6 ms·

While we’re complaining about Google’s 2FA offering… The issue described here started happening to me recently: https://www.googlenestcommunity.com/t5/Apps-Acc

While we’re complaining about Google’s 2FA offering… The issue described here started happening to me recently: https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-Google-using-YouTube-instead-of-text-for-2-step-verification-for/m-p/155159 https://www.googlenestcommunity.com/t5/Apps-Account/Why-is-G... Summary- Google has added a “match the numbers in the app” style 2FA to YouTube. Makes sense- their video monopoly means that for many iOS users like myself it’s the only Google app they’ve got. Except… 1) It’s the default, and there’s no apparent way to change it, or even turn it off. This is annoying- I prefer TOTP since it’s more secure. There’s a Google Prompts section in the 2FA settings, but it says that I don’t have any supported devices. This actually makes sense, because 2) It doesn’t f*king work! Ever since they changed it from “press yes” to “match number”, the screen opens in the YouTube app and then loads forever. Which means I’ve got a spurious notification on my phone, a screen to dismiss next time I open the YouTube app (or several, because for some reason they can stack), and two extra clicks every time I log into Google on a new device. Actually, I lied earlier- there is one way to disable it, and it’s to DISABLE ALL 2FA, as you can see people doing in that support thread. I honestly don’t blame them, but clearly less 2FA was not the plan of whoever’s idea this was. Speaking of support forums- I don’t think anyone at Google reads them, but they do read HN :))))

