News for hackers. Stuff that matters.
Re:Google Authenticator now supports Google Account synchron... by explodingwaffle on Monday April 24, 2023 @04:37PM (#35692884)
While we’re complaining about Google’s 2FA offering…

The issue described here started happening to me recently: https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-G...

Summary- Google has added a “match the numbers in the app” style 2FA to YouTube. Makes sense- their video monopoly means that for many iOS users like myself it’s the only Google app they’ve got. Except…

1) It’s the default, and there’s no apparent way to change it, or even turn it off. This is annoying- I prefer TOTP since it’s more secure. There’s a Google Prompts section in the 2FA settings, but it says that I don’t have any supported devices. This actually makes sense, because

2) It doesn’t f*king work! Ever since they changed it from “press yes” to “match number”, the screen opens in the YouTube app and then loads forever. Which means I’ve got a spurious notification on my phone, a screen to dismiss next time I open the YouTube app (or several, because for some reason they can stack), and two extra clicks every time I log into Google on a new device.

Actually, I lied earlier- there is one way to disable it, and it’s to DISABLE ALL 2FA, as you can see people doing in that support thread. I honestly don’t blame them, but clearly less 2FA was not the plan of whoever’s idea this was. Speaking of support forums- I don’t think anyone at Google reads them, but they do read HN :))))

Re:Google Authenticator now supports Google Account synchron... by lasr_velocirptr on Monday April 24, 2023 @05:00PM (#35693213)
One of the potential solutions might be to just treat youtube as a separate service i.e. create a separate account for YouTube with 2fa disabled.

It’s not ideal since you need to deal with two accounts but that’s what password managers are for.

Re:Google Authenticator now supports Google Account synchron... by hyperdimension on Monday April 24, 2023 @05:17PM (#35693405)
Wow, that link is such a great example of Google's "support."

"This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours."

...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?

Re:Google Authenticator now supports Google Account synchron... by 0xbadcafebee on Monday April 24, 2023 @06:03PM (#35693880)
> On Google's side, why even bother replying at all if that's all you're going to do?

Oh, it's just so they can claim to their advertisers that they do support.

Remember: if you're not paying for the product, you are the product! (https://en.wikipedia.org/wiki/Television_Delivers_People)

Re:Google Authenticator now supports Google Account synchron... by devnullbrain on Monday April 24, 2023 @06:17PM (#35694012)
>Remember: if you're not paying for the product, you are the product!

This cliche isn't true: if you pay, you're a more valuable mark. You're always a product.

Re:Google Authenticator now supports Google Account synchron... by dontblink on Monday April 24, 2023 @06:13PM (#35693978)
Just an FYI here: Google's community support forums aren't well named as their intended purpose is for users to answer other user's questions. For the community to support each other.

For actual support you need a paid account to reach out to.

You could argue that it's badly named and should just be called Google's community forum instead, which is what it really is.

Re:Google Authenticator now supports Google Account synchron... by hyperdimension on Monday April 24, 2023 @06:54PM (#35694354)
That's pretty funny and makes sense. I guess I shouldn't have expected anything more from Google. Thanks for the clarification.
Re:Google Authenticator now supports Google Account synchron... by philsnow on Tuesday April 25, 2023 @01:43AM (#35696897)
Outside of google employees, who even posts to these community support forums? Simps for Google?
Re:Google Authenticator now supports Google Account synchron... by felixg3 on Tuesday April 25, 2023 @03:36AM (#35697586)
Have you seen answers.Microsoft.com, the most useless support community on the internet full of „independent advisors“ aka Microsoft simps just sending links to irrelevant documentation?
Re:Google Authenticator now supports Google Account synchron... by donkeyd on Tuesday April 25, 2023 @05:48AM (#35698356)
While we're at it, have you seen the Apple ones? 3 year old threads with 100 messages of people saying 'I have this same issue' and zero response from Apple.

Some examples of the subjects of these threads:

- SD Card readers in original M1 Macbook Pro not working

- Bluetooth headphones balance getting messed up randomly (so old someone created an application to automatically center balance)

- Specific Intel Macbooks crashing after using a Thunderbolt dock exactly twice.

All of them with no response from Apple at all and no fixes in sight.

Re:Google Authenticator now supports Google Account synchron... by philsnow on Tuesday April 25, 2023 @11:28AM (#35701836)
Very fair replies. I didn't mean to call out Google + fans of Google in particular, but rather "Bigco"s and fans thereof in general.

