Hacker News Reader

Comment by probably_wrong | Hacker News Reader

Incidentally, this is why I don't use 2FA on my Google account: because they won't let me enable it without giving a phone number first.

View on HN

Last time I tried to make a new google account, I could not without a phone number. My original account created many years ago does not have 2FA because of the phone number requirement.

Just got flashback from the time when I was downvoted to hell on HN when I wrote comment that Google is forcing sms 2FA just to get phone numbers.

All data will be used against you!

Yeah I’ve had this with certain things too. Is it groupthink? Naïveté?

This is the problem with downvoting. We need to ask for explanation about why something is being downvoted, especially for the first few downvotes because that's what that leads to a cascade.

Positives of downvoting - I get it, it filters out the non-sense. Negatives of downvoting - Leads to herd and mob mentality - "Oh this is downvoted, I must also think this is bad since others thought so as well. Plunk, another downvote! Take that!"

Especially right now when we have intense polarization and people are pulled away from centrist, ideological and sound perspectives into narratives, biases and prejudices.

I've raised this before, but IMO - Downvoting does more harm than good in the long term. Short term benefits are that we get rid of trolls, rude people and actually false information.

I consider down-voting a badge now. I just hit negative points today!

FWIW after enabling non-phone 2FA, you can delete the phone number from your Google account - this doesn't remove 2FA.

But that would require you to trust them to actually delete it, if you don't trust them to not abuse your number that's kinda a non starter I would say.

In Europe at least, laws are very clear about "if I click the delete button, you have to delete it". All big companies stick pretty closely to those laws because the fines are huge.

There are also laws against using data for some other purpose than it was collected for, but they're less well enforced, and it's pretty frequent that a sneaky T&C clause let's them use data for something else.

Well from the article you have two examples from twitter and facebook that surely didn't care about laws.

And since they don't believe they will get caught (probably due to their track record with getting away with everything) there is no reason to care either.

And they don't have to be as blatantly stupid to send ads to the numbers, they could do as facebook, use it for a shadow profile.

No. There are things you can (and sometimes must) save.

    if(IsEUCitizen()) {
    ...

You are being downvoted because nobody in their right mind would start the name of such a function by a capital. It would immediately get associated to the Windows API.

;-)

I believe it's enough to be EU resident to get GDPR protections. So just change your address for a bit.

Phone number is associated to a non-EU country.

Thus "FWIW" :)

By all means, use a throwaway number for signup / 2FA setup.

If the phone number is not a actually used for non-phone 2FA, then why is it "required"?

Does the phone number serve another purpose besides security? If it does, then any assurances during sugn up that the information provided will only be used for the purposes it is disclosed would be false. Knowingly false statements made to induce someone to sign up could be considered misrepresentation.

A privacy podcast I listen to recently said that, for now anyway, it's possible to use a temporary/burner phone to do the initial SMS-based signup, then switch to app-based 2FA on a different phone, and then delete the phone # associated with the temporary/burner phone (as you said).

Does Google use the phone numbers for purposes other than security?

(Facebook has been caught doing that.)

Too bad I am using google voice

Reply on news.ycombinator.com