Comment by aikinai
5 years ago
How does that story have anything to do with being evil, by any stretch of the definition?
Are you insinuating that Google has this convoluted verification flow to intentionally harm people in some way? Or even to intentionally harm privacy or further business goals at users' expense?
Or are you just using "evil" to refer to anything you don't like?
The outcome is that they hold your email / data hostage while escalating their demands for your personal information. That sounds pretty evil to me.
That may not be what they intend, but that is result, regardless.
>Or even to intentionally harm privacy or further business goals at users' expense?
Yes (and obviously).
Google, and other SaaS, have used such dark patterns to collect more user identity data (user profile info is what they ultimately sell - even if sold to advertisers "anonymized", the profile is richer and more worth the more data they have on you).
What never seems to come up is that as far as ads are concerned and with the amount and kinds of data that these companies are and have been collecting, your name is worth zilch. "Anonymized" is a red herring.
> How does that story have anything to do with being evil
Google forcing you to enter a phone number is dishonest/hostile and has absolutely not the slightest to do with any desire to make your account more secure.
It's basically just Google holding your account hostage to get your phone number.
It’s a false reason to collect more data by holding your Gmail hostage until you provide a phone number. It is a pretty shitty user flow with no benefit except for their data collection.
I think that comment refers to Google trying to know more identifiable information about the user: a phone number. Which adds to Google’s collection of private data, susceptible to more profiling and such.
FB were caught using 2FA phone numbers for 'evil' purposes.
https://www.eff.org/deeplinks/2019/07/fixed-ftc-orders-faceb...
As noted in the parent, in the given scenario the phone number provides absolutely no improvement in security or verification that the person who enters the phone number is actually the owner of the account. At best, granting Google the benefit of the doubt, it is security theater.
So, since it isn't effective for its stated purpose, are there other reasons it could be in place?
It's not security theater, they don't verify whose phone number is provided. Whatever number they get is used to unlock the account.
That's what would make it "security theater" as opposed to "security".