Category: It’s rant o’clock

  • Why does Google need my phone number to confirm it’s “me”?

    Why does Google need my phone number to confirm it’s “me”?

    This was going to be posted on Google’s support forum, because of course it’s doesn’t have proper support for customers. IT got a little too long so I’m not sure if I’m still going to post it but nevertheless people should be aware of Google’s behavior.

    I tried signing in on one of my Google accounts, it’s a semi-burner-type because I don’t want to associate personal information with it.

    Anyway, yesterday it decided that it wouldn’t let me sign in anymore. The process implies that the password is wrong, and for a bit it made me second-guess myself, but I’m good with passwords (without MFA) so it didn’t seem right. I entered a deliberately wrong password to see what happened, and indeed the denial was much quicker and it was no longer suggesting that I might have my password wrong, it was outright stating it.

    Each time, by the way, this would happen (i.e. I correctly entered my password), it would automatically initiate the I-haven’t-tracked-you-with-this-IP-address-yet internal protocol or whatever, so it would send me a code over email. I guess this is a good time to tell I’m not using an account that ends in @gmail.com but uses my own domain, on my own servers (this is only a Google account with no Gmail) meaning IF I HAVE ACCESS TO THE ACCOUNT it should be enough to satisfy those identity concerns as far as Google’s involved, because it would mean I have control of DNS servers, registrar account, mail servers, proxies, directory servers, and all the ridiculous amount of complexity that email requires worked out, but that was not the case.

    Instead, it’s completely glossed over and what really happens is that as soon as I enter that code that was sent automatically without any warning or consent (as I never set up MFA in the first place) I get another blank field to enter a mobile number so Google can know for sure it’s me by sending me yet another code.

    How exactly would that work? How can that be possibly be tied to me if I had never given Google a phone number to match it with. More importantly, as an authentication factor, this would fall under a possession factor, but I already used that with the emailed code.

    Email provided by Google would be normally unlocked with the same password used to login to an account. That’s something you know, the knowledge factor. Assuming your in the vicinity of where you normally access you account from, that already should be enough for multi-factor authentication because another factor that Google doesn’t acknowledge as a factor is someplace you’re in, the location factor, that’s unless you fail to meet it because then the fact that Google is tracking your location whenever or however it can, can be spun as a matter of security and not a matter of privacy, as it would be “revelatory” of that well-known thing.

    But let’s pretend that’s not a thing and get to the code; in order to receive it I would need to have access to my non-Google provided email account. That is something you have. The possession factor. It’s the same thing as having a valid SIM card (itself a form of smart card) to authenticate to your carrier and get that message with the code. Your carrier might even have the option of forwarding text to an inbox or you might have a VoIP line that forwards your texts to anything with an API such as Telegram, I used to do this. Regardless, it’s still only something you have.

    What it is not is something Google has, or probably more appropriately something Google wants. Assuming my account has really been compromised and already I passed at least two of five authentication factor, where only 4 are really practical after taking out behavioral, and only 3 are really practical after taking out biometrical given those two (as well as location but I guess we’re ignoring that) are extremely invasive, this is why in the case of biometrics an in-device verification is often used instead (I checked that box too but that only works with an in-device account, not in-browser even the browser is on the device signed in. Unless it’s Googles’ own browser). The one remaining is the one unrecognized but already failing: location. Which is often what triggers all of this nonsense. Google from my point of view wants confirmation of the places you visit.

    Again assuming my account has been compromised, and if they have access to email my personal safety has been compromised as well asking for phone number to get a code, would not constitute another factor I have already presented. It wouldn’t constitute a factor at all because Google has no way to verify the phone number with nothing to match it against. An if I have truly been compromised, it would have no way to know it’s handing a third party an opportunity to lock me out further by adding information to my account I could never match, and compromising Google’s own data in the process.

    Google sign in/up pages say to prevent lock out by entering a phone number. Why would I be locked out for non matching and why must it be a phone number. Why not a key pair, it’s the standard and the base of all security, it’s used in many things from physically as some form of smart card (SIM card, ATM cards, ID cards, public phone cards) or in their virtual form best and most often known as certificates, or more recently passkeys which can prove possession and in turn verify identity without disclosing that identity, if Google is so concerned for user security and privacy, or arguably their wellbeing, as it claims.

