installed."

Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users.

> Guess what - Google already has your phone number before asking for it via the 2FA form. My guess is that the reason they have one platform-independent process for setting up 2FA is for iOS users.

Only if the phone number is the same one I use for my Android phone. But yes, I realize that any SIM I put into my phone will also be known by Google.

It's just an incredibly shit onboarding method. They already have a more secure way than SMS to determine the account owner, so why not offer it as an option?

Can you even create a working Google account without a phone number? When I last tried that, it seemed to be mandatory from the start.

It never seemed to be a security measure, but an anti-spam measure. You can buy captcha solving as a service for fractions of a cent, and bulk create thousands of accounts for sending spam. Buying working phone numbers is more hassle and more expensive, and will leave a payment trail if you use a service like Twilio.

You can, but it's not obvious that it's an option. I'd be willing to bet that the signup UI was deliberately designed to make it look like a phone number is required.

You can, but only if Google thinks your IP address has a low likelihood of spam.

This is new to me thank you. I am a little afraid of locking myself out so i am hesitate to just try it, i will read into it and give it a try. Seriously thanks.

Reply on news.ycombinator.com