Out of all of them I guess I'm more disappointed in Apple because they have cultivated this aura of superior UX (so that emphasis on UX should extend to when people have problems).. but then again it's largely just an aura.

Re:Google Authenticator now supports Google Account synchron... by abirch on Monday April 24, 2023 @08:14PM (#35694973)
Where is Bard?

Oh it's still waiting for its Google Authentication Numbers.

Re:Google Authenticator now supports Google Account synchron... by kapep on Tuesday April 25, 2023 @05:36AM (#35698270)
Even better is this comment by another support team member:

> I'm chiming in to ensure you've got the answer you're looking for. Feel free to let us know if you have more questions about this.

Totally void of any helpful information or even remotely understanding of the issue. Of course at the time the comment was posted, no useful answer had been given by any support team member.

But to be fair though, the support team did follow up a few month later:

> Thanks all for your patience on this post, and sorry for the confusion. I originally pinned a response by @knewland397 as a helpful workaround for some folks on the thread, but I understand that it didn’t answer the whole question. Happy to shed some light on the situation here!

> Prompts like this are intended to be easier than entering a verification code to log in, and you can receive them from not only the Youtube app, but the Gmail app, Google Photos app, and more. To learn more about prompts and how they help keep your account safe, stop by our Help Center [1].

> To answer your question of why your Nest Community account is impacted, our community uses the same Google Account authentication as the rest of Google services.

> For future reference, our friends over at the Google Account Help Community are best equipped to help you with these types of questions. This forum is meant to host discussion about apps and accounts as they relate to Google Home and Nest.

The help center [1] indeed documents the apps (under the "iPhone and iPad" tab):

> Gmail App, YouTube App YouTube, Google App, Fotos App Fotos, AdWords App or Smart Lock App.

[1]: https://support.google.com/accounts/answer/7026266

Re:Google Authenticator now supports Google Account synchron... by NavinF on Monday April 24, 2023 @05:56PM (#35693817)
Never encountered that. Is this because I got lucky in an A/B test or because I have Advanced Protection turned on and only use FIDO keys?
Re:Google Authenticator now supports Google Account synchron... by miohtama on Monday April 24, 2023 @07:36PM (#35694690)
If you are not paying for it, you are not the customer, but the product.
Re:Google Authenticator now supports Google Account synchron... by npteljes on Tuesday April 25, 2023 @09:10AM (#35699948)
We are products either way.
Re:Google Authenticator now supports Google Account synchron... by contravariant on Monday April 24, 2023 @07:38PM (#35694707)
Out of interest what is the added value of using the Youtube app over visiting youtube on a webbrowser?
Re:Google Authenticator now supports Google Account synchron... by oittaa on Monday April 24, 2023 @07:55PM (#35694824)
Downloading videos for offline watching. For example during flights without a wifi.
Re:Google Authenticator now supports Google Account synchron... by cute_boi on Monday April 24, 2023 @07:59PM (#35694859)
why not use youtube-dl?
Re:Google Authenticator now supports Google Account synchron... by thaumasiotes on Monday April 24, 2023 @08:23PM (#35695039)
If you did that, you wouldn't get the ads that the official app shows.
Re:Google Authenticator now supports Google Account synchron... by cute_boi on Monday April 24, 2023 @08:30PM (#35695100)
Oh, let me apologize for daring to give people this suggestion. How foolish of me to forget that most people are just dying to hand over their personal data to Google, all in the name of their oh-so-benevolent services. And by the way, I think people love watching "This stream is supported by skillshare" ads? We definitely need more companies like them, making it easier for us to be spied on. Don't you agree?
Re:Google Authenticator now supports Google Account synchron... by npteljes on Tuesday April 25, 2023 @09:10AM (#35699939)
It breaks integration with the YouTube app, and it's a bit of a maintenance keeping up with the latest version, whether to use youtube-dl or yt-dlp or another fork, etc.
Re:Google Authenticator now supports Google Account synchron... by oittaa on Wednesday April 26, 2023 @02:59AM (#35710355)
Why use Netflix or Disney+ when you can go to The Pirate Bay?
Re:Google Authenticator now supports Google Account synchron... by pests on Monday April 24, 2023 @08:27PM (#35695073)
A way better experience. YouTube web is slow and clunky.
Re:Google Authenticator now supports Google Account synchron... by jdeibele on Monday April 24, 2023 @10:50PM (#35696018)
I paid $1.99 for Vinegar and on my iPad (and Mac) I get ad blocking, videos playing in the background, etc. It can be a little clunky because autoplay of the next video doesn't seem to work and there are times I'd like to use a music playlist. It's probably my fault but a quick glance at settings didn't resolve it.

https://apps.apple.com/us/app/vinegar-tube-cleaner/id1591303...

