zlacker

[parent] [thread] 17 comments
1. tamimi+(OP)[view] [source] 2024-03-23 03:38:53
> The court orders show the government telling Google to provide the names, addresses, telephone numbers and user activity for all Google account users who accessed the YouTube videos..

Hopefully that clarifies for some folks why these big tech/social media companies insist on having your phone number as a “2FA for security” despite all the sim-swap attacks.. simply for this moment, because you might be using a VPN, and address/name aren’t in your google account, but definitely your phone number is there, it’s even worse if you’re using an android too, as they probably will pull out all your app/browsing history..

replies(4): >>chatma+L1 >>caskst+pi >>kevinc+Hv >>IshKeb+AR
2. chatma+L1[view] [source] 2024-03-23 03:55:50
>>tamimi+(OP)
You can avoid this with Google by using a virtual WebAuthN device (ironically via Chrome devtools), and then you will unlock the ability to enroll in MFA with a QR code for an OTP URL.
replies(3): >>getcru+E3 >>c0pium+8a >>crotch+kQ3
◧◩
3. getcru+E3[view] [source] [discussion] 2024-03-23 04:23:11
>>chatma+L1
This sounds like it’s new though? And maybe is for testing/dev and will go away?
◧◩
4. c0pium+8a[view] [source] [discussion] 2024-03-23 06:09:18
>>chatma+L1
Which really underscores that all of the MFA stuff is actually about security. Because of course it is.
5. caskst+pi[view] [source] 2024-03-23 08:25:00
>>tamimi+(OP)
No, it doesn't "clarify" anything like that. If google doesn't have phone numbers of some subset of the accounts requested... they will just specify so in their response to law enforcement since it is completely legal and google is not currently obligated by law to have phone numbers of all users of Youtube. Sundar isn't going to prison because of that or anything.

Saying that some PM at Google decided decade ago something like "hey guys let's build a database of our user's phone numbers to satisfy some theoretical future dragnet surveillance request from law enforcement and tell our users that it is for their own security" is actually quite ridiculous conspiracy theory if you think about it.

6. kevinc+Hv[view] [source] 2024-03-23 11:38:44
>>tamimi+(OP)
I'm not saying that there aren't other motives, but there are legitimate security concerns.

Credential stuffing is a huge issue for large providers and requiring 2FA is a huge mitigation. Sure, a targeting attack will make the SIM swap, but that is a huge difficulty upgrade from generic credential stuffing.

replies(1): >>dogman+HV
7. IshKeb+AR[view] [source] 2024-03-23 15:13:23
>>tamimi+(OP)
"Guys, we know our users' names, addresses, all of their emails, browsing history, location history and contacts... but we're missing the critical information! Their phone numbers! Can anyone come up with a security justification for asking for it?"

-Nobody ever.

Come on, use your brain. Even if you are talking about smaller entities who might otherwise only have names and emails, why would they want phone numbers? They don't care about identifying you. And even if they did they already have your email and name.

Step away from the tin foil...

replies(2): >>dogman+2W >>Nextgr+jW
◧◩
8. dogman+HV[view] [source] [discussion] 2024-03-23 15:52:36
>>kevinc+Hv
Source - am a fairly experienced security engineer.

It’s a nonsense argument to say Google can’t handle credential stuffing without SMS 2FA in place, as in not pushing all 2FA via Google Authenticator and using the very wide reach and talented security team for baseline cred stuffing. Sec tools for this, even without being Google and their very talented sec team, are pretty good.

Wanting a hard phone number is a pure identification play and also about the more likely pragmatic concern (than cred stuffing) of using Google for burner accounts.

replies(1): >>kevinc+9W
◧◩
9. dogman+2W[view] [source] [discussion] 2024-03-23 15:54:41
>>IshKeb+AR
Brief counter, based on adtech knowledge.

Fingerprinting to a user, especially for a bulk request, without something to anchor on like a device id (or phone number), is harder than you make it out to be. End of third party cookies and so on has had an effect.

