Hacker News Reader

Comment by RJIb8RBYxzAMX9u | Hacker News Reader

Google does this too when you sign in from "unknown" locations, if you don't have 2FA configured. I think the purpose is to slow down bots. If you try reusing the same number in quick succession on different accounts, Google won't let you.

I'm so glad I'm out of the family tech support "business"; if only firing real customers were so easy...

View on HN

This really bugs me. I have throwaway Google accounts that I don't want to add my phone number to, so I can only access them from the location I created them.

Enabling 2FA should stop this from happening. Adding TOTP as your 2nd factor would require adding a recovery number, but maybe you can remove it after. I have accounts that has TOTP 2FA w/o recovery number, but perhaps they were grandfathered in.

Alternatively, use a physical token as the 2nd factor, then no recovery number is required.

How do you even create a Google account without a phone number?

You can't create a Google account without a phone number (at least last I tried), however once you enable a 2FA method other then SMS you can then delete the phone number. To their credit the phone numbers I gave to Google when setting up my accounts have never shown up in any of the usual law enforcement or skip trace databases so I'm less apprehensive about opening new accounts with them.

T-Mobile sells me out once a year - I don't even give them my real name, they must get it from my credit card or something. This year I used a fake name "authorized user" card, still waiting to see if that keeps my latest number out of the databases or not, around nine months to go.

Wow there's a lock to unpack here. How are you accessing law enforcement or skip trace databases to check?! And what do you mean by T-Mobile selling you out -- where did they give out your info? (They let you get a line without your real name?!)

You can request a copy of your info from those databases from Transunion, LexisNexis, etc. and they'll send it to you. however since they are not used in credit decisions they are not governed by the FCRA and you can not dispute or amend anything. Every phone number I've ever had is in those databases, as well as every address I've ever lived at - plus a few dozen variations that are typos or incomplete which I guess says something about my handwriting, every paycheck I've received over the past twenty-some years is in there, both regular payments and bonus, with taxes broken out and everything (a lot of businesses outsource employment verification to a Transunion subsidiary called The Work Number and in return they get all that information). There is my list of "known associates" which is pretty much all of my family living and dead since the 80s, all of my wife's family, a couple former roommates and their families. Apparently I own a sporting goods store in Austin, Tx (thats false, but can't dispute or amend). Every legal action I've been a party to is there. Every car I've ever driven is in there. I think most people would be shocked if they knew how much data these companies keep. I became aware when a police officer called me about some tenants at a rental property on a phone number I'd never given to anyone. I think the Transunion TXLop database is where I finally found the number. Since then its been my hobby to see how long I can keep my phone numbers out of that database.

Wow, thank you so much for sharing, that's really great info!

I think he means that the hijackers call into T-Mobile customer support who then allow his number to be ported to their sim.

My T-Mobile number was simjacked last year, though afterwards once I reclaimed my number they let me set up a "secret word" that the person calling in has to give them and I haven't had any problems since.

I've asked that my number be unable to be changed to a different sim over the phone. So to change it I need to go into a physical store and present proper ID

Just tested this, I was able to create an account without a phone number. I think it doesn't require a phone number if Botguard is highly confident you aren't a bot. (it does recommend adding a phone number for 2FA though) Also, I created the account through ChromeOS settings, which perhaps is a signal that I'm not a bot?

I made the account while ago and it let me, I guess they don't let you anymore though

For me, it shows a short list of phone number endings, and you have to pick the right one. It's far from perfect, but it doesn't just let me enter any number I want.

Reply on news.ycombinator.com