Re: Google will no longer send SMSs with six digit codes for verification

On 2025-03-03 11:39, VanguardLH wrote:

"Carlos E.R." <robin_listas@es.invalid> wrote:
 

On 2025-03-03 11:05, VanguardLH wrote:

"Carlos E.R." <robin_listas@es.invalid> wrote:
>

Hi,
>
Just read yesterday that Google will no longer send SMSs with six digit
codes for verification of gmail account, but instead will use QR codes.
This is to avoid scams in which the victim is told to tell the fraudster
the number he just received on the phone.
>
I have a source but it is in Spanish:
>
<https://www.20minutos.es/tecnologia/ciberseguridad/novedad-google-luchar-contra-estafas-adios-autenticacion-digitos-sms-5685840/>
>
Oh, English here:
<https://www.forbes.com/sites/daveywinder/2025/02/26/google-confirms-gmail-to-ditch-sms-code-authentication/>

>
Doesn't make sense.  Say I'm using a desktop PC.  Nope, it doesn't have
a cellular or landline phone line to it (it cannot do telephony) which
is typical of desktop PCs.  I want to login to my Gmail account.  How
are they going to send an SMS text to my desktop PC?  Not everyone
logging into Gmail is using a smartphone to do so.

>
Tough luck. The SMS is sent to the phone that is registered with the
account.

 What was the point of Google (and Microsoft) fucking up OAUTH, a
protocol, to screw into the OAUTH2, a framework, for authenticated
logins?

2FA.

 Whether on my Android phone or Windows desktop using OAUTH2 email apps,
or using a web browser with HTTPS, I've never received an SMS text (on
my phone) to complete a login to Gmail.  If they replace SMS texts with
QR codes (delivered how?), well, I wasn't getting SMS texts before, so I
won't be getting QR codes, either.

I have.

 If the QR codes are sent via SMS texts, instead of getting a string of
numbers the users get a QR code.  Um, just what is a QR code?  Scan one
to see it is just embedded text.  Maybe Google is assuming no one has a
QR scanner app on their phone to decode what text it contains.

This is undefined. Probably you get a QR graphic in the computer, and you have to take a photo of it with your phone, inside some application they still have to tell us.

 Once the QR image arrives via SMS text on the phone, what the hell am I
supposed to do with it?  Not like I can point the phone's cameras at the
phone's screen to read the QR image to decode into the text within.  So,
whatever is attempting the login must incorporate a QR scanner that can
look at QR images in SMS texts?

See above.

 

However, my IMAP e-mail client using OAUTH2 to login never sends me
anything to further authenticate the login.
>
To where is Google going to send their QR code when I use a web browser
to connect and log into https://www.gmail.com?

>
To your registered smartphone.

 And I'm somehow supposedly to magically scan a QR code in an SMS text
sent to my phone to get it to my desktop?  Unlike a numeric string, I
cannot transcribe a QR code into whatever is the text within it.

See above.
--
Cheers, Carlos.