Re:Google Authenticator now supports Google Account synchron... by zo1 on Tuesday April 25, 2023 @02:26AM (#35697180)
I use the web one exclusively. Other than the video pop out feature missing and once in a while scrolling bugs on shorts, it actually works perfectly fine.

I refuse to use the YouTube app because they disabled playing in the background or with the screen locked . They Want your eyeballs on the screen for the ads. It so blatant.

Re:Google Authenticator now supports Google Account synchron... by pests on Tuesday April 25, 2023 @04:39PM (#35706452)
If I get sent to the web version I open in app immediately since its such a better experience for me.

They allow background play and screen-off play. You just need to subscribe to Premium.

Re:Google Authenticator now supports Google Account synchron... by mc10 on Monday April 24, 2023 @09:11PM (#35695375)
On iOS the YouTube website only supports video resolutions up to 720p.
Re:Google Authenticator now supports Google Account synchron... by MatmaRex on Monday April 24, 2023 @09:35PM (#35695529)
The YouTube mobile website is intentionally crippled. For example, the video refuses to play in a video popout, even though the same browser feature works for me on other mobile websites and on desktop YouTube. Personally I just avoid browsing it on mobile as a result, but I could see someone being convinced to install the app.
Re:Google Authenticator now supports Google Account synchron... by bigfudge on Tuesday April 25, 2023 @03:08AM (#35697406)
On iOS, installing vinegar sorts this. You get video pop outs and no ads to boot. It’s much better that the app and seems to give longer battery life (hardware acceleration?)
Re:Google Authenticator now supports Google Account synchron... by thefourthchime on Monday April 24, 2023 @09:07PM (#35695343)
Re: “it’s doesn’t fucking work”.

I don’t know if it’s just me, but it seems like for the last couple years the products from the FAANG companies have been rotting on the vine. It seems like all the people that made these have moved on and have a b-team barely making them work.

Re:Google Authenticator now supports Google Account synchron... by kotatsuyaki on Monday April 24, 2023 @09:51PM (#35695653)
GitHub has a similar problem, where the GitHub mobile app can’t be disabled as an 2FA factor. They implemented an option to make other factors as the “default” without the ability to completely disable mobile, and then falsely closed the discussion [1].

If such insecure factor can’t be disabled, what’s the point in setting up TOTP and / or hardware keys?

[1]: https://github.com/orgs/community/discussions/10861

Re:Google Authenticator now supports Google Account synchron... by bombcar on Monday April 24, 2023 @09:53PM (#35695669)
The point is to offload security faults onto the customers so tickets can be ignored.
Re:Google Authenticator now supports Google Account synchron... by 1letterunixname on Tuesday April 25, 2023 @12:05AM (#35696392)
Google's TOTP is not as good as it could be being HMAC-SHA1 of a symmetric secret and Unix epoch. WebAuthn with a hardware device is less prone to losing and compromising secrets.

I use all 2FAs allowed.

Tangent on passwords. What the world needs is a path to automated, interoperable secret management in 3-4 RFCs:

User-operable, standardized password change REST API that:

0. Sends a session token/nonce

1. Describe the password policy declaratively and precisely, to be validated client-side with boilerplate client code

2. Offer a list of supported PBKDFs and their required and allowed parameter values

3. Includes both client- and server-side PBKDF hashing with minimum values for a given risk type AND adjusted with the "inflationary" Moore's Law costs of tech resources (CPU, GPU, RAM, ASIC, FPGA, QC) over time

---> This would then permit a password manager app to automatically change every password perhaps every day. I'm thinking the future should be like this but use user certificates as a primary AA mechanism and passwords as a break-glass-backup.

Re:Google Authenticator now supports Google Account synchron... by account42 on Tuesday April 25, 2023 @04:45AM (#35698010)
A hardware device = SOL if it breaks. Few things warrant that much risk for a bit more security.