News for hackers. Stuff that matters.
Re:Gmail 2FA causes the homeless to permanently lose access ... by cmeacham98 on Friday October 07, 2022 @09:56AM (#33121370)
> It is possible to encourage 2FA but allow to opt out.

You might be surprised to learn that this is how it works for Google accounts: it is default-on but you can turn it off.

> If they at least would allow for a sufficient number of options. Like paper-tan (even self printed), yubikey or similar, second email address, an authenticator, ... but even big companies often only require a phone number.

You might be even more surprised to discover that all of these options are supported for Google accounts.

Re:Gmail 2FA causes the homeless to permanently lose access ... by valenterry on Friday October 07, 2022 @09:58AM (#33121396)
Not only have I not said that Google doesn't offer 2FA - yes they do.

However, Google tries _very hard_ to prevent people from e.g. creating a gmail account without a phone number. Try it if you don't believe me.

Re:Gmail 2FA causes the homeless to permanently lose access ... by judge2020 on Friday October 07, 2022 @10:18AM (#33121672)
I definitely vividly remember needing it a few years ago, but right now I can try to sign up and it says "Mobile Number (optional)" (Maybe that's based on some security heuristics).
Re:Gmail 2FA causes the homeless to permanently lose access ... by valenterry on Friday October 07, 2022 @10:25AM (#33121785)
Yeah and it also only works on your phone (or if you know how to make Google think you are on your phone) and in certain countries. All to my knowledge and based on my tests.
Re:Gmail 2FA causes the homeless to permanently lose access ... by a_JIT_pie on Friday October 07, 2022 @01:56PM (#33124767)
I thought the same but I just tried on firefox desktop (Windows) and spun up a new google account with email, password, fake first+last name and fake bday. Really, I was expecting to be stopped at "Phone Number required" but it is indeed optional.
Re:Gmail 2FA causes the homeless to permanently lose access ... by nahkoots on Friday October 07, 2022 @02:10PM (#33124943)
I just did it from Firefox on Linux in a private tab near Washington, D.C.. Fake name, no phone, no backup email. I was able to log out, sign back in, and send an email without any trouble.

No doubt they're letting me through because some security heuristic says I'm a real human, and I'm sure they'd eventually make me provide a number if I continued using the account (this happened to me with my university G Suite account a couple years ago and I needed to contact my IT department to manually disable the phone challenge), but so far I can't see any evidence that they're doing anything unreasonable.

Perhaps they're requiring you to use a number because you've tested it a lot.

Re:Gmail 2FA causes the homeless to permanently lose access ... by valenterry on Friday October 07, 2022 @09:20PM (#33128933)
We are talking about creating an new account, not about signing in.
Re:Gmail 2FA causes the homeless to permanently lose access ... by ranger_danger on Friday October 07, 2022 @10:02AM (#33121454)
Google only allows non-U2F 2FA methods (like TOTP) to be enabled AFTER enabling a hardware U2F device. And signing up without a working mobile number is impossible. Anyone who says that's not true hasn't actually tried in the last several years.
Re:Gmail 2FA causes the homeless to permanently lose access ... by nyuszika7h on Friday October 07, 2022 @10:19AM (#33121686)
I definitely had TOTP before I had U2F. I think you mean after enabling SMS 2FA, not U2F.
Re:Gmail 2FA causes the homeless to permanently lose access ... by ranger_danger on Tuesday October 18, 2022 @10:04AM (#33247307)
Nope, while I also did have TOTP before U2F (because it wasn't even a thing then), the rules changed to where if you don't have a phone number on your account, then you're required to enroll a U2F device before you can turn on TOTP.
Re:Gmail 2FA causes the homeless to permanently lose access ... by exodust on Friday October 07, 2022 @12:14PM (#33123300)
Can't turn it off for Google Ads account any more. Won't let you in. This is a real pain for shared google account in a small team like ours. Sick of Google removing user choice.

We all knew password, no problems at all. Now it mandates 2FA. And because they mandate it for Google Ads, now it's on for everything like Google Drive etc.