Hacker News Reader

Google still allows you to setup recovery phone numbers unforunately.

https://support.google.com/accounts/answer/183723?hl=en&co=G...

I think years ago I found my number there with no-recollection of every agreeing to it and quickly yeeted it. (You can remove the number but keep recovery email)

View on HN

It's subtle with the UI but you can choose not to allow SMS by removing your phone number from Google after setting up alternative 2FA. If they don't have a number they can't sim-jack

This is one of the most important pieces of security advice that is often overlooked: remove your phone number from EVERYTHING.

You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere.

1. https://landing.google.com/advancedprotection/

Big benefit of Advanced Protection: you can go tell less technical users to set it up and it will enforce all these best practices (no SMS, two keys, no giving random apps access to GMail...).

Reply on news.ycombinator.com