<story><title>Use forums rather than Slack/Discord to support developer community</title><url>https://www.mooreds.com/wordpress/archives/3451</url></story><parent_chain><item><author>thaumasiotes</author><text>Just a couple of days ago, I signed in to a gmail account using the correct username and password.&lt;p&gt;Gmail intercepted me and claimed to be worried that they couldn&amp;#x27;t recognize the device I was using. According to the flow, they wanted me to verify my identity in one of three ways: (1) I could verify the backup email address associated with the account; (2) if unable to do that, I could provide the 2FA code sent to that same backup email address (how would I be able to know this without being able to know what the address was?); or (3) I could provide a phone number -- previously unknown to Google -- on the spot, and then provide the 2FA code sent to that brand-new phone number. (How is this supposed to help them verify my identity?)&lt;p&gt;I went for option (2), the email 2FA code. After providing the code, I was informed that, before signing in to my existing gmail account, I must also provide a phone number and enter the 2FA code sent to my new phone number.&lt;p&gt;So I went back and went for option (1), typing in my backup email address. Same thing happened. Because Google &amp;quot;couldn&amp;#x27;t recognize the device I was using&amp;quot;, I was not allowed to sign in to an account I obviously controlled without providing a phone number with absolutely zero authentication value.&lt;p&gt;I did find a workaround. If you attempt to sign in to an account afflicted in this way &lt;i&gt;in an incognito browser window&lt;/i&gt;, Google will, for the moment, allow it.&lt;p&gt;&amp;quot;Don&amp;#x27;t be evil&amp;quot; is long gone.</text></item><item><author>errantspark</author><text>I constantly run into this problem, I&amp;#x27;ve used my google voice number for everything for years (yeah it&amp;#x27;s not a great move but very hard to migrate away from) and a frustrating number of services recently have been rejecting it for verification. I end up having to take the sim out of my laptop and put it in my PinePhone. It&amp;#x27;s such a hassle. This whole &amp;quot;you&amp;#x27;re not a human unless you have a phone number&amp;quot; thing sucks. Same thing with having a credit score. You&amp;#x27;re just assumed to participate in these systems even though there&amp;#x27;s no mandate to do so or protection for you if you don&amp;#x27;t.</text></item><item><author>jedberg</author><text>Oh please do.  This seems like the perfect time to bring this up:&lt;p&gt;I had a piece of software that used Discord for support.  They required that users be verified, which requires you to give you phone number to Discord.  I gave them my Google Voice number, which is the only number I have, and they rejected it because they don&amp;#x27;t support VOIP numbers.  I asked them if there was any other way to verify my identity.&lt;p&gt;They told me, &amp;quot;Just use a friend&amp;#x27;s phone to verify.  As long as they don&amp;#x27;t try to verify on Discord in six months it should be fine, we won&amp;#x27;t check again&amp;quot;.&lt;p&gt;Their official answer to identity verification was to impersonate someone else!</text></item></parent_chain><comment><author>eftychis</author><text>Never ever ever ever give your phone number to Google for verification or authorization. People just don&amp;#x27;t understand how easy it is to find someone&amp;#x27;s phone number and then steal it for long enough to steal e.g. emails. Has happened, will happen etc. Like ssn, phone numbers were never made for this purpose. In fact phone numbers and services (e.g. SMS) are just the front end and are setup to be easy to redirect.&lt;p&gt;We had incidents in the past just because the colleague had given the number to Google and those were corporate accounts.&lt;p&gt;Every time a service moves to SMS or phone calls for 2FA a cry can be felt across the universe by any security engineer&amp;#x2F;cryptographer.&lt;p&gt;If you are a person responsible for this: please don&amp;#x27;t. If my antiquated bank that is insured and doesn&amp;#x27;t really care can understand this, so can you, if you care just a bit.</text></comment>
<story><title>Use forums rather than Slack/Discord to support developer community</title><url>https://www.mooreds.com/wordpress/archives/3451</url></story><parent_chain><item><author>thaumasiotes</author><text>Just a couple of days ago, I signed in to a gmail account using the correct username and password.&lt;p&gt;Gmail intercepted me and claimed to be worried that they couldn&amp;#x27;t recognize the device I was using. According to the flow, they wanted me to verify my identity in one of three ways: (1) I could verify the backup email address associated with the account; (2) if unable to do that, I could provide the 2FA code sent to that same backup email address (how would I be able to know this without being able to know what the address was?); or (3) I could provide a phone number -- previously unknown to Google -- on the spot, and then provide the 2FA code sent to that brand-new phone number. (How is this supposed to help them verify my identity?)&lt;p&gt;I went for option (2), the email 2FA code. After providing the code, I was informed that, before signing in to my existing gmail account, I must also provide a phone number and enter the 2FA code sent to my new phone number.&lt;p&gt;So I went back and went for option (1), typing in my backup email address. Same thing happened. Because Google &amp;quot;couldn&amp;#x27;t recognize the device I was using&amp;quot;, I was not allowed to sign in to an account I obviously controlled without providing a phone number with absolutely zero authentication value.&lt;p&gt;I did find a workaround. If you attempt to sign in to an account afflicted in this way &lt;i&gt;in an incognito browser window&lt;/i&gt;, Google will, for the moment, allow it.&lt;p&gt;&amp;quot;Don&amp;#x27;t be evil&amp;quot; is long gone.</text></item><item><author>errantspark</author><text>I constantly run into this problem, I&amp;#x27;ve used my google voice number for everything for years (yeah it&amp;#x27;s not a great move but very hard to migrate away from) and a frustrating number of services recently have been rejecting it for verification. I end up having to take the sim out of my laptop and put it in my PinePhone. It&amp;#x27;s such a hassle. This whole &amp;quot;you&amp;#x27;re not a human unless you have a phone number&amp;quot; thing sucks. Same thing with having a credit score. You&amp;#x27;re just assumed to participate in these systems even though there&amp;#x27;s no mandate to do so or protection for you if you don&amp;#x27;t.</text></item><item><author>jedberg</author><text>Oh please do.  This seems like the perfect time to bring this up:&lt;p&gt;I had a piece of software that used Discord for support.  They required that users be verified, which requires you to give you phone number to Discord.  I gave them my Google Voice number, which is the only number I have, and they rejected it because they don&amp;#x27;t support VOIP numbers.  I asked them if there was any other way to verify my identity.&lt;p&gt;They told me, &amp;quot;Just use a friend&amp;#x27;s phone to verify.  As long as they don&amp;#x27;t try to verify on Discord in six months it should be fine, we won&amp;#x27;t check again&amp;quot;.&lt;p&gt;Their official answer to identity verification was to impersonate someone else!</text></item></parent_chain><comment><author>megous</author><text>It&amp;#x27;s especially nice when traveling. I was once asked by a client to do something while I was in other country about 5k km from regular location. Couldn&amp;#x27;t login to the apps account for this reason (no backup email or phone set). So I didn&amp;#x27;t do the work.&lt;p&gt;I suspect it&amp;#x27;s some work-life balance enhancing thing. :D&lt;p&gt;I don&amp;#x27;t really mind, since it also helps me bash Google services in front of my clients who still use them, without being aware of these failure modes.&lt;p&gt;Personally speaking, it&amp;#x27;s absolutely a no go service. I can probably handle service loss at home quite fine, but if I relied on google or other services with these &amp;quot;anti-abuse&amp;quot; features while traveling that would be very stressful. I usually print out everything important before departing so I don&amp;#x27;t rely on any electronics, anyway, because none of it is as reliable and as quickly accessible as a piece of paper or a bunch of cash.</text></comment>