Remix.run Logo
joekrill 3 hours ago

> a Google Account that isn't tied to anything else.

Isn't that pretty much impossible? You need a phone number for verification, which effectively ties it to that phone number.

Linux-Fan a few seconds ago | parent | next [-]

> > a Google Account that isn't tied to anything else. > > Isn't that pretty much impossible? You need a phone number for verification, which effectively ties it to that phone number.

I just want to follow-up on this because some people claim this is not correct because they have managed to create accounts without phone numbers.

Indeed, I think to this day, under special circumstances (like e.g. on reasonably recent Android devices) you might be able to setup a Google account without phone number.

The trick is, that in the general case, you can not keep this account online indefinitely.

I once worked out a trick to get it going and I was feeling safe because I had setup 2FA and backup codes (see https://masysma.net/37/google_how_to_create_an_account_witho...).

First thing to note: This way of account creation does not seem to work anymore.

Second thing to note: After once logging in from a different country, trying to login again REQUIRES me to provide a phone number after successfully giving username/password/2FA code. No way to use the recovery code instead...

Also, given that this account was never before connected to a phone of any kind, by definition, the addition of a phone number cannot provide additional security confirmation (it's data that simply wasn't present before and any "personal" phone number could potentially do -- of course I haven't tried, because that's the point of not linking a phone number).

I think this way it is finally proven that they only do this to harvest the data/phone numbers and any claim of enhanced security is void.

I write this after having lost the second account to the phone number required screen despite being in possession of all the credentials which were ever assigned to that account...

megagpt1 3 hours ago | parent | prev | next [-]

You can create an account with no phone number during Android device setup.

You can also just get a burner phone number for a few bucks.

armadyl 3 hours ago | parent | prev [-]

Accounts created on stock Pixels don’t require phone numbers.

iririririr 3 hours ago | parent [-]

that haven't been true since pixel 4. it just picks your phone in the background.

a burner sim, like a literal criminal, is the only way today.

asnelt 3 hours ago | parent | next [-]

Even with a burner sim, there is the International Mobile Equipment Identity (IMEI) number, which is tied to the phone, and is known to all apps with the android.permission.READ_PRIVILEGED_PHONE_STATE permission.

exceptione 3 hours ago | parent [-]

That can't be true? <https://grapheneos.org/faq#hardware-identifiers>

  As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers. Apps targeting Android 10 will receive a SecurityException and older apps will receive an empty value for compatibility. The currently enabled carrier-based messaging app for SMS/MMS/RCS is a special case that's given access to certain device identifiers including the IMEI. This is normally the GrapheneOS fork of AOSP Messaging but can be changed to another app by the user.

  Since these restrictions became standard, GrapheneOS only makes a small change to remove a legacy form of access to the serial number by legacy apps, which was still around for compatibility. It used to need more extensive changes such as disallowing access to the serial number but those restrictions are now standard.

I don't know however if sandboxed google play is such a privileged app.
asnelt 2 hours ago | parent | next [-]

I couldn't immediately find whether GrapheneOS grants READ_PRIVILEGED_PHONE_STATE to Google Play. It might very well be that the GrapheneOS sandbox spoofs a fake IMEI, and I do hope so.

In any case, my parent comment was meant for stock Pixels, as mentioned by armadyl further up in this thread.

nickspacek 2 hours ago | parent [-]

https://grapheneos.org/usage#sandboxed-google-play

> Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access.

It doesn't mention IMEI here, but hopefully READ_PRIVILEGED_PHONE_STATE is included in "privileged access."

exceptione 2 hours ago | parent [-]

There is an AppStore app, I am not sure if this is the one we are talking about? <https://github.com/GrapheneOS/AppStore/blob/main/app/src/mai...>

That one lists:

  ACCESS_NETWORK_STATE
  ENFORCE_UPDATE_OWNERSHIP
  FOREGROUND_SERVICE
  FOREGROUND_SERVICE_SPECIAL_USE
  INSTALL_PACKAGES
  INTERNET
  POST_NOTIFICATIONS
  QUERY_ALL_PACKAGES
  RECEIVE_BOOT_COMPLETED
  REQUEST_DELETE_PACKAGES
  REQUEST_INSTALL_PACKAGES
  UPDATE_PACKAGES_WITHOUT_USER_ACTION
gruez an hour ago | parent [-]

That's grapheneos's own app, separate from the play store or play services.

exceptione an hour ago | parent [-]

True. I think this one is closer to the truth: <https://github.com/GrapheneOS/platform_packages_apps_GmsComp...>

There is no READ_PRIVILEGED_PHONE_STATE mentioned there.

gruez 25 minutes ago | parent [-]

That's also incorrect, because the gmscompat app is just a helper app. Play services can and does request additional permissions. Those permissions are handled by the OS under the play services app, not gmscompat. If you want RCS for instance, you must grant play services and google messages phone and ICC auth access, which isn't seen in gmscompat at all.

mindslight 2 hours ago | parent | prev [-]

That's the application software side. I would assume the IMEI and IMSI are both going out to the cell network though, and I would presume that it's trivial to tie a phone number to those with how the mobile industry generally sells subscriber data to various data brokers. The only question is how permissive those data brokers are (their major constraint is how much most people become aware of this dynamic), but when dealing with a major APT like Google I'd assume they're tuned into the best ones with songs about bona fide purposes.

exceptione an hour ago | parent [-]

Are you talking about the US here? I am hoping this would be off-limits in Europe.

mindslight an hour ago | parent [-]

Yes I am talking with a US perspective. I would hope the GDPR would prevent such things in (most of) Europe. But I also personally wouldn't assume so given that there are still the same dynamics of keeping the info flows private to avoid scrutiny, and claiming plausible "legitimate purposes" and "consent".

alt227 2 hours ago | parent | prev | next [-]

Its possible to set up a phone with a google account without even a sim card in it and use it as a wifi only device, so Im pretty sure what your saying is wrong.

goodmythical 3 hours ago | parent | prev | next [-]

assuming the number you get hasn't previously been assigned to a google account

drxzcl 2 hours ago | parent [-]

I've had no end of trouble registering an account on our corporate SIMs as the phone numbers (not the actual SIM cards) had been recycled as employees leave.

edoceo an hour ago | parent [-]

So many systems cannot handle known pattern of a phone number changing. Who's decided these are imutable values? That I have only one? That it's not shared?

megagpt5 2 hours ago | parent | prev [-]

It still works without a SIM card, how do you explain that?