Google Play devs will need to enable 2-Step Auth and meet identity requirements

I’m stunned there wasn’t an identity verification requirement before. I always just assumed there was. What a clown show.

Also, isn’t 2FA based on SMS or TOTP almost as easy to phish as a password? If someone is already typing their password into a phishing site, that site can just ask for 2FA codes too, right?

I’d say make WebAuthn the baseline, but I do that for myself with a YubiKey and it sucks. Mine’s older (v4) and only does U2F, but it doesn’t work over RDP and I have to use my PC for everything.

I think a better system would be a hybrid of Microsoft’s push (click approve) system and WebAuthn. Ex: I visit a site and it pushes a WebAuthn challenge to my phone’s authenticator and I approve by NFC using my hardware key.

That way you get a signature for a specific domain (ex: microsoft.com) and you only need compatibility for the system on one device; your phone.

>Meanwhile, Google is introducing “Developer identification requirements” to “help us better understand your needs.” In addition to providing your email address and phone number, the following information will also be required:

>Your account type — whether it’s personal or belongs to an organization

>A contact name

>Your physical address

>Verification of your email address and phone number

It seems an odd juxtaposition, you get a lot of people on HN who claim to advocate for privacy, yet don't bat an eye at and even cheer on needing to provide google with your physical address just publish an app on the play store in the name of security.

Password were easy to guess so they now must contain two special character, spaces, commas and at least one key that is not in your keyboard. In the end it doesn't even matter because passwords are useless. Why is security becoming this mess?