Eclipse Community

So many times I've wanted to log into Google, and instead of something like verify your recovery email, or get a code emailed, or a form of 2FA I can tolerate, they ask "Get a verification code sent to your phone".



Now you might think, oh it's the phone number connected to this account? Fuck no, you can put in any random phone number and they will just send you a code.



I put in a new phone number that Google has not seen from me before, they just sent it a code, and it worked. Literally all this does is verify if user has a phone number. This does no user authentication, it is only a burden to users with phones, and would lock out people without a phone. Literally if my password gets leaked or guessed, this "2FA" would let any "hacker" just waltz in. It makes no sense. Why is this a thing?

Maybe it's some sort of anti-bot check?

Google doesn't trust their own Recaptcha smfh

K4sum1 wrote: ↑23 Jun 2024, 17:53 Google doesn't trust their own Recaptcha smfh

I swear that recaptcha lets bots trough just fine but is a pain in the ass for normal users. I mean fuck it even the stupid AI hcaptcha generated shit is better IMO

K4sum1 wrote: ↑23 Jun 2024, 08:35 Now you might think, oh it's the phone number connected to this account? Fuck no, you can put in any random phone number and they will just send you a code.

Yup i was real surprised when i did that. I mean in general almost all forms of 2fa google offers are kinda trash. Like with recaptcha they are better at keeping users out of their accounts then actuall hackers.

Something else Google is doing in Chromium based browsers (Chrome, Edge, Brave, other ?): the hidden and unremovable extension which grants access to private APIs giving full access to system / tab CPU usage, GPU usage, and memory usage to any *.google.com site:
https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

Food for thought:
https://www.google.com/googlebooks/chrome/index.html

App Manager's (Android) remarks about Chrome:

Chrome versus Bromite = Apples to Oranges
One can not compare "bare bones" Chrome without any ad-blocking to Bromite which includes ad-blocking.

Personally, I do not trust EMBEDDED ad-blocking!
All that does is "shift" the 'trust' from developer of Chrome to the developer of Bromite.
It's a blind trust, why would I trust Bromite over Chrome?
Bromite has X users. Chrome has Y users. X < Y. Y is a needle in a hastack at Google. X is a small stack of papers read through in an afternoon.

Blindly trusting Bromite just kind of reminds me of news like this - https://techcrunch.com/2022/05/24/ddg-microsoft-tracking-blocking-limit/

Preach! I had two accounts that I was locked out of tied to two different phone numbers I no longer have (I've been in this game for a long time, hehe), and Google is willing to do NOTHING to help their userbase with this issue. I tried Google Community Forums upon their recommendation which just consists of non-employee users just telling you to eat it and die basically. Gee, thanks a lot.

They are *sort of* contactable via Twitter/X only, and even then it's extremely excruciatingly difficult to get the attention of a human being.

Since then, I've gotten one of my accounts back, no thanks to them. I just attempted it enough times to where I gained access to an email verification loophole and even then I had to wait 30 days to get a password reset link. I waited and I held that one down.

Unfortunately, the other account does not have the email route (that barely works anyway) so I'm still working on getting that one back.

If you find any headway with this in the future, please let me know, K4sum1. This is oppressively ridiculous.

And don't even get me started on Facebook/Meta. Ugh!

All my gmail accounts just forward to my main now so I don't really use them for much. I just have my one "main" account which is just used for YT and MicroG, and like 5 other accounts that I never use. If i need to log in, sometimes they do email or phone idk. Just annoying in my case.

Google is evil!

Duke wrote: ↑14 Jul 2024, 16:30 Something else Google is doing in Chromium based browsers (Chrome, Edge, Brave, other ?): the hidden and unremovable extension which grants access to private APIs giving full access to system / tab CPU usage, GPU usage, and memory usage to any *.google.com site:
https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

Chromium, hence Chrome, will spy on your PC hardware:
https://www.windowslatest.com/2025/07/04/google-chrome-will-check-windows-11-eligibility-on-your-pc-for-windows-10-eol/

Duke wrote: ↑06 Jul 2025, 20:51 Chromium, hence Chrome, will spy on your PC hardware:
https://www.windowslatest.com/2025/07/04/google-chrome-will-check-windows-11-eligibility-on-your-pc-for-windows-10-eol/

No offense, but this (to me) demonstrates PERSONAL BIAS.