contravariant 3y ago
Out of interest what is the added value of using the Youtube app over visiting youtube on a webbrowser?
- pests 3y ago
  A way better experience. YouTube web is slow and clunky.
  - jdeibele 3y ago
    I paid $1.99 for Vinegar and on my iPad (and Mac) I get ad blocking, videos playing in the background, etc. It can be a little clunky because autoplay of the next video doesn't seem to work and there are times I'd like to use a music playlist. It's probably my fault but a quick glance at settings didn't resolve it. https://apps.apple.com/us/app/vinegar-tube-cleaner/id1591303229 https://apps.apple.com/us/app/vinegar-tube-cleaner/id1591303...
  - zo1 3y ago
    I use the web one exclusively. Other than the video pop out feature missing and once in a while scrolling bugs on shorts, it actually works perfectly fine. I refuse to use the YouTube app because they disabled playing in the background or with the screen locked . They Want your eyeballs on the screen for the ads. It so blatant.
    - pests 3y ago
      If I get sent to the web version I open in app immediately since its such a better experience for me. They allow background play and screen-off play. You just need to subscribe to Premium.
- mc10 3y ago
  On iOS the YouTube website only supports video resolutions up to 720p.
- oittaa 3y ago
  Downloading videos for offline watching. For example during flights without a wifi.
  - cute_boi 3y ago
    why not use youtube-dl?
    - thaumasiotes 3y ago
      If you did that, you wouldn't get the ads that the official app shows.
      - cute_boi 3y ago
        [flagged]
    - npteljes 3y ago
      It breaks integration with the YouTube app, and it's a bit of a maintenance keeping up with the latest version, whether to use youtube-dl or yt-dlp or another fork, etc.
    - oittaa 3y ago
      Why use Netflix or Disney+ when you can go to The Pirate Bay?
- MatmaRex 3y ago
  The YouTube mobile website is intentionally crippled. For example, the video refuses to play in a video popout, even though the same browser feature works for me on other mobile websites and on desktop YouTube. Personally I just avoid browsing it on mobile as a result, but I could see someone being convinced to install the app.
  - bigfudge 3y ago
    On iOS, installing vinegar sorts this. You get video pop outs and no ads to boot. It’s much better that the app and seems to give longer battery life (hardware acceleration?)
lasr_velocirptr 3y ago
One of the potential solutions might be to just treat youtube as a separate service i.e. create a separate account for YouTube with 2fa disabled. It’s not ideal since you need to deal with two accounts but that’s what password managers are for.
hyperdimension 3y ago
Wow, that link is such a great example of Google's "support." "This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours." ...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?
- 0xbadcafebee 3y ago
  > On Google's side, why even bother replying at all if that's all you're going to do? Oh, it's just so they can claim to their advertisers that they do support. Remember: if you're not paying for the product, you are the product! (https://en.wikipedia.org/wiki/Television_Delivers_People https://en.wikipedia.org/wiki/Television_Delivers_People)
  - devnullbrain 3y ago
    >Remember: if you're not paying for the product, you are the product! This cliche isn't true: if you pay, you're a more valuable mark. You're always a product.
- dontblink 3y ago
  Just an FYI here: Google's community support forums aren't well named as their intended purpose is for users to answer other user's questions. For the community to support each other. For actual support you need a paid account to reach out to. You could argue that it's badly named and should just be called Google's community forum instead, which is what it really is.
  - hyperdimension 3y ago
    That's pretty funny and makes sense. I guess I shouldn't have expected anything more from Google. Thanks for the clarification.
  - 3y ago
NavinF 3y ago
Never encountered that. Is this because I got lucky in an A/B test or because I have Advanced Protection turned on and only use FIDO keys?
miohtama 3y ago
If you are not paying for it, you are not the customer, but the product.
- npteljes 3y ago
  We are products either way.
thefourthchime 3y ago
Re: “it’s doesn’t fucking work”. I don’t know if it’s just me, but it seems like for the last couple years the products from the FAANG companies have been rotting on the vine. It seems like all the people that made these have moved on and have a b-team barely making them work.
kotatsuyaki 3y ago
GitHub has a similar problem, where the GitHub mobile app can’t be disabled as an 2FA factor. They implemented an option to make other factors as the “default” without the ability to completely disable mobile, and then falsely closed the discussion [1]. If such insecure factor can’t be disabled, what’s the point in setting up TOTP and / or hardware keys? [1]: https://github.com/orgs/community/discussions/10861 https://github.com/orgs/community/discussions/10861
- bombcar 3y ago
  The point is to offload security faults onto the customers so tickets can be ignored.
1letterunixname 3y ago
Google's TOTP is not as good as it could be being HMAC-SHA1 of a symmetric secret and Unix epoch. WebAuthn with a hardware device is less prone to losing and compromising secrets. I use all 2FAs allowed. Tangent on passwords. What the world needs is a path to automated, interoperable secret management in 3-4 RFCs: User-operable, standardized password change REST API that: 0. Sends a session token/nonce 1. Describe the password policy declaratively and precisely, to be validated client-side with boilerplate client code 2. Offer a list of supported PBKDFs and their required and allowed parameter values 3. Includes both client- and server-side PBKDF hashing with minimum values for a given risk type AND adjusted with the "inflationary" Moore's Law costs of tech resources (CPU, GPU, RAM, ASIC, FPGA, QC) over time ---> This would then permit a password manager app to automatically change every password perhaps every day. I'm thinking the future should be like this but use user certificates as a primary AA mechanism and passwords as a break-glass-backup.
- account42 3y ago
  A hardware device = SOL if it breaks. Few things warrant that much risk for a bit more security.

contravariant 3y ago

Out of interest what is the added value of using the Youtube app over visiting youtube on a webbrowser?

pests 3y ago
A way better experience. YouTube web is slow and clunky.
- jdeibele 3y ago
  I paid $1.99 for Vinegar and on my iPad (and Mac) I get ad blocking, videos playing in the background, etc. It can be a little clunky because autoplay of the next video doesn't seem to work and there are times I'd like to use a music playlist. It's probably my fault but a quick glance at settings didn't resolve it. https://apps.apple.com/us/app/vinegar-tube-cleaner/id1591303229 https://apps.apple.com/us/app/vinegar-tube-cleaner/id1591303...
- zo1 3y ago
  I use the web one exclusively. Other than the video pop out feature missing and once in a while scrolling bugs on shorts, it actually works perfectly fine. I refuse to use the YouTube app because they disabled playing in the background or with the screen locked . They Want your eyeballs on the screen for the ads. It so blatant.
  - pests 3y ago
    If I get sent to the web version I open in app immediately since its such a better experience for me. They allow background play and screen-off play. You just need to subscribe to Premium.
mc10 3y ago
On iOS the YouTube website only supports video resolutions up to 720p.
oittaa 3y ago
Downloading videos for offline watching. For example during flights without a wifi.
- cute_boi 3y ago
  why not use youtube-dl?
  - thaumasiotes 3y ago
    If you did that, you wouldn't get the ads that the official app shows.
    - cute_boi 3y ago
      [flagged]
  - npteljes 3y ago
    It breaks integration with the YouTube app, and it's a bit of a maintenance keeping up with the latest version, whether to use youtube-dl or yt-dlp or another fork, etc.
  - oittaa 3y ago
    Why use Netflix or Disney+ when you can go to The Pirate Bay?
MatmaRex 3y ago
The YouTube mobile website is intentionally crippled. For example, the video refuses to play in a video popout, even though the same browser feature works for me on other mobile websites and on desktop YouTube. Personally I just avoid browsing it on mobile as a result, but I could see someone being convinced to install the app.
- bigfudge 3y ago
  On iOS, installing vinegar sorts this. You get video pop outs and no ads to boot. It’s much better that the app and seems to give longer battery life (hardware acceleration?)