    If Google is so concerned for it, in the troubleshooting article about account access, when all methods requiring personal identifiable information aren’t met, why is Google so quick to suggest to “just open a new account”. To me that sounds as it doesn’t really care if you ever get access back, or what might happen with your recurring charges if you have any, as long as you have another account for Google to keep tabs on you. You could make a video call with an ID in hand, it’s still invasive, it’s not perfect but it’s a solution for those that chose to rely on Google for anything just finding out that relationship wasn’t as symbiotic as they thought.

    Google doesn’t seem to be interested on identifying the accountholder being the same but rather the accountholder themselves.

    They’d be left without access to cancel subscriptions, or email to change the basically anything relating their other accounts, including the bank’s to kill those cards. That’s hardly caring about their wellbeing.

    Using a phone number isn’t even reliable security either as your carrier could hypothetically reassign your phone number to another person out of the blue and there goes your MFA. It’s not, or it wasn’t hypothetical for me, it’s what AT&T did to me a few years back, hence I’m not attached to a phone number or a device that is not autonomous (that requires to be signed in somewhere).

    How do I know it’s not going to abuse it, because on the same message where it asks for the phone number it says that Google would store this phone number BUT ONLY for security purposes, it was missing a “pinky swear yoo-guyeess”.

    It reminded me to all the times it has allegedly stored data for security purposes but then proceeded to abuse using a loophole like that class action suit (that might be still ongoing) against Google that which I was notified I’m in; where the last thing Google did was asking to dismiss the case, proving to me it has no remorse for its behavior, nor respect for the users that make it money.

    In any case if Google has so. much. concern. — so much! — for our accounts, and privacy, why does it keep implementing measures that require a server, a Google server to work. Most of the Google’s services don’t work correctly in my network because the firewall blocks trackers. I didn’t choose nor single out Google, the block comes from automatically updated crowdsourced blacklists, meaning the entire planet deemed its servers adversarial by adding them in these lists. Case in point; as I type this, yet another burner account was triggered Google’s unsolicited[, probably location-tracking-based-]protection, and [also without being solicited] made my Android device a piece of its MFA puzzle, but since it cannot properly communicated with block servers, I assume, the messages twice over the maximum time allowed to complete the whole thing only to show up.

    Then it froze when I tapped on the green checkmark to confirm that my online activity is dull, not as exciting and dangerous as Google, Apple, Microsoft, Amazon and others with an urge to identify me personally (rather than just recurringly) paint it to be with all of this spy craft. Which is in part the reason I was driven me away to set up and maintain my own services. And why I only keep burner accounts from these, which in turn doesn’t compel me to spend much if anything at all at their stores because I can lose access on their whims. Unfortunately Google is demanding for a phone number even for these accounts now, it’s rather disingenuous way to confirm identity or that I’m not “a bot” coming from a member of the so called FIDO alliance so I’d really really like to hear the reasoning behind it. With hard emphasis on reason-. Security or privacy-related reasons, that’s what it’s claimed, so let’s hear it.

    If Google is serious about security or privacy, maybe start at home? Make your servers reputable again (ship sailed though. Ship already found all wrecked growing a coral reef too) because its alleged intentions with it seem unquestionably, blatantly, transparently insincere.

  • Newer Android comes with IaaS. Specifically: yours.

    Newer Android comes with IaaS. Specifically: yours.

    And by “come with IaaS”1 I really mean “is Google’s customer-provided IaaS. Well… more or less, I’m taking a bit of creative liberty, but I don’t really have to make the same exact infuriating point.

    If you’re using one of the more recent Androids (sic,) besides its usual overly-invasive status quo, you may have stumbled into terms like Private Compute Core, Android System Intelligence, Federated Learning, etc.

    I don’t remember which of these even goes all the way making the effort of putting up a show (in the settings) of either not needing or forbidding itself from connecting to the Internet (as if it would let you have a say on system-level things anyway) so you’re really confident you’re privacy is being respected.