By all means, do a TINY bit of research on the matter and you WILL find that MOZILLA/FIREFOX DOES THIS ALSO !!!
Perhaps even MORESO.
No, not for "Win11 eligibility", but hardware data IS COLLECTED !!!

I have personally tried (IN VAIN) to block the HUNDREDS of telemetry connections that Mozilla/Firefox makes.
Especially that FIRST LAUNCH on any new profile.

I do like IceCat, but I have a hunch that nobody here has even heard of it.
But even if they did, they're not using it as no topics are discussed here regarding it.
I couldn't get one of my bank/billpay "MFA" to work in IceCat, or it would probably be my default browser.

The-10-Pen wrote: ↑07 Jul 2025, 09:20 By all means, do a TINY bit of research on the matter and you WILL find that MOZILLA/FIREFOX DOES THIS ALSO !!!
I have personally tried (IN VAIN) to block the HUNDREDS of telemetry connections that Mozilla/Firefox makes.

The reason why I'm using LibreWolf and R3dfox

I can not speak for LibreWolf. I didn't really know "how" to test for telemetry when I gave it a try.
I do know how to test nowadays and R3DFOX has a crapload of telemetry !!! An outright crapload !!!
How much is just for a "new profile" and how much can be prevented is unknown on my end.
That's not intended as "disrespect" towards R3dfox - but it is Mozilla and has the Mozilla telemetry -- period.
I just know for a FACT that there is a CRAPLOAD of telemetry exchanging hands at every launch !!!
IceCat is the **ONLY** Mozilla fork I've ever seen (and I've seen "hundreds") that is free of all of that Mozilla BS.

The-10-Pen wrote: ↑07 Jul 2025, 17:53 I can not speak for LibreWolf. I didn't really know "how" to test for telemetry when I gave it a try.

Wireshark

The-10-Pen wrote: ↑07 Jul 2025, 09:20 I do like IceCat, but I have a hunch that nobody here has even heard of it.
But even if they did, they're not using it as no topics are discussed here regarding it.
I couldn't get one of my bank/billpay "MFA" to work in IceCat, or it would probably be my default browser.

I have, you may call it GNU IceCat. GNU project is the forefront of software freedom.

I revisited LibreWolf since it's been several years since I last gave it a try.
And as I suspected, TONS AND TONS OF TELEMETRY HANDSHAKES with each and every launch !!!

GNU IceCat remains the **OONNLLYY** Mozilla Fork I have ever encountered that is absent of all of the Mozilla BS.

The-10-Pen wrote: ↑08 Jul 2025, 21:31 I revisited LibreWolf since it's been several years since I last gave it a try.
And as I suspected, TONS AND TONS OF TELEMETRY HANDSHAKES with each and every launch !!!

Lies. I'm getting none.
The only connections I got after launch are the adblock lists updated by uBlock Origin.

Duke wrote: ↑10 Jul 2025, 17:01 Lies. I'm getting none.
The only connections I got after launch are the adblock lists updated by uBlock Origin.

For one, DO NOT CALL ME A LIAR !!! Please have more respect towards those that "disagree with you".

THIS is what I get when I run LibreWolf.
SEVENTY SEVEN telemetry connections !!!
There are a *FEW* that pertain to uBlock lists, but SEVENTY SEVEN TELEMETRY CONNECTIONS !!!

What have you done to BLOCK them (if you indeed have blocked them, I see no proof on your end, just that you "disagree with me")?

First of all, there is no need to shout using caps every 3 words.

The-10-Pen wrote: ↑10 Jul 2025, 18:02 For one, DO NOT CALL ME A LIAR !!! Please have more respect towards those that "disagree with you".

I don't call you a liar but just what you said is not true.

The-10-Pen wrote: ↑10 Jul 2025, 18:02 There are a *FEW* that pertain to uBlock lists, but SEVENTY SEVEN TELEMETRY CONNECTIONS !!!

