13

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me.

Google Sign In Form

It says:

Verify it's you
This device isn't recognized. For your security, Google wants to make sure it's really you.

Enter a phone number to get a text message with a verification code.

Obviously, Google thinks that knowing my password is not enough to prove "it's me." I don't have a phone, so I never linked any phone number with my Google account.

What intrigues me is the phrasing. "Enter a phone number" sounds to me like it would accept any number. Obviously, since I never linked a phone number, they do not have anything to compare the number entered into that field to. This also means that they cannot send me a text message with a verification code.

I do not understand how this improves security. They already assume that I may be an attacker who somehow got hold of my password, otherwise they would just let me log in. But what would stop an attacker from entering any phone number in their control so they can receive the verification code? Assuming that an attacker may know my password, how does this prevent them from gaining unauthorized access to my account?

Improve this question
4
  • 2
    It looks like they are asking you to associate a phone number to your account. But they are asking this right when something is wrong, so they are actually trying to associate your account with a potential attacker's number! Google can't be this stupid (I hope). So maybe they are really asking for the potential attacker's phone number. They won't associate it with your account, but just log it and report it to you to make the intrusion attempt more traceable. It's just my guess.
    – reed
    Apr 30, 2018 at 18:05
  • Is there a skip button under More Options? Google is really annoying at pushing 2FA. (2 weeks ago I enabled 2FA and then my cellphone stopped working on the same day, good thing I had a backup 2FA method)
    – user253751
    May 2, 2018 at 22:22
  • In my country, almost all the time, if you need to create a google account, you need to verify it using a phone. If you can't verify it, then you can't create a google account. This is true for Twitter as well as Facebook. If you try to create an account using a VPN, then it's a no-no.
    – DxTx
    Apr 7, 2019 at 16:14
  • The only possible thing this might do is stop a robot getting in. This TFA is a stupid concept for two reasons. 1) If I gave my password away or chose an easy password, its my own stupid fault. 2) When I am on my mobile, texting me a code on my mobile is pretty bloody stupid, as it proves nothing.
    – Rohit Gupta
    Jan 2 at 1:01

4 Answers 4

Reset to default
10

Although it's strangely worded, it does make sense from Google's point of view, because:

  1. If your account credentials are ever compromised, an attacker would be less willing to continue at this point, unless they are willing to use a throwaway number every time they hack someone's account. (Which probably isn't cost effective.) They certainly can't use their actual phone number as then law enforcement could potentially track them down. This could basically work to "verify it's you".
  2. It enables Google to start using 2FA with you in the future. But since forcing 2FA might be frowned upon, perhaps they decided they'll only force it if you ever login from an unknown device.
  3. This reduces the number of new email addresses created for spamming purposes. It's harder to get working phone numbers than it is to get email addresses, so by forcing a user to associate a working phone number that they personally have access to with their account, it cuts down on the number of newly created spam email addresses. I assume if you try to associate too many email accounts with the same number, you'll get shut down.
Improve this answer
1
  • 1. I don't know, that seems like asking someone at my door claiming to be a police man to give me the number of the police so I can verify he's really from the police. 2. "unknown device " Yes. Or when you use a VPN with varying servers, or incognito mode so that you're not inundated with Google's tracking cookies. 3. But you can create arbitrary many accounts and send many emails, until you log in from a new device (or different VPN server, or incognito mode). But for a spammer it would be trivial to start many instances of a non-incognito browser from a fixed IP.
    – Fab
    Aug 25, 2019 at 22:44
2

PSTN (phone's network) has a much thicker paper trail than TCP/IP, far fewer endpoints (#s vs IPs), typically requires $+registration with a gov-regulated telco (compared to coffee shop wifi), and extends the legal protection of wiretapping (instead of just hacking).

These all serve as social discouragements to low-level attackers, like an angry ex, but probably don't protect as much from sophisticated targeted attacks. More attacks are actually amateur/personal, so this practice cuts down on the abuse of Google's users and the enforcement actions Google needs to take. If it didn't save Google money, Google wouldn't bother.

Improve this answer
2
  • Even if these are true, they're not the reason why Google asks for phone numbers.
    – Lie Ryan
    May 1, 2018 at 3:03
  • 2
    @LieRyan: if you've a better answer share it with the group.
    – dandavis
    May 1, 2018 at 3:54
0

I suspect the phone number has to be one that google has already associated with your account. If you enter some unknown number, nothing useful will happen. The strange wording is twofold; to handle the case that there are several numbers available, and to not tell you what the numbers are.

Improve this answer
6
  • The question says the account doesn't have a phone linked.
    – AndrolGenhald
    May 3, 2018 at 19:43
  • In that case, no phone number will elicit a code that works. The principle is to not give any useful information to the hypothetical attacker, including the information that no phone number will work.
    – ddyer
    May 3, 2018 at 20:42
  • Do you have any evidence for this? I doubt Google would do that as it's terrible UX, and TTT's answer makes much more sense to me.
    – AndrolGenhald
    May 3, 2018 at 20:56
  • It's obviously not a good practice to allow anyone with a working phone to validate their access to an account, as TTT suggests. "They can track you down" isn't true (burner phones bought anywhere) and even if true in some cases, law enforcement has more important things to do than find miscreants who hack your google account.
    – ddyer
    May 3, 2018 at 21:20
  • That's your opinion, but you're saying that Google does it this way, which I believe is factually incorrect.
    – AndrolGenhald
    May 3, 2018 at 21:27
0

What Google expects to happen: You enter the number of a phone that you carry. Then Google sends a message to that number, you read the message, and type in a code that you see. As the result, if I tried to hack into your account, I would either not enter the code, or Google would learn my phone number.

If that is all, then it is very little security. But it will give you some protection against colleagues, relatives, “friends”, room mates and so on who might know your password because you were careless, but don’t have a burner phone and don’t want to risk their own phone number being known. So this is only a bit of protection, but your idiot brother might cause as much damage as a well-equipped hacker and might be stopped.

On the other hand, Google has some information about your phone(s) or they wouldn’t have figured out that you are using a different device. And they might only send a message if you enter a phone number that is associated with you. Say you logged in using your iPad or the computer at my home instead of your phone. If you enter your phone number, they send a code. If I enter my phone number, they send nothing. That is a decent addition of security. Enough to help keeping a friend and many hackers out.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.