    I’m going to trust Google on this just this once, but mostly because it makes my next point pass as well-researched. (To be honest, I actually “researched” it but finding the ugly was so fast and expected, that it was super anti-climatic…and expected. The lack of build up robbed me from the “Igotchumothafacka!” moment.)

    But let’s pretend I’m gonna teach you how to give birth. Hope you did your Hamas course. Yeah, I know that’s not it, but it feels more now, y’know?. Moving on.

    Though that private core thing might be allegedly private, it’s meant to interact and carry back and forth data with all other apps on your devices, such as your contacts, location services, calendar, the phone app, etc. And last time I checked, those are under no such fatwa, quite the opposite: the last time I set up what’s currently my phone, every single first party app required me to accept a privacy policy before using it.

    BTW, this is a Pixel device, which I got because I thought my previous Xiaomi device was too invasive — Was I about to have a first hand demonstration of what invasive can really be. I had to replace [almost] literally all first party apps with F-Droid-sourced apps. The false belief of having only first party apps would mean a less invasive experience was one of the three reasons I chose this device. It seems as invasive as it was, Xiaomi was actually taming Google’s own egregious efforts not before getting in some of their own, of course.

    For example, just moments ago that I mentioned the phone app, it’s not based on nothing. The phone app — which you’d think is the core app of a portable computer device specifically known as a phone — somehow needs from external support to fulfill its reason of existence. No wonder why a little earlier it had been removed from the AOSP. The only app that I didn’t replace is the Settings app.

    Which is invasive as well, but it’s the most I can do.

    I’m using a custom Android image which already have some privacy protections but it’s not a privacy-focused, BlissRoms, which I thought it was the best featured without being gimmicky since the first time I tried to get it until I finally got it working a full year later. My device is both under MDM and has root access, the bootloader is unlocked. Whenever I’m not using my ultra-filtered Wi-Fi connection, I’m permanently connected to the same network through tunneling so data coming in and out of my device if sifted at all times, except for Google’s of course which has its own rules. I’m a remote code executor’s dream, on the flip side, it gives detailed visibility and manageability into and of my traffic.

    I have more trust in what Windows Defender in Windows Server classified as malware than of a Google Play Services connection, and this launcher that’s I use that’s was a premium purchase at some point but now it’s adware2 That changed too BTW, but that’s for another day however since I mentioned iPhone devices (you’re not supposed to say “iPhones” because IDK… stupidity. Though the deeper reason might be so you don’t think as iPhone “devices” as general computing devices that do things like running software from other sources that don’t involve paying Apple for shit.) as stupid as I hear Siri has become, at least it’s something. I miss stupid Siri, I miss any voice assistant so I don’t have to fumble with my phone which is a fucking bezel-less screen with no thought put on how to hold it without activating random things every fucking time. If you want an assistant on Android you have to surrender so much information it should be illegal. On top of that it asks requires you to train your voice in it, or rather train a model of your voice that’s stored not in-device but paired with the first Google account the device get a hold off on and replicate across the globe in Google’s data centers. It’s not because you’re so important that your information needs redundancy, it’s because you are important as a product for Google to sell that your monetizable information (and since what’s not monetizable today could be monetizable tomorrow: everything) needs redundancy.

    I miss local universal search also known as Spotlight. Pixel devices now come with a non-optional Google search. What could there be so urgent that needs being searched from my homescreen rather than some setting or thing on the actual device. To be fair, Apple patented Spotlight[‘s functionality] on a phone, that’s why Android devices couldn’t have universal search in the beginning but I think since then that has expired.

    Currently, Pixel devices come with zero functionality — that’s none of the advertised (or not) features — that doesn’t need you to accept a privacy agreement or statement or some other waiver (whether bounding or potentially binding) of liability. Why do they need that? Because that’s how legally Google has a head start covering its when for the eventual inevitable lawsuit. But then by then it has collected enough data, and Google seems to be aware that people think shit about it but they’re stuck as evidenced by their continual use of it, so it is unrepentant. That’s what I’ve witness over and over.

