Hacker News Reader

Comment by CarelessExpert | Hacker News Reader

My Google account is configured right now to only support the Android prompt, TOTP, and Backup Codes. SMS is specifically not enabled, both for 2FA and account recovery.

Either that answer is out of date or it's lacking nuance. I haven't done it in a while, but it may be that you need SMS 2FA initially, and then once you've added TOTP you can then remove SMS.

But SMS is absolutely not required and anyone who thinks it is and is avoiding 2FA for that reason needs to go take a second look at their security settings.

View on HN

I can also remove SMS as 2FA on my account, but I’ve had to give a phone number on all my accounts at different points in time, and they got confirmed by SMS.

What I was pointing at is not that SMS is the only option but that the phone number + confirmation seems mandatory at least once.

IMO, the bottom line is that Google wants your phone number, I'm guessing so they can somehow further target ads. They bugged the hell out of me a while back trying to get a phone number, even though I had a backup email address configured. They haven't bugged me for a while now, but that's likely because now they're going to try to force me to give them a phone number.

Thing is you can delete it immediately after you've set up your account with alternate 2FA eg TOTP/authenticator.

Do you believe they actually delete it? I don't.

I deleted my account with Digital Ocean years ago, because I use NoScript and every time I went to a new page at DO, it required me to enable more 3rd-party domains. I switched to Vultr.com because they only use their domain for their web pages.

Recently I received an email from DO that my acct information may have been accessed by some hack. I replied to that email, requesting that they delete everything on their systems relating to me. They said I had to sign in and purge my account. I already did this, when I switched to Vultr.com. But I tried anyway. It wouldn't let me sign in (Duh! I already deleted the account), so won't let me purge my info. When I explained that DO would have to delete it, they never replied. They obviously still have my info or they couldn't have emailed me.

My level of trust that a company has actually deleted everything they say they are deleting is about zero. If it's to their advantage to keep it, they will.

> They haven't bugged me for a while now, but that's likely because now they're going to try to force me to give them a phone number.

This and your other reply in this part of the conversation are purely paranoid speculation.

Frankly, if you're this concerned about Google's nefarious intent, you should get off their platform. They probably already know a lot more about you than just some random phone number.

Reply on news.ycombinator.com