Google locked me out of my account and demands I add phone number

gvprtskvni

I've been using Google Play on a secondary profile with an account created specifically for that purpose for about a month. But now Google has locked me out because of "suspicious activity" and requires phone number identification for logging back in, even though I have a recovery email address. It is probably because I created and used the account over a VPN, as I don't want to let them know my real IP.

Anyone have any advice how to deal with this?

RedDeath

gvprtskvni On one occasion, Google asked me to take a photo of my ID card (National Identity Document) to verify my age (that I am over 18 and that I am the actual owner of my account) and my email address, and that was without having GrapheneOS installed. This happened to me while using my Xiaomi Redmi 9 Prime mobile phone and living in Spain.

Probably9857

gvprtskvni

This isn't going to help now, but you should be able to avoid this on new accounts by immediately setting up a 2FA method, like TOTP.

secrec

gvprtskvni You can avoid the eventual future phone number verification on g accounts by setting them up with TOTP authentication. While their website implies that you have to use "google authenticator", you can scan the QR code with ANY authenticator that supports TOTP.

JollyRancher

If you are in the US, you can go to Best Buy and buy one of the Mint Mobile trials. They cost like 2 bucks. Put the SIM in a phone, give Google that number to verify, and then ditch it.

Of course, you are SOL if you need access to that number again but it is a cheap, easy, way to get reasonably anonymous disposable numbers for verification (or other purposes).

gvprtskvni

JollyRancher I looked into this a while back and anonymous numbers sadly don't seem to be a thing where I live (I'm not from the US).

gvprtskvni

Probably9857 I'd have to use Google's own authenticator then right? Last time I checked, I don't think they supported 3rd party ones like Aegis.

Probably9857

gvprtskvni

They support Aegis and other 3rd party authenticators. I've been using Aegis with Google for years.

gvprtskvni

Probably9857 You're right. I made a new account and added 2FA so hopefully they're satisfied now, though I have a sneaking suspicion they will keep harassing me until I give them my phone number.

leafnose

gvprtskvni
You could perhaps check this short guide by @DeletedUser370.
I think the most important things are to create the account on the phone and without a VPN, which should not be an issue when on a cellular network (with Wi-Fi off obviously).

Van-de-GraaffeneOS

leafnose

If 10¹⁰⁰ is requiring your phone number either way, VPN or no VPN, it's better to leave the VPN on and set to the location nearest your throwaway number's area code. Double check that the Location permission is disabled for Play Services, too.

Once they have your throwaway number, go to Settings → Apps → Sandboxed Google Play → Phone Number Verification and turn that sucker off.

leafnose

Van-de-GraaffeneOS
I’m not sure to follow… Most VPN services have just one or a few locations available for a given country, you certainly won’t get an IP linked to your area code – also, VPNs are not residential proxies. Anyway, Google knows the IPs used by VPN services, that’s the issue, not the apparent IP location given by your VPN service.
Note that the guide I linked is precisely for not having to use a throwaway number.

Grapi

What is the reason to have a google account at all?

Google is fooling you anyway, earlier or later.

I experienced this more times (not only with google). First you have a "free" e-mail. After a couple of years they block your account until you provide your ID, your phone number, a photo of your ass, etc.

So don't be depended on a google account with the long term. Create one for some temporary actions, use some anonymous SIMs, etc. Be prepared to lose your account at any moment.

Actually you can get an eSIM with a normal phone number for a verification by silent.link for crypto.

gvprtskvni

Grapi I would much rather get the five or so non-open source apps I need from Aurora Store, which I did previously. But people say it's not safe, especially not for banking/ID apps.

Considering all I need the account for is updating these few apps, it's not that big of a problem if the worst case scenario is just that I need to make a new account once in a while. Though I would prefer if they lasted longer than a month.

Anonymous SIMs aren't available in my country. But maybe anonymous eSIMs work, I don't know.

secrec

gvprtskvni But people say it's not safe, especially not for banking/ID apps

Did those "people" give a reason why? Or are they making assumptions and spreading unjustified fear? Aurora store is just a window into gplay. It is used both for installing, AS WELL AS UPDATING. NOBODY can argue that it is unsafe to update an application through Aurora, because the signature MUST MATCH in order for your phone to allow the update. This has nothing at all to do with the aurora store software or the route by which the apk is downloaded through aurora store.

So here is what makes this all so much fun; if you try to update an application through aurora store and the signature doesn't match, you'll see a SYSTEM level warning saying that its the replacement application is compromised. It WILL NOT INSTALL. But this also protects you during application INITIAL install. Why? Because if aurora store was some kind of Trojan horse providing hacked files, then the people who are UPDATING through it would be instantly notified, and believe me, it would be big news if that was happening.

gvprtskvni

secrec Yes, I also wonder why. If the concern is that Aurora is switching apps for fake malicious ones, I don't see why one couldn't just check the signing certificate hash with AppVerifier on another phone where you downloaded them through legit Play Store, and compare it to the Aurora download.

chinook

gvprtskvni GoS opinion on Aurora is here: https://discuss.grapheneos.org/d/24311-which-stores-are-recommended-by-gos-developer/4

Basically, it's less safe.

gvprtskvni

chinook But what if you verify the signatures yourself as I suggested? Wouldn't that address the main concern?

And even if an app requires Google Play Services, it seems to work fine even if you block network access for GPS and Play Store (at least that's the case for my one app that requires it). So wouldn't there some privacy benefit in keeping the Google stuff offline and update the app through Aurora?

chinook

gvprtskvni

But what if you verify the signatures yourself as I suggested?

Aurora signatures? You'd probably have to compare package contents with the original package from Google Play anyway, no?

Just balance the privacy with security. Your phone, your decision :)

gvprtskvni

chinook I might be misunderstanding the point of using a program like AppVerifier (which is far from unlikely. I don't have much technical expertise).

As I understood it, comparing the SHA-256 hash of the signing certificate of an app (as AppVerifier does) downloaded from an untrusted source against the hash of the same app downloaded from a trusted source is supposed to show whether or not it has been tampered with in some way.

So, if I note down the hashes of the apps downloaded from legit Google Play, make a new profile, download the same apps again from Aurora, and check that their hashes match those of the old ones, isn't that proof that the apps are just as safe as those from legit Google Play? Or can the app be tampered with without altering the signing certificate? I literally have no clue. I know nothing about app development and have only the faintest idea what a signing certificate actually is or does.

chinook

gvprtskvni I'm sorry, I mixed up Aurora and F-droid.

You're right, they should have the same signatures. The issues is with the signature verification in Aurora instead.