Path: news.eternal-september.org!eternal-september.org!feeder3.eternal-september.org!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: "Carlos E.R." <robin_listas@es.invalid>
Newsgroups: comp.mobile.android
Subject: Re: Google will no longer send SMSs with six digit codes for
 verification
Date: Mon, 3 Mar 2025 11:48:28 +0100
Lines: 80
Message-ID: <s0eg9lxcan.ln2@Telcontar.valinor>
References: <803e9lxp44.ln2@Telcontar.valinor>
 <1begjrynfhjra$.dlg@v.nguard.lh> <k8cg9lx8uf.ln2@Telcontar.valinor>
 <1bfu5iribmwb4$.dlg@v.nguard.lh>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net hXM7IGSSAQYNKCVwmAe/TwDQSVTOb0MbGqor87OSAHpeD60Ilq
X-Orig-Path: Telcontar.valinor!not-for-mail
Cancel-Lock: sha1:diLnM11kOGvA1Emgwyu47Q0iwlg= sha256:YEVEYUw7+7Up2Tl7scXoqg5EIj51hsje2Oa5Xc+/xRA=
User-Agent: Mozilla Thunderbird
Content-Language: es-ES, en-CA
In-Reply-To: <1bfu5iribmwb4$.dlg@v.nguard.lh>

On 2025-03-03 11:39, VanguardLH wrote:
> "Carlos E.R." <robin_listas@es.invalid> wrote:
> 
>> On 2025-03-03 11:05, VanguardLH wrote:
>>> "Carlos E.R." <robin_listas@es.invalid> wrote:
>>>
>>>> Hi,
>>>>
>>>> Just read yesterday that Google will no longer send SMSs with six digit
>>>> codes for verification of gmail account, but instead will use QR codes.
>>>> This is to avoid scams in which the victim is told to tell the fraudster
>>>> the number he just received on the phone.
>>>>
>>>> I have a source but it is in Spanish:
>>>>
>>>> <https://www.20minutos.es/tecnologia/ciberseguridad/novedad-google-luchar-contra-estafas-adios-autenticacion-digitos-sms-5685840/>
>>>>
>>>> Oh, English here:
>>>> <https://www.forbes.com/sites/daveywinder/2025/02/26/google-confirms-gmail-to-ditch-sms-code-authentication/>
>>>
>>> Doesn't make sense.  Say I'm using a desktop PC.  Nope, it doesn't have
>>> a cellular or landline phone line to it (it cannot do telephony) which
>>> is typical of desktop PCs.  I want to login to my Gmail account.  How
>>> are they going to send an SMS text to my desktop PC?  Not everyone
>>> logging into Gmail is using a smartphone to do so.
>>
>> Tough luck. The SMS is sent to the phone that is registered with the
>> account.
> 
> What was the point of Google (and Microsoft) fucking up OAUTH, a
> protocol, to screw into the OAUTH2, a framework, for authenticated
> logins?

2FA.

> 
> Whether on my Android phone or Windows desktop using OAUTH2 email apps,
> or using a web browser with HTTPS, I've never received an SMS text (on
> my phone) to complete a login to Gmail.  If they replace SMS texts with
> QR codes (delivered how?), well, I wasn't getting SMS texts before, so I
> won't be getting QR codes, either.

I have.

> 
> If the QR codes are sent via SMS texts, instead of getting a string of
> numbers the users get a QR code.  Um, just what is a QR code?  Scan one
> to see it is just embedded text.  Maybe Google is assuming no one has a
> QR scanner app on their phone to decode what text it contains.

This is undefined. Probably you get a QR graphic in the computer, and 
you have to take a photo of it with your phone, inside some application 
they still have to tell us.

> 
> Once the QR image arrives via SMS text on the phone, what the hell am I
> supposed to do with it?  Not like I can point the phone's cameras at the
> phone's screen to read the QR image to decode into the text within.  So,
> whatever is attempting the login must incorporate a QR scanner that can
> look at QR images in SMS texts?

See above.

> 
>>> However, my IMAP e-mail client using OAUTH2 to login never sends me
>>> anything to further authenticate the login.
>>>
>>> To where is Google going to send their QR code when I use a web browser
>>> to connect and log into https://www.gmail.com?
>>
>> To your registered smartphone.
> 
> And I'm somehow supposedly to magically scan a QR code in an SMS text
> sent to my phone to get it to my desktop?  Unlike a numeric string, I
> cannot transcribe a QR code into whatever is the text within it.

See above.

-- 
Cheers, Carlos.