Category: Uncategorized

I tried signing in on one of my Google accounts, it’s a semi-burner-type because I don’t want to associate personal information with it.

Anyway, yesterday it decided that it wouldn’t let me sign in anymore. The process implies that the password is wrong, and for a bit it made me second-guess myself, but I’m good with passwords (without MFA) so it didn’t seem right. I entered a deliberately wrong password to see what happened, and indeed the denial was much quicker and it was no longer suggesting that I might have my password wrong, it was outright stating it.

Each time, by the way, this would happen (i.e. I correctly entered my password), it would automatically initiate the I-haven’t-tracked-you-with-this-IP-address-yet internal protocol or whatever, so it would send me a code over email. I guess this is a good time to tell I’m not using an account that ends in @gmail.com but uses my own domain, on my own servers (this is only a Google account with no Gmail) meaning IF I HAVE ACCESS TO THE ACCOUNT it should be enough to satisfy those identity concerns as far as Google’s involved, because it would mean I have control of DNS servers, registrar account, mail servers, proxies, directory servers, and all the ridiculous amount of complexity that email requires worked out, but that was not the case.

Instead, it’s completely glossed over and what really happens is that as soon as I enter that code that was sent automatically without any warning or consent (as I never set up MFA in the first place) I get another blank field to enter a mobile number so Google can know for sure it’s me by sending me yet another code.

How exactly would that work? How can that be possibly be tied to me if I had never given Google a phone number to match it with. More importantly, as an authentication factor, this would fall under a possession factor, but I already used that with the emailed code.

Email provided by Google would be normally unlocked with the same password used to login to an account. That’s something you know, the knowledge factor. Assuming your in the vicinity of where you normally access you account from, that already should be enough for multi-factor authentication because another factor that Google doesn’t acknowledge as a factor is someplace you’re in, the location factor, that’s unless you fail to meet it because then the fact that Google is tracking your location whenever or however it can, can be spun as a matter of security and not a matter of privacy, as it would be “revelatory” of that well-known thing.

But let’s pretend that’s not a thing and get to the code; in order to receive it I would need to have access to my non-Google provided email account. That is something you have. The possession factor. It’s the same thing as having a valid SIM card (itself a form of smart card) to authenticate to your carrier and get that message with the code. Your carrier might even have the option of forwarding text to an inbox or you might have a VoIP line that forwards your texts to anything with an API such as Telegram, I used to do this. Regardless, it’s still only something you have.

What it is not is something Google has, or probably more appropriately something Google wants. Assuming my account has really been compromised and already I passed at least two of five authentication factor, where only 4 are really practical after taking out behavioral, and only 3 are really practical after taking out biometrical given those two (as well as location but I guess we’re ignoring that) are extremely invasive, this is why in the case of biometrics an in-device verification is often used instead (I checked that box too but that only works with an in-device account, not in-browser even the browser is on the device signed in. Unless it’s Googles’ own browser). The one remaining is the one unrecognized but already failing: location. Which is often what triggers all of this nonsense. Google from my point of view wants confirmation of the places you visit.

Again assuming my account has been compromised, and if they have access to email my personal safety has been compromised as well asking for phone number to get a code, would not constitute another factor I have already presented. It wouldn’t constitute a factor at all because Google has no way to verify the phone number with nothing to match it against. An if I have truly been compromised, it would have no way to know it’s handing a third party an opportunity to lock me out further by adding information to my account I could never match, and compromising Google’s own data in the process.

Google sign in/up pages say to prevent lock out by entering a phone number. Why would I be locked out for non matching and why must it be a phone number. Why not a key pair, it’s the standard and the base of all security, it’s used in many things from physically as some form of smart card (SIM card, ATM cards, ID cards, public phone cards) or in their virtual form best and most often known as certificates, or more recently passkeys which can prove possession and in turn verify identity without disclosing that identity, if Google is so concerned for user security and privacy, or arguably their wellbeing, as it claims.

If Google is so concerned for it, in the troubleshooting article about account access, when all methods requiring personal identifiable information aren’t met, why is Google so quick to suggest to “just open a new account”. To me that sounds as it doesn’t really care if you ever get access back, or what might happen with your recurring charges if you have any, as long as you have another account for Google to keep tabs on you. You could make a video call with an ID in hand, it’s still invasive, it’s not perfect but it’s a solution for those that chose to rely on Google for anything just finding out that relationship wasn’t as symbiotic as they thought.

Google doesn’t seem to be interested on identifying the accountholder being the same but rather the accountholder themselves.

They’d be left without access to cancel subscriptions, or email to change the basically anything relating their other accounts, including the bank’s to kill those cards. That’s hardly caring about their wellbeing.

Using a phone number isn’t even reliable security either as your carrier could hypothetically reassign your phone number to another person out of the blue and there goes your MFA. It’s not, or it wasn’t hypothetical for me, it’s what AT&T did to me a few years back, hence I’m not attached to a phone number or a device that is not autonomous (that requires to be signed in somewhere).

How do I know it’s not going to abuse it, because on the same message where it asks for the phone number it says that Google would store this phone number BUT ONLY for security purposes, it was missing a “pinky swear yoo-guyeess”.

It reminded me to all the times it has allegedly stored data for security purposes but then proceeded to abuse using a loophole like that class action suit (that might be still ongoing) against Google that which I was notified I’m in; where the last thing Google did was asking to dismiss the case, proving to me it has no remorse for its behavior, nor respect for the users that make it money.

In any case if Google has so. much. concern. — so much! — for our accounts, and privacy, why does it keep implementing measures that require a server, a Google server to work. Most of the Google’s services don’t work correctly in my network because the firewall blocks trackers. I didn’t choose nor single out Google, the block comes from automatically updated crowdsourced blacklists, meaning the entire planet deemed its servers adversarial by adding them in these lists. Case in point; as I type this, yet another burner account was triggered Google’s unsolicited[, probably location-tracking-based-]protection, and [also without being solicited] made my Android device a piece of its MFA puzzle, but since it cannot properly communicated with block servers, I assume, the messages twice over the maximum time allowed to complete the whole thing only to show up.

Then it froze when I tapped on the green checkmark to confirm that my online activity is dull, not as exciting and dangerous as Google, Apple, Microsoft, Amazon and others with an urge to identify me personally (rather than just recurringly) paint it to be with all of this spy craft. Which is in part the reason I was driven me away to set up and maintain my own services. And why I only keep burner accounts from these, which in turn doesn’t compel me to spend much if anything at all at their stores because I can lose access on their whims. Unfortunately Google is demanding for a phone number even for these accounts now, it’s rather disingenuous way to confirm identity or that I’m not “a bot” coming from a member of the so called FIDO alliance so I’d really really like to hear the reasoning behind it. With hard emphasis on reason-. Security or privacy-related reasons, that’s what it’s claimed, so let’s hear it.

If Google is serious about security or privacy, maybe start at home? Make your servers reputable again (ship sailed though. Ship already found all wrecked growing a coral reef too) because its alleged intentions with it seem unquestionably, blatantly, transparently insincere.