I actually count 18 connections to lists, I may have missed some. With the corresponding OCSP connections.
Plus the connections to the Mozilla addons services checking for updates.
The connections to WindowsUpdate and Microsoft are surely not from LibreWolf, obviously.

In fact, you don't prove all of these connections are coming from LibreWolf.
Use TCPView: https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview
or, if you want to stay with NirSoft, CurrPorts: https://www.nirsoft.net/utils/cports.html

Then sort the connections by process name and you'll see which ones are really from LibreWolf.

Same exact test (from Win10 VM) shows zero for IceCat and seventy seven for LibreWolf.
So that really does not make any sense to me.
Windows Updates are disabled on all of my machines, even my VMs.

So why does LibreWolf connect to WindowsUpdate and Microsoft per DNSQuerySniffer when Chrome does not, when IceCat does not?

I can launch DNSQuerySniffer at startup and it remains completely empty.
Launch Chrome, it remains completely empty.
Launch IceCat, it remains completely empty.

Launch LibreWolf and I get seventy seven entries.
So "to me", it is LibreWolf opening some kind of door for everything else to walk through.
Regardless if librewolf.exe made those connections or not, they are not made unless it is running.

I'd love an explanation because that really does not make sense to me.
I can only go by what I see. Zero DNSQuerySniffer entries for Chrome and IceCat. Tons of them for LibreWolf.
LibreWolf is opening some sort of door for everything else to walk through.

The-10-Pen wrote: ↑10 Jul 2025, 20:09 So why does LibreWolf connect to WindowsUpdate and Microsoft per DNSQuerySniffer

It does not. Use the tools I've told you and check the LibreWolf process.

The-10-Pen wrote: ↑10 Jul 2025, 20:09 Launch Chrome, it remains completely empty.

Impossible. Chrome always connect to Google as soon as you launch it.
The *.1e100.net connections. Always!

The-10-Pen wrote: ↑10 Jul 2025, 20:09 So "to me", it is LibreWolf opening some kind of door for everything else to walk through.
LibreWolf is opening some sort of door for everything else to walk through.

Paranoia.
It does not. Use the tools I've told you and check the LibreWolf process.

Only thing I can think of is that my Windows configuration DOES NOT HAVE any "default browser". NONE.
So DNSQuerySniffer remains EMPTY. Even for HOURS if no web browser is ever launched.

This works great for me!
I can let the computer sit for HOURS and DNSQuerySniffer remains EMPTY.

Launch Chrome but not open any web site and DNSQuerySniffer remains EMPTY.
Same goes for IceCat.

All I know is that DNSQuerySniffer goes haywire when I launch LibreWolf.
To my understanding, that means LibreWolf is "opening doors" for anything and everything to walk through.

Duke wrote: ↑10 Jul 2025, 21:06 The *.1e100.net connections. Always!

I'm not seeing this connection.
I could have it blocked by other means.

You don't read what I wrote.
You don't even try the tools. Scared to face the truth ?
I'm just wasting my time, stay in your closed own world.

I am running TCPView at your request. Sorry for not screencapping.
I have not tried CurrPorts because I have no need to stay with NirSoft.

I am not getting *.1e100.net connections. What screencap shall I provide as proof?

I am running PORTABLE CHROME v136. Unsure if that makes a difference.
I only run portable browsers and my Windows registry has no "default" web browser.

I am also running Chrome++ with the below command line switches --

command_line=--no-first-run --no-default-browser-check --test-type --disable-logging --allow-outdated-plugins --enable-features=AllowLegacyMV2Extensions --disable-features=LensOverlay,LensRegionSearch,GlobalMediaControls,CustomizeChromeSidePanel,Translate,ExtensionManifestV2DeprecationWarning,ExtensionManifestV2Disabled,ExtensionManifestV2Unsupported,OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints --ash-no-nudges --disable-background-networking --disable-breakpad --disable-comp-onent-update --disable-domain-reliability --disable-default-apps --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'

The "disable-component-update" was intentionally broken by way of spelling so that I can update Widevine files.

This is what TCPView gives when I launch Chrome.

This is what TCPView gives when I launch LibreWolf.

Why are TCP connections more imporant than DNS connections?
I always thought it was the other way around.