Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by pachouli-please | Hacker News Reader

Parent Full thread

pachouli-please·

you moved off gmail due to forced mfa of all things? interesting...

also, aren't 'app passwords' or whatever they call it still a thing?

View on HN

They won’t allow you to use regular TOTP alone. You always have to link a phone, even for Google Workspace. It sucks!

This is not true. In some organizations I work with they only allow Security Keys on Google Workspace, you can't even use TOTP. It's possible to disable SMS and Phone verification, but if you allow TOTP then Google Prompt is also automatically allowed.

Neither my Google Workspace account nor my personal Gmail account has a phone number.

yes I don't like security decisions forced upon me, that's reasonable. if I want a throwaway email, I don't need MFA because I don't care if the account is compromised. but I don't get to make that decision because Google decided for me that my account will have forced MFA

I imagine it's because they would be (legally) responsible for any malicious usage of your account.

Based on what? Have the laws changed, or has there been a recent ruling on something related to this?

"I imagine" which means they have no idea what they are talking about

>if I want a throwaway email, I don't need MFA because I don't care if the account is compromised.

But Google cares if their servers are used to send spam or worse, because it makes their email service less useful for other users who may not use it as a throwaway account.

Reply on news.ycombinator.com