[Android Apps and Games] GalaxyA325G:
I realize you were responding to someone else, so please feel free to ignore this discussion on my part, but I have to disagree with you - but if you're right - I would LOVE it for you to be right.

I really would.

But...

The whole point of 2SV/2FA is to trade privacy for security

If there exists a DIFFERENT equation - then please let me know!

I would love to NOT trade privacy for security.

However, as I understand it, all three 2SV/2FV choices listed in the quote clearly trade privacy for security (where having to spoof a phone number and/or obtain a fake throw-away virtual phone or credit card has an impact on your privacy and certainly on your convenience).

Whether I like that tradeoff or not, it's fundamentally binary logic as I see it.

As far as I know, there are only two choices for Fair Email to authenticate on Google mail servers, despite Google pretending there are more than two choices:

a. 2FV/2SV (where I'll also include account-OAuth)

b. Web-OAuth

Fair Email performs both (as of a few days ago, thanks to the kind-hearted efforts of Marcel and Christian Ketterer on our behalf).

Having made the strong claim that 2SV/2FV degrades privacy, I will also make the looser claim that Web-OAth2 does NOT degrade privacy (as far as I am aware); but I'm willing to hear from anyone who claims otherwise as I am just a regular user so I don't know a lot about it.

You would have to be damn good to purchase things and maintain privacy at the same time. I'm sure it can be done, but a hellovalot of people hiding from the law/fbi/tla/mafia/etc., have been tripped up by that.

Best to never need to purchase anything as a basic tenet of privacy.

They all trade privacy for security.

The whole point of 2SV/2FA is to trade privacy for security

Logic. Sense. Reason.

I think the problem here is people are conflating privacy with security.

They're two different things (at the fundamental level anyway).

a. Fundamentally, 2SV/2FA is a good thing for security, but,

b. 2SV/2FA is fundamentally a bad thing for privacy.

Along the same vein, I don't understand why you think these are the same thing:

a. Trading privacy for security, versus,

b. NOT trading privacy for security.

Seems simple enough to me.

But a LOT of people don't understand that binary decision above.

So it's not just you.

If I have to guess why people don't understand the difference between trading privacy for security (or trading privacy for convenience), I would guess that the reason is that they don't realize there is an ASTOUNDING difference in privacy between these two actions:

a. Setting up a Google Account on your phone, and,

b. NOT setting up a Google Account on your phone.

As an aside, there is also an astounding difference in "convenience", but this argument is mostly about privacy so we'll conveniently leave convenience out of the logical equation.

My claim is there is also a large (maybe not astounding though) difference in privacy between these two actions:

A. 2SV/2FV authorizations (of any type), and,

B. Web-OAUth.

Note that my argument is based on pure logic and sense more so than actual data in that the obvious difference is clear to all, is it not?

1. 2SV/2FV requires a "second something", while,

2. Web-OAuth does not.

Again, I am just a regular user so bear in mind my arguments are based solely on logic and sense - so if you can shoot a hole in any of my arguments, please do as we'll all learn about privacy from that effort - where a key component of Fair Email is PRIVACY.

The problem is that you have only two choices:

a. Use email on your phone, or,

b. Do not use email on your phone.

Once you choose the latter, you have only two choices:

A. Use Google email servers for that email, or,

B. Do not use Google email servers for that email.

Once you choose the latter, now you need to choose an email provider, but that's where the cost/benefit equation kicks you in the face.

Again, you have two choices only:

a. Pay for an email provider, or,

b. Do not pay for an email provider.

Once you choose the latter, whom do you choose for that free email provider?

a. Microsoft?

b. Apple?

c. Yahoo?

d. AOL?

e. Protonmail?

f. Gmx.net?

g. Yandex?

h. Tutanota?

i. Zoto