lasr_velocirptr 3y ago

One of the potential solutions might be to just treat youtube as a separate service i.e. create a separate account for YouTube with 2fa disabled. It’s not ideal since you need to deal with two accounts but that’s what password managers are for.

hyperdimension 3y ago

Wow, that link is such a great example of Google's "support." "This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours." ...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?

0xbadcafebee 3y ago
> On Google's side, why even bother replying at all if that's all you're going to do? Oh, it's just so they can claim to their advertisers that they do support. Remember: if you're not paying for the product, you are the product! (https://en.wikipedia.org/wiki/Television_Delivers_People https://en.wikipedia.org/wiki/Television_Delivers_People)
- devnullbrain 3y ago
  >Remember: if you're not paying for the product, you are the product! This cliche isn't true: if you pay, you're a more valuable mark. You're always a product.
dontblink 3y ago
Just an FYI here: Google's community support forums aren't well named as their intended purpose is for users to answer other user's questions. For the community to support each other. For actual support you need a paid account to reach out to. You could argue that it's badly named and should just be called Google's community forum instead, which is what it really is.
- hyperdimension 3y ago
  That's pretty funny and makes sense. I guess I shouldn't have expected anything more from Google. Thanks for the clarification.
- 3y ago

NavinF 3y ago

Never encountered that. Is this because I got lucky in an A/B test or because I have Advanced Protection turned on and only use FIDO keys?

miohtama 3y ago

If you are not paying for it, you are not the customer, but the product.

npteljes 3y ago
We are products either way.

thefourthchime 3y ago

Re: “it’s doesn’t fucking work”. I don’t know if it’s just me, but it seems like for the last couple years the products from the FAANG companies have been rotting on the vine. It seems like all the people that made these have moved on and have a b-team barely making them work.

kotatsuyaki 3y ago

GitHub has a similar problem, where the GitHub mobile app can’t be disabled as an 2FA factor. They implemented an option to make other factors as the “default” without the ability to completely disable mobile, and then falsely closed the discussion [1]. If such insecure factor can’t be disabled, what’s the point in setting up TOTP and / or hardware keys? [1]: https://github.com/orgs/community/discussions/10861 https://github.com/orgs/community/discussions/10861

bombcar 3y ago
The point is to offload security faults onto the customers so tickets can be ignored.

1letterunixname 3y ago

Google's TOTP is not as good as it could be being HMAC-SHA1 of a symmetric secret and Unix epoch. WebAuthn with a hardware device is less prone to losing and compromising secrets. I use all 2FAs allowed. Tangent on passwords. What the world needs is a path to automated, interoperable secret management in 3-4 RFCs: User-operable, standardized password change REST API that: 0. Sends a session token/nonce 1. Describe the password policy declaratively and precisely, to be validated client-side with boilerplate client code 2. Offer a list of supported PBKDFs and their required and allowed parameter values 3. Includes both client- and server-side PBKDF hashing with minimum values for a given risk type AND adjusted with the "inflationary" Moore's Law costs of tech resources (CPU, GPU, RAM, ASIC, FPGA, QC) over time ---> This would then permit a password manager app to automatically change every password perhaps every day. I'm thinking the future should be like this but use user certificates as a primary AA mechanism and passwords as a break-glass-backup.

account42 3y ago
A hardware device = SOL if it breaks. Few things warrant that much risk for a bit more security.