    By the way, if you’re thinking “you just a paranoid imbecile, I will fuck with you and take one of you famous rimmings, but you’re a moron with too much time to kill.” That’s understandable. I’m not a journalist, I’m not bound by journalistic ethical guidelines or whatever. I would be honored if we fuck each other silly, but I don’t think I’m being paranoid because then I must be imagining — that’s what paranoia is, right? — the Class Action Suit that has currently undergoing trial, the one that I’m a part of; where Google is being sued because even if you set some data collection off, it found some creative way of still getting it under some other pretense, and doubled down on it trying to claim fair game if it confuses it with unclear um, well… everything. See here: https://www.googlewebappactivitylawsuit.com

    It’s been creative like that in other ways too, this is the company that secretly CCs (or CCOs) emails to its legal team, department, or whatever so the message enjoys Attorney-Client Privilege and thus, as I understand, in US law it can be potentially blocked from everything and everyone if the company chooses, unless it’s forced to reveal it during the discovery phase of a lawsuit, that is if it didn’t delete it because it’s unlike Google to retain all information about you. Wink emoji. Knowing look. Black woman’s “mm-hm” judgmental perfection.

    But you’ve heard all of this before. You probably become jaded to it. If so, then allow me to introduce you, or remind you about Federated Learning. One of those things I mentioned earlier.

    What’s Federated Learning

    Basically, it’s offloading the compute needed for AI from Google’s data centers down to all Android users. Not your piece of the work, everybody’s or rather the work that Google has been advertising in their own Pixel devices with all of those powerful Tensorfuck AI chips or whatever, but really so far they had been sent to the data center for processing, costing the company money to offer this feature that I don’t personally know, or have heard of anybody that cares for it, wants it, or trusts it, yet regardless it’s still shoved down their throats, but now the work is done on-device. Whether you use it or not. Whether you want it or not.

    After energy is wasted at your expense, the processed data is sent back to the cloud (gawd! I hate that term) for the “greater good” à la3 Folding@home, except that scratch the greater good because everybody can see and use and download the data of Folding@home whereas what Google has you process is completely encrypted, and most traffic transmitted to and from your devices nowadays; that encryption is not for your benefit. The federated meaning combined data “the learning” of it is not shared openly, unless of course you use Google’s products which happen to be good for its business given that they are its business. You know how logic can work in mysterious ways.

    On second thought, what worked in mysterious ways might not be logic. Agh. Geography! Am I right? Who cares anyway, if you still don’t understand what I’m trying to say, what’s written in the title: Google is abusing you yet again, without your consent or tricking you to consent — which I’m convinced I am every time I’m forced to accept another EULA mid-service when a company is in a position to keep something hostage from you.

    You should be angry about this. I know I am. I hate this. It’s the reason I can’t bring myself to use Windows and I’m still using a very discontinued macOS version. It’s not so much the data collection or the privacy implications which already should be non-negotiable absentees in a system but what irks me the most is the business behind it at your expense. The same goes for companies that sell you crowd-sourced data, specially live crowd-sourced data.

    A sort of perfect example of this is antivirus software. I don’t know if you whre around of you remember how it used to work: you installed the thing which came with a preinstalled definitions list. Optionally you’d later update it with newer definitions lists which are the things used to identify viruses (yes, that is the plural) by the virus scanner. That’s not the case anymore, together with other malware-related (ransomware, intrusion prevention/protection, …), performance/efficiency/analysis-related (system, storage, sales, email), and the like that offer XaaS (what-fucking-ever as a service), you kind of are both their customer and their product but you are not compensated in either area. Not that it would make it okay.

    Federation

    In IT, federation tends to mean when standards are agreed upon to exchange information, the most common example are directory services and authentication/authorizations providers connections which might be a little much for most to understand, so an easier example is email (which coincidentally often — though feel free to read it as always — uses directory services for its user database — where users of one email service provider can exchange messages with users of another email service provider because it’s been agreed how shit should work. In other words, what protocols to use for the exchanging of the messages and all that.

    However, federation also often used to loosely mean loosely interconnected, or siloed-but-you-can-still-get-to-it, or distributed. The last of which would apply much better in this case, but I can see how the use of that word would be slightly too transparent on the ulteriorness of its motives.

