Google always asks for a phone no. when creating a new acc on a 2nd user & after

CutStandard8309

One way that has always worked for me is creating a google account on an old phone running stock os (doesn't really matter what OEM). These accounts never get asked for phone number verification.

Also I create the account through play services and not a browser.

amolpatravali97

CutStandard8309 My issue isn't with getting a phone verification (this is a symptom), its that I thought each user on grapheneos has a unique id that spoofs google, so google thinks each user is new & it'll skip the phone verification. But on getting the phone verification on the second user this makes you wonder if there's some device id thats getting leaked

TrustExecutor

CutStandard8309
Interesting. Can you do this multiple times? I mean does Google log that the same device identifier already created an account on the same device?

CutStandard8309

Ahh, gotcha.

I don't think the sandbox is leaking, i think rather, that since GOS only meets basic integrity in the Play Integrity API, it trips some extra steps to ensure you aren't a bot signing up for an account.

However, I don't have a very deep understanding of this, but that is just my assumption.

N1b

That's weird indeed and worth investigating... But for practical usage, you do have a reliable solution to create a Google account on profile A, and if you set up 2FA (FIDO or TOTP) afterwards Google shouldn't ask for phone numbers anymore on this account...

As for triggering phone verification on profile B, you mentioned that you changed your IP. Do you use a VPN for that? Because a known VPN IP is most likely a red flag for Google and could cause the issue.

amolpatravali97

N1b The phone verification on profile B is concerning because I want to create 5 more profiles with anonymous google accounts.
About the VPN, I use a 5G mobile proxy and these IPs are clean & aren't shared or banned on any dnsbls.

CutStandard8309

TrustExecutor they peobably do log what device's create what account's but i have always been able to create another account by logging out of the first account and creating another.

This is likely not a fool proof way of getting an "anonymous" google account, but rather an easy way to get a burner google acount without having to give up your phone number and other PII.

Hb1hf

Just to make sure we're on the same page:

user A's account is pre existing, you're just using the GOS device to log into it
User B's account doesn't exist, you're trying to create it on the spot in the GOS device

Is this understanding correct?

amolpatravali97

Hb1hf

Both User A & User B are new
I create a google account from the play store on User A I don't get asked for any verification. I change my IP address & log into User B & create google account from the play store, I get asked for a phone verification

amolpatravali97

CutStandard8309 But this method links your first google account with your second and after. The goal is to be able to create multiple google accounts without verification

pyg

amolpatravali97

This is very concerning. It means Google Play is somehow detecting there are multiple profiles and inferring 1 profile is the first profile and 1 profile is the second profile.

Have you opened up an issue on Github?

A lot of the responses seemed to shrug off what you are saying like it doesn't matter. This may indicate a larger problem however.

CutStandard8309

pyg I din't think anyone here is shrugging it off, rather speculating what might cause the phone number verification.

FWIW, I can't create a google account, on a GOS device without being asked to verify myself with a phone number. It doesn't matter whether or not I am in a owner, guest, or user profile, I am always asked to verify myself by phone number.

Edit: spelling

amolpatravali97

pyg Yes, i've opened a new issue: https://github.com/GrapheneOS/os-issue-tracker/issues/2406

strcat

amolpatravali97 You're making incorrect assumptions leading to your conclusion that this is what's happening. Filing an issue based on these kinds of assumptions doesn't make sense. You're inferring that something must be happening when you haven't at all narrowed it down to that.