9

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me.

Google Sign In Form

It says:

Verify it's you
This device isn't recognized. For your security, Google wants to make sure it's really you.

Enter a phone number to get a text message with a verification code.

Obviously, Google thinks that knowing my password is not enough to prove "it's me." I don't have a phone, so I never linked any phone number with my Google account.

What intrigues me is the phrasing. "Enter a phone number" sounds to me like it would accept any number. Obviously, since I never linked a phone number, they do not have anything to compare the number entered into that field to. This also means that they cannot send me a text message with a verification code.

I do not understand how this improves security. They already assume that I may be an attacker who somehow got hold of my password, otherwise they would just let me log in. But what would stop an attacker from entering any phone number in their control so they can receive the verification code? Assuming that an attacker may know my password, how does this prevent them from gaining unauthorized access to my account?

  • 2
    It looks like they are asking you to associate a phone number to your account. But they are asking this right when something is wrong, so they are actually trying to associate your account with a potential attacker's number! Google can't be this stupid (I hope). So maybe they are really asking for the potential attacker's phone number. They won't associate it with your account, but just log it and report it to you to make the intrusion attempt more traceable. It's just my guess. – reed Apr 30 '18 at 18:05
  • Is there a skip button under More Options? Google is really annoying at pushing 2FA. (2 weeks ago I enabled 2FA and then my cellphone stopped working on the same day, good thing I had a backup 2FA method) – immibis May 2 '18 at 22:22
  • In my country, almost all the time, if you need to create a google account, you need to verify it using a phone. If you can't verify it, then you can't create a google account. This is true for Twitter as well as Facebook. If you try to create an account using a VPN, then it's a no-no. – DxTx Apr 7 at 16:14
9

Although it's strangely worded, it does make sense from Google's point of view, because:

  1. If your account credentials are ever compromised, an attacker would be less willing to continue at this point, unless they are willing to use a throwaway number every time they hack someone's account. (Which probably isn't cost effective.) They certainly can't use their actual phone number as then law enforcement could potentially track them down. This could basically work to "verify it's you".
  2. It enables Google to start using 2FA with you in the future. But since forcing 2FA might be frowned upon, perhaps they decided they'll only force it if you ever login from an unknown device.
  3. This reduces the number of new email addresses created for spamming purposes. It's harder to get working phone numbers than it is to get email addresses, so by forcing a user to associate a working phone number that they personally have access to with their account, it cuts down on the number of newly created spam email addresses. I assume if you try to associate too many email accounts with the same number, you'll get shut down.
2

PSTN (phone's network) has a much thicker paper trail than TCP/IP, far fewer endpoints (#s vs IPs), typically requires $+registration with a gov-regulated telco (compared to coffee shop wifi), and extends the legal protection of wiretapping (instead of just hacking).

These all serve as social discouragements to low-level attackers, like an angry ex, but probably don't protect as much from sophisticated targeted attacks. More attacks are actually amateur/personal, so this practice cuts down on the abuse of Google's users and the enforcement actions Google needs to take. If it didn't save Google money, Google wouldn't bother.

  • Even if these are true, they're not the reason why Google asks for phone numbers. – Lie Ryan May 1 '18 at 3:03
  • 1
    @LieRyan: if you've a better answer share it with the group. – dandavis May 1 '18 at 3:54
0

I suspect the phone number has to be one that google has already associated with your account. If you enter some unknown number, nothing useful will happen. The strange wording is twofold; to handle the case that there are several numbers available, and to not tell you what the numbers are.

  • The question says the account doesn't have a phone linked. – AndrolGenhald May 3 '18 at 19:43
  • In that case, no phone number will elicit a code that works. The principle is to not give any useful information to the hypothetical attacker, including the information that no phone number will work. – ddyer May 3 '18 at 20:42
  • Do you have any evidence for this? I doubt Google would do that as it's terrible UX, and TTT's answer makes much more sense to me. – AndrolGenhald May 3 '18 at 20:56
  • It's obviously not a good practice to allow anyone with a working phone to validate their access to an account, as TTT suggests. "They can track you down" isn't true (burner phones bought anywhere) and even if true in some cases, law enforcement has more important things to do than find miscreants who hack your google account. – ddyer May 3 '18 at 21:20
  • That's your opinion, but you're saying that Google does it this way, which I believe is factually incorrect. – AndrolGenhald May 3 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.