    I know this kinda has a feel like a US’ Republican’s “why should my tax dollars {chest puff} fund the {thing4}” and then proceeding to pass short-sightedness, xenophobia, racism but more than anything selfishness as fairness5. This is not that kind of thing. You have earned the right to be furious about this especially if you are Americ— from the US where the most respected thing, the most important belief in life is money (and lawsuits but who’s counting, certainly not Google, that’s be or should be like a googol, and I can’t count past one hand because I need one free to mastur hold the mouse when I don’t have somebody to help me hold it and click it).

    You are being robbed of your children’s innocence (I assume that amounts to money as well and children in a sentence is always good to stir some shit, late stage too, but I don’t know how to work it in). Grab that pitchfork and unite with your biggot-you-secretly-want-to-fuck6 of a neighbor and get up in arms, and with a little luck: down on fours; it’s bound to happen, you’ll be amped up, with a common enemy and of course drinking, because why not.

    Google has a “cute” comic about this Federated Learning feature where it vaguely mentions the data sent is tiny, 5MB and the like, but so it’s Folding@home and if you put it and a powerful enough computer it will make your machine double as a furnace. I hear old Mac Pros can heat a whole room, the ones identical to PowerMacs.

    In hindsight, I’ve said the same thing each time Google announces a new Pixel device, other than the Nexus 4 which at the time I think it was beautiful and I had to get on the gray market only to gift it away and the Pixel I own now which I chose only because it was the less hideous, I’m not a Pixel fan. So I’ve always had an ample supply of criticism at the ready. I try to be objective but I can’t deny that the fact that is a Google product and the company’s egregious behavior may at time cloud my judgment and has me on a constant high alert mode.

    “Why do they keep packing in so much AI hardware bullshit in it if it still needs to connect to the Internet to do anything”.

    It irked me that like I said before, they’re packing more and more power specifically for AI tasks, yet none of those features work offline.

    “What’s the fucking point!? There’s always some connection to be made <<and since we’re here already, let’s dump all of this user personal information forgot I brought with me>>”

    I had been missing the big picture. From the looks of it had been building the infrastructure right in our pockets, and it hasn’t stopped.

    To Google’s credit, that’s actually very smart, and fucked up, and probably a low level engineer’s idea they got rid off before they could accrue some benefits and savvy7.

    A redeemer

    As I mentioned before, this is the Folding@home MO8 minus the goodwill; that Folding@home shares the product of the communal efforts. So I think the solution would be quite obvious, besides having some much fucking needed transparency or what leaves and comes into our devices, the data generated obtained by these methods should be made public for other organizations and individuals alike to use, even for profit because that’s what Google indirectly is doing, profiting from the advantage it might give it9.

    Google may paint this resource-stealing endeavor as altruistic but it is everything but.

    1. Infrastructure as a Service. Rental of equipment, e.g. a VPS (virtual private server: a cloud-hosted virtual machine) instance is the rental of other people’s computers or [compute] infrastructure. ↩︎
    2. May I remind you I have root access, if I didn’t know how to block traffic without needing an app that tunnels to the loopback interface (AKA 127.0.0.0/8, ::1/128, or localhost, and allegedly). ↩︎
    3. Actually, that’d be au since we’re talking about a logiciel (masculine) right? But English speakers tend to understand à la better. Maybe put me in with “English speakers” because I don’t think I can speak a single French sentence anymore. ↩︎
    4. Usually the betterment of something communal that whomever is saying it is too stupid to trace back to themselves. ↩︎
    5. That “why should I pay for you if you use it and I don’t” glossing over that others have paid for them for that one government discount, service or whatever they use. ↩︎
    6. Or alternatively a biggot-you-fucked-once-forever-ago-but-you-both-feigned-dementia-then-drifted-appart-as-they-got-biggotier-and-you-got-annoyingly-obnoxiously-PC-or-vice-versa-further-amplifying-the-hatred-of-each-others’-guts-but-neither-of-you-would-would-not-immediately-refuse-sharing-the-last-hotel-bed-or-a-tent-or-something-allowing-yourselves-getting-briefly-lost in-though-about-what-could-happen-before-refusing-for-show-but-being-convinced-very-quickly-where-you-provided-most-of-the-rationale-in-favor-of-it-and-left-hastily-in-pretend-disgust-to-walk-off-a-chub, or something. ↩︎
    7. Or from the “free” open source code where it gets its free labor from, fanatical users with no aesthetic sense that material-design tributes to the company before killing the product, close source it, or both. e.g; AOSP’s aforementioned Phone/Dialer app. ↩︎
    8. Loosely “how it works”. ↩︎
    9. For whomever cares or trusts this. ↩︎

