Comment by xjay | Hacker News Reader

Comment by xjay | Hacker News Reader

Funny how "2FA" almost always equates to "phone number".

Beware if they claim they don't store your phone number. It's highly likely they store a hash of it for tracking purposes, and proceed to use child-like logic to claim they didn't break any law in doing so.

Furthermore, data brokers use the same hashing algorithm [1] to connect disparate/separate entities, such as your bank, insurance company, fast food chain, etc, basically, any entity you've shared your phone number/email with, in order to gather data on you behind the scenes. How did that happen, you ask? "Out of sight, out of mind."

Google could restrict non-2FA accounts. That way, users could still access their private collection of playlists, but maybe they're no longer able to make comments.

Google and others should offer a standard palette of 2FA options, where the risk factors are left to the users. Let them choose between verified email, some or other TOTP, but try to avoid scavenging private phone numbers, you know, the highest value, globally unique identifier, ooooh.

[1] https://twitter.com/WolfieChristl/status/1288229191759081472

It says in the article that they're using "Google Prompt" which sends a push notification to your phone instead of SMS or TOTP. Regardless I would be surprised if Google's own 2FA didn't support TOTP since....you know...they own probably the most popular mobile TOTP app: Google Authenticator.

Google has:

* Prompts. (Show a notification on a device)

* Phone Txt or voice

* Backup codes

* Authenticator App (ie TOTP)

* Security Key: Yubikey and the like. (You can use some Android phones as a Bluetooth security key)

I'd say google has more options than anyone else right now.

Iirc none of the alternate methods is available until you have given them a phone number.

A few months back I finally enabled 2FA on one of my accounts, I wanted to use totp and that option was completely unavailable until I enabled SMS 2FA.

You can remove the phone number and the other options stay enabled. I removed the phone years ago, because I did not want all of my security for more or less all of my online accounts (password recovery via email) to hinge on the unhelpfulness of a customer service agent of my cell phone provider who is heavily incentivized to be as helpful as possible to any criminal impersonating me

And you of course can trust Google that they actually remove your phone number. /s

Look, this is silly. Not removing the users number on request is asking for a huge scandal if it ever was leaked or compromised. Pulling this crap isn’t worth it. The value of collecting a few phone numbers from people who don’t want to give it out is nothing.

You might not consider it worth it, but some marketroid? Was anyone actually surprised when facebook sent spam texts to 2FA numbers back in 2018? They just floated that balloon and went "whoop sorry bug in the system" and that was that.

To be fair, it was almost certainly a bug in their system.

You can argue that they shouldn't have made that mistake, and I'd agree, but stupidity is always more likely than malice.

> stupidity is always more likely than malice.

It's interesting how the supposedly smartest companies of the world are so regularly so stupid in such consistent ways.

They're never stupid in a "oh no we deleted all your personal information from our system and now can't track you anymore" way, weirdly.

that probably happens, but it doesn't tend to get publicity.

More generally, remember that you could be one of those megacorp employees one day, and you might build a 2fa system which logged to a particular place.

Later (remember the company is growing for 50% for many years) some new person sees the phone numbers and doesn't realise their provenance (very likely culturally at a place like FB, where things are default open) someone else finds the phone numbers and uses them to send marketing messages.

Like, that's what happened (most likely) but it amazes me that people will always want understanding for their own mistakes, but regularly disclaim that others shouldn't have done it, or made a mistake maliciously.

To be clear, I have no special insight here, but I think that assuming everything is malice and pre-planned is a less fruitful headspace to inhabit than realising that everyone is human, all companies make mistakes and that's a good prior.

To be even clearer, FB should have made this bug impossible (and I'm sure they have now), but given the amount of mistakes I've made I hesitate to cast the first (or indeed one of the last I suppose) stone.

> Pulling this crap isn’t worth it.

And what happens if it's revealed? How large are fines, how long the prison time?

For data of EU citizens, up to 2% of global revenue for small violations, 4% for severe ones

There indeed was a big scandal when FB did something like this with 2fa SMS numbers

Simply bury something in the TOS along the line of "oh well actually we reserve the right to do whatever with your 2F phone number" and be done with it.

Or just keep a hash of the number as GP described.

To address the app and phone number concern I have; I doubt it's possible to remain a user of Google services without being forced to give them my phone number at least once, and even if they don't keep it, they'll keep a hash of it to bypass the spirit of the law, and track me across data brokers using a derivative of my phone number instead.

My guess is, if they aren't nagging you about verification by phone number, you've likely provided them with your number at least once in the past.

On a related note, there's been a push for supporting the Payment Services Directive (PSD2), which requires strong customer authentication (SCA) in most cases, which implies 2FA.

Forget 2FA: you can't get a Google Account without giving a phone number during signup.

You could as recently as a few months ago (haven’t tried since winter), but you have to be careful from the create account page. If you get asked for a phone number, start over in a new Firefox container. Or, you could do it through YouTube.

It has to be the IP address of something they know the location of with some certainty, near impossible to privately sign up for one.

Try it with a VPN or anything from a datacenter IP or any other public place and it's a no go.

I have tried this dozens of times in the last year, with an empty cookie jar. Every time it demands I verify a phone number.

They need to store the phone number in order to send an SMS to it.

Why do they need your phone number?

They already have Google Authenticator. (Although authenticator plus is better imo) and they use your email address for that.

Maybe they want to have a backup? People setup 2FA using authenticator, loose phone, no proper backups, backup codes lost.

Using access to specific phonenumber as second factor is not too good security wise, but there’s no perfect options. I’d say managing 2FA properly is hard even for IT pros, let alone regular people. Like how many store the backup codes offsite, regularly test backup Ubikeys etc.

In this case if it's not phone number based. It's based on an app prompt on your phone.

I like this better, because if you lose your phone/number, it’s a pain to redo all of your phone based 2FA accounts.

Reply on news.ycombinator.com