◧◩◪
10. kevinc+9W[view] [source] [discussion] 2024-03-23 15:56:20
>>dogman+HV
How do you handle credential stuffing? Attackers will use a huge number of regular residential IPs or VPNs that you would expect to see logins from. How do you tell a credential stuff from a regular login? They are both coming from unknown IPs with normal login rates and they have valid credentials.
replies(1): >>dogman+4B6
◧◩
11. Nextgr+jW[view] [source] [discussion] 2024-03-23 15:57:55
>>IshKeb+AR
> why would they want phone numbers

Because it is trivial to make a burner/secondary email address, but much less trivial to do the same with a phone number. Furthermore, everyone adds phone numbers to their contacts but very few add emails, so phone numbers are much more valuable from the perspective of inferring social graphs.

Both of these are extremely valuable for adtech and generic "growth & engagement" scum, thus why all companies matching this criteria started effectively requiring phone numbers. The 2FA/security angle is just an excuse for the true reason behind it.

replies(1): >>IshKeb+0Z
◧◩◪
12. IshKeb+0Z[view] [source] [discussion] 2024-03-23 16:19:55
>>Nextgr+jW
None of that is related to providing identities to the government, which was his tin foil hat conspiracy theory for why 2FA is used.

I'd buy the spam reduction angle - it's a bit easier to get an email address than a phone number. But I have never seen a service require 2FA (except things like NPM and PyPI; but that's clearly for security) so I don't think it's that either.

I think it's pretty clear that the reason really is security. There's no conspiracy.

replies(1): >>Nextgr+501
◧◩◪◨
13. Nextgr+501[view] [source] [discussion] 2024-03-23 16:27:41
>>IshKeb+0Z
> None of that is related to providing identities to the government

Agreed. But I disagree that the true reason is security. The true reason is better stalking which is valuable to adtech scum which now happens to be the vast majority of consumer-grade tech.

> I have never seen a service require 2FA

Try register on Twitter. They'll let you register but then randomly suspend your account for alleged ToS violations (even if the account was outright inactive) but will give you the option of instantly unbanning yourself following phone number verification. Microsoft will randomly lock out MS accounts without a phone number attached and will require a phone number for "security" upon the next login (the security angle being very dubious considering they don't have a number on file to compare to, so even an attacker can pass this challenge just fine). Etc.

> There's no conspiracy.

It's true, there's no conspiracy, it's just business and can be explained by common sense and economics. Phone numbers help tracking people. Adtech makes more money the better it can target its ads. Most consumer tech nowadays is intertwined with adtech. Said consumer tech thus optimizes for higher profit by collecting more data to help adtech.

replies(2): >>IshKeb+XA1 >>thesha+No3
◧◩◪◨⬒
14. IshKeb+XA1[view] [source] [discussion] 2024-03-23 21:52:04
>>Nextgr+501
> Phone numbers help tracking people

That's the conspiracy. They don't need phone numbers for that.

It's mainly security with a sprinkling of spam/bot reduction.

Do you really think NPM and PyPI are doing it to improve their targeted advertising?

◧◩◪◨⬒
15. thesha+No3[view] [source] [discussion] 2024-03-24 20:37:32
>>Nextgr+501
> Try register on Twitter. They'll let you register but then randomly suspend your account for alleged ToS violations (even if the account was outright inactive) but will give you the option of instantly unbanning yourself following phone number verification. Microsoft will randomly lock out MS accounts without a phone number attached and will require a phone number for "security" upon the next login (the security angle being very dubious considering they don't have a number on file to compare to, so even an attacker can pass this challenge just fine). Etc.

I have accounts with both of these orgs, not equipped with 2FA and none of what you describe has ever occurred.

◧◩
16. crotch+kQ3[view] [source] [discussion] 2024-03-25 01:02:11
>>chatma+L1
You can't avoid it during account creation.

So they still have the number.

replies(1): >>chatma+7qg
◧◩◪◨
17. dogman+4B6[view] [source] [discussion] 2024-03-25 23:43:20
>>kevinc+9W
Because there’s a bit more to it than just tracking IPs and rates.
◧◩◪
18. chatma+7qg[view] [source] [discussion] 2024-03-29 03:19:56
>>crotch+kQ3
I was able to avoid it, albeit two years ago, when signing up with Apple "Hide My Email." I never gave Google my phone number for that account.
[go to top]