Hacker News Reader

Comment by strken | Hacker News Reader

> we check for MX records of very well known DEPs

This is one of the most pointless anti-abuse measures you could implement, since a Gmail account can be created in about 20 seconds with no identifying information.

View on HN

Is that still true these days? I was under the impression they required a phone number now, or something else "real-world" to tie to.

I've created 3 new Gmail accounts in the last year and I've never been forced to enter my phone number. Either it's a myth or the rule magically never applies to me.

I'm going to guess it's the latter. I'm unable to log into some of my existing gmail pseudonymous aliases because google refuses to let me log in without providing a phone number (ostensibly for my own security, IIRC to enable 2fa, even though it doesn't make any sense).

An existing email account is something worth protecting. It's OK to allow a few extra false negatives while signing up, compare to accessing an existing account.

Wouldn't it be up to me to decide if I want to enable 2fa?

Provided Google has a lot of info about me, they can probably tie those accounts to me anyway, but I'd rather not formally associate them with my public identity.

IIRC, and my memory of it is faint, they don't seem to require a phone number if they can otherwise identify you. For example, try it via a VPN or Tor.

There's some sort of complex formula that determines whether you need to provide a phone number, based on how many accounts have been recently created from your device, IP, etc.

So if you use a VPN or proxy, would it be more likely to cause the SMS check to trigger?

I tried to create a secondary email address on Gmail and Outlook.com and they both required me enter a phone number.

Ended up using Protonmail instead, which allowed me to register with username and password and nothing else.

Lots of Google rules don't apply to specific, known-to-google "mes".

Google knows who you are by your devices, IP addresses, browser signatures, cookies, and other metrics. They don't need to verify your identity anymore, in fact they could probably tell you things about yourself that you don't even know.

Reply on news.ycombinator.com