Re: Google will no longer send SMSs with six digit codes for verification

On 2025-03-06 07:50, VanguardLH wrote:

"Carlos E.R." <robin_listas@es.invalid> wrote:
 

On 2025-03-05 21:43, VanguardLH wrote:

"Carlos E.R." <robin_listas@es.invalid> wrote:
>

On 2025-03-05 02:45, VanguardLH wrote:

Frank Slootweg <this@ddress.is.invalid> wrote:
>

VanguardLH <V@nguard.lh> wrote:
[...]
>

Not relevant to my statement of having to wait for SMS messages (text or
QR image content) nor there is no guaranteed delivery of SMS messages.
>
To where is the SMS message sent?  To the phone.  Okay, I'll see an SMS
message with a QR image.  Then what?  Do SMS apps have embedded scanning
of the content of SMS messages to then use an embedded QR decoder to
show the text embedded in the image (which obviates the whole point of
supposedly securing the text string in an image) that I then have to
copy/paste into some web prompt?

>
     AFAICT, "an SMS message with a QR image" is a figment of your
imagination!
>
     I think such a thing is not mentioned anywhere and not even implied
anywhere.

>
The delivery mechanism is defined where?
>

     The referenced articles mention that *use* of a code in an SMS message
will be replaced by *use* of a QR code, but that does not mean that the
QR code is *in* an SMS message. (I think that would be obvious, because
an SMS message is too small to hold a QR code, not to mention that it
can only hold character data, not binary data.)

>
I figured it could be MMS (Multimedia Messaging) instead of SMS (Short
Message Service).  MMS can be used to send pictures.  I have automatic
downloads of MMS disabled in my messaging apps.
>
However, upon some further reading, Google Prompts looks to use
notifications instead of SMS/MMS messages.  Maybe.
>

     So perhaps it's best to come up with an actual quote from the
referenced articles, which leads you to your assumption, instead of
going on and on about something which is very likely a straw man / red
herring.

>
That's the crux of the problem: there are no details on how QR images by
whatever delivery mechanism are to get decoded into strings by the user
to input into a waiting field.  All of us are just guessing for now what
are the possibilities.

>
You are imagining it wrong. You try to login on your computer; the
computer displays a picture, the phone takes a photo. There are no SMS
involved, no conversions, no fields to complete. Just point and shoot,
done. Instantly.
>
Same as currently done to login to wasap on the computer. The same
system. Known and tested.

>
No, not when logging into my computer.  Google isn't involved in me
logging into my computer.

>
I did not say "logging into my computer". I said "login on your
computer", obviously to Google, which is the context.
>
You are login into google in your computer; the browser you are using,
or the mail application you are using displays a QR code, and tells you
«take a picture with "name of app" in your registered phone, number
ending in XXX». You comply, and in seconds you are authorized to
complete login to google in the computer.

 "name of app" is?

To be determined at some future date.

Would have to be one that connects back to my Google
account.  Play Services, Google app (aka Google Assistant), or what?
That would provide the mechanism used to complete the Google Prompt.
 What if I'm using a web browser on the phone?  The web browser on the
phone can show a QR image the web site presents, but then what?  It's
not like I can point the camera in the phone at the web page in the web
browser on the phone.  Does "name of app" scan the screen?

That's not the case reported in the news. Does not apply.
Still, the app can take a screenshot.

 

In the same context, the method now is that google says "you will have
received an SMS in your registered phone that ends in XXX, please copy
here the six digit number you received".

 That's now with a text string send via SMS.  Google says they won't be
using SMS (or MMS) to send QR codes.  So, some app on the phone checks
for and displays a Google Prompt.  Apparently that would be Play
Services or the Google app.
 The part about getting an SMS notification with a string that the user
manually transfers to a waiting input field is not what I'm asking
about.  That uses SMS to send a string to the user sent by the web site
interrupting a login that a messaging app will display in its window, or
in its notification.  SMS will not be involved when Google switches to
sending QR codes.  Looks like Google Prompts will handle delivering the
QR image to the phone.  It was, and still is for now, sending SMS texts
to the phone.  Not when Google switches to QR codes.
 Google won't be using SMS to send QR codes.

They did not said they would.

 The intend to drop SMS.
 From what I've read, so far, it looks like they will use Google Prompts
which involve either Play Services or the Google app, or maybe both in
tandem (on Android, just the Google app on iOS) that connect to your
Google account.
 At this point, it's anyone's guess how the QR image gets from the Google
Prompt into the waiting login page.  Perhaps Google will update their
Google App to show the image along with its decoded string the user can
read and manually copy, or the Google App could convert the QR image in
the Google Prompt into a string in the clipboard to let the user paste
into the login form, or the Google App phones home with the QR image
showing in a web page (there is a camera button in the Google App).
 Somehow all of this seems to be just for logging into Google service and
web sites, not for use by anyone else.  Gmail is not my primary e-mail
service, and I won't miss not using it as a backup e-mail provider.
Many other Google services have their own Android app, so they don't
need QR codes.  Google services I used on my desktop run in the
background, like Google Drive, and they don't ask for logins (after the
initial setup).  Displaying a QR code at a Google web site viewed in a
web browser on the desktop to complete the loop by using a phone's
camera that pipes the decoded string back to Google would complete that
loop.  Not sure how a QR code displayed at a Google web site in a web
browser on the phone is going to get scanned to send the string back to
your Google account.

--
Cheers, Carlos.