Hacker News Reader

Comment by CWwdcdk7h | Hacker News Reader

Last time YouTube wanted to verify my phone number it was easier to find a free service to receive SMS than for Google to deliver it to my actual phone. And Google didn't care I "verified" a number assigned to other side of the world.

View on HN

Be careful. Google once locked me out of an account that I've owned for over 10 years one day. My username and password were correct, but they randomly flipped 2FA on (without my consent) and sent the recovery code to a phone number that I switched away from years ago. It was completely unrecoverable. There's absolutely no way to get in touch with customer service. Never make an account with them unless you're not willing to lose it randomly to automated bureaucracy.

It's becoming increasingly hard to find a service that lets you see verification messages, and even then google doesn't like a lot of the numbers those services use

In my country there are several telco operators that will send you basically an unlimited number of SIM cards for free (as in free beer) that you can use for getting the verification SMS and then immediately throw the SIM away. The only "cost" is that you have to wait a day or two for the SIMs to get to your physical mailbox.

If you create an account from another country, since you can only send the sms verification from that country, locks your account to that country for at least one year. I created a US account years ago and it still is US. I don't even spoof my location.

What happens when they ask for you to get another code to that same number, though? Can you access that number again?

Can you delete the phone number after verification + switch to TOPT (with the private key written down next to your password, probably in a password manager) for 2FA?

I think that's considered "more secure" in most account security flowcharts.

Yeah I try to switch everything to TOTP these days, try to remove the SMS option on whatever I can. Google offers about a dozen ways to verify your account now.

Reply on news.ycombinator.com