  • Batshit Logic

    Batshit Logic

    Let’s do a thought experiment.

    Imagine you’re back on your childhood and have these two friends who have been your best friends forever dating all the way back since the last winter, and nobody could ever replace them …at least until the summer.

    One believes Barbie is the shit, the other is stuck in Hello Kitty. You’re done with that and already had your first gang banged pregnancy scare from the Polo team.

    Each friend argues for the other to abandon their fanatism of their chosen brands of brainwash, or else they’re gonna kill each other. There’s no room for the other’s plastic beliefs.

    One day the bickering between your stupid friends escalates to the point one is throwing rocks at the other in the head, leading to bleeding and early onset alopecia, while the other went low, and pulled hair from other regions, and let’s just say they won’t be needing a bikini wax… maybe ever.

    You sit with both friends and hear their ridiculous arguments, they make no sense to you because they’re batshit crazy but you understand where each is coming from thus you understand it’s an irreconcilable difference, and understand that they’ll never see eye to eye, and much less they’ll see eye to that third eye on that slithering appendage you’ve grown so fond of.

    So after another round with your spiritual councilor… and three other councilors now from the football team, calling for god, at last you finally have your cum to Jesus moment, and decide to intervene: you enlist your mom to go talk to them.

    You tell you mom to make them see that both Barbie and Hello Kitty can’t hold a candle to the candle stick you succumb to your knees to prey on— I mean pray to.

    But what exactly do you tell your mom? To force them to abandon their stupid ideas and make them super sluts, believing in only the almighty dick that moves thee world? Or at the very least moves so many right-wing-family-values-down-low congressmen, or senators, and of course moves you up and down on it. While I do think your idea is better, and I applaud your conviction; maybe they won’t be as well-receiving as you have been to men when you try to force your own thing onto them.

    Wouldn’t you agree that the inability to compromise of each side and forcing their belief system onto the other is what got them into this mess in the first place? And now you’re trying make your mom meddle when it’s not her fucking place to do so.

    Right? You must be able to understand this very basic logic.

    Now, replace the friend that loves Hello Kitty for Gaza, and the other bitch for Israel. You are the protesters in the US trying to make the government (your mom) go fucking meddle. The rocks are the missiles, the pussy punches are the underground tunnels.

    What’s the goal? What do you expect to happen? Religious people believe for real in ghosts. As it is, they’re unreasonable, but it gets “better”.

    Religions generally are authoritarian hierarchies, have a fixed perspective, they rule with fear, they are violent, intolerant, misogynists, they shame people and isolate them which leads to exile, suicide, etc. They waste people’s time, strip their rights, or in some places strip people out of their living breaths. And that’s on secular industrialized nations. Can you even begin to imagine what it would be like in a piece of land that’s not considered a country by anyone, with murderous leaders in one side, and a criminal leader trying to get a superhero moment on the other; so hopefully his pending trial is forgotten.

    When I was watching students protest on the news earlier today I was dumbfounded, or rather founded many dumb on screen… whatever. Don’t you have something better to do than force your leaders intervene where it’s none or their fucking business? What do you think it’s going to happen.

    You have a aspiring self-obsessed dictator who also happens to be a serial rapist and serial liar. Proven to cheat whenever he get the change serial lying rapist running for president and your giving talking points to the crazy party with this stupidity.

    If you want to help, don’t try to impose your will by walking around outside on campus and call yourself an activist. Get on a fucking plane and go fight the fight if you truly mean it. Otherwise just go back to class or to Tik Tok to finish training the AI that will replace you.