[Android Apps and Games] GalaxyA325G:
If anyone can solve this trading of privacy for security that Google erected on May 30th, 2022... I'm all ears.

However... I've tried to find a way to use a free throwaway virtual phone numbers on my daily drive phone for years, but the problems are immense to overcome.

a. They STILL trace back to your phone

b. They often expire unless you babysite them constantly

c. Once they expire, you have to start all over again

Please understand... we're TOGETHER in this.

I'm just a regular user who was happy with the privacy implications of login/passwd; but that's no longer an option after May 30th, 2022.

If you can find a free virtual phone number that doesn't have those basic flaws above, trust me, I'll be indebted to you forever.

I'm just a regular user, much like you, seeking a solution to what Google unilaterally erected as a barrier as of May 30th, 2022.

Unfortunately, last we checked on the Android Usenet newsgroup, just the mere act of logging into a Google Voice account on Android using the Google Voice app CREATES an on-device Google Account (which is anathema).

I don't have much knowledge, but I understand basic logic.

IMHO, it's patently illogical to suggest 2SV/2FV for a variety of reasons, any one of which negates its use in terms of privacy...

a. You can never turn 2SV/2FV off

(if you do, the Google authentication stops working)

b. You don't need it in the first place (web-OAUth2 works just fine)

c. The whole point of 2SV/2FV is to trade privacy for security

Any argument that suggests 2FV/2SV has to overcome those basic logical natural hurdles above.

I wish an "authenticator app" didn't FIRST require 2SV/2FA.

I really do.

However, last we checked on the Usenet newsgroups...

Google at least allows you to turn off 2SV/2FV (Apple does not).

But once you turn it off, whatever it enabled... stops working.

I didn't put these hurdles in place.

Google did.

Any argument in favor of 2SV/2FA has to overcome those logical conditions.

It's illogical to talk about the option being for people "serious about security" if those people are more "serious about privacy" since one is traded for the other.

Having put that basic logic out there, I admit I don't know anything about these physical devices, but the logic I'm espousing has NOTHING to do with "security" but with privacy.

Two different things.

We need to keep PRIVACY separate from SECURITY

Since Google traded our privacy for security on May 30th

All I'm trying to do is RECOVER from that trade by losing the least amount of privacy possible.

For example... if you know how to purchase those physical keys without going to the trouble of never stepping outside your balcony like Osama bin laden did, then I'm all ears, but everyone knows that it's a PITA to go around hiding your identity to purchase throwaway fake credit cards using a bitcoin account and then shipping those fake throwaway credit cards with a fake throwaway shipping addresses...

Suffice to say it's a logical hurdle that the instant money is involved, your privacy is a goner (unless you know an easy way around that - in which case - as always - I'm all ears).

The only way I know of to obtain that physical part with privacy is to steal it off of someone else... but if you know a better easier way - let us know as the hurdles here are pure logic, sense, and reason.

With all due respect, I don't see the logic in that statement.

How is a password trading privacy for security?

You have to explain how giving them a password of, oh, say, 'foobar' is trading away your privacy for security.

NOTE: I'm aware they have your IP address also, but they have that in EVERY other case also.

Logic.

If EVERY alternative-to-web-oauth method we can think of to suggest FIRST requires 2SV/2FA to be set up, then we have to START there with the trading of privacy for security.

As far as anyone knows, there are really only two (or three, depending on how you break it down) ways to authenticate GMail on FairEmail after May 30th, 2022:

1. 2SV/2FA (which enables a half dozen secondary options), or,

2. On-Device OAuth (aka "GMail (Android)" in Fair Email)

3. Web-OAuth (aka "GMail (OAuth)" in Fair Email)

Is that statement above correct or not?

Because if it's correct, then it's not logical to speak about "one time backup codes", for example, without overcoming the 2SV/2FA privacy hurdles first.

While I won't disagree that OTP is confusing to me (as I had never thought of using it until Marcel suggested it earlier in this thread)...

... if the FIRST thing you need to run OTP is 2SV/2SV, then your privacy is ALREADY gone.

Adding OTP AFTER you lost your privacy doesn't gain it back.

My arguments are always eminently logical, sensible, and reasonable... are they not?

If OTP requires 2SV/2FA, and if 2SV/2FA trades privacy for security, then that's where the LOGICAL ARGUMENT has to start. Right?

Bingo.

Despite Google pretending there are more options than really exist, in terms of privacy there are only three options I can see:

1. 2SV/2FA (which enables a half dozen secondary methods)

2. On-device OAuth (which Fair Email calls "GMail (Android)")

3. Web-OAuth (which Fair Email calls "GMail (OAuth)")

The first question we need to answer is whether or not that statement above is correct. I believe it to be correct, but all your arguments require it to be wrong.

This is pure logic.

Fair Email bills itself as a privacy-aware app.

Hence, we have to thank Marcel for understanding all of this privacy stuff better than we do.

We could nip this entire discussion in the bud if Marcel posted which of the three options he thinks is the "most private", but I understand he has much more important things in his life to deal with right now.

a. GMail (2SV/2FA)

b. GMail (Android)

c. GMail (OAuth)

Bear in mind the history that I'm just a regular user (like millions of others) instantly negatively impacted by Google's unilateral attack on privacy May 30th, 2022, because Fair Email & K-9 Mail stopped working as a direct result of Google's Draconian actions.

a. When Marcel quit and returned to the project, I installed that version of Fair Email but it CREATED an on-device Google Account.

b. When I asked Marcel about that, he suggested OTP, but when I tried OTP I found it REQUIRED 2SV/2FA which is an unnecessary trade of privacy for security.

c. It's only when Marcel worked with Christian to add web-OAuth that we gained back the privacy we had with app passwords.

As I keep trying to state, I'm not knowledgeable in this stuff but I am damn good at basic LOGIC... so any argument tried with me better pass a basic test of fundamentally sound LOGIC.

Of the three choices available to Fair Email today for GMail...

1. 2SV/2FA

2. On-Device Account

3. Web-OAuth

Assuming that's correct, the logical question to ask is...

Which of those three does NOT trade privacy for security?

I'm not an expert... so I'm open to anyone who can explain better how Web-OAuth trades privacy for security (if it does) as I would have preferred the venerable login/passwd method in terms of privacy - but it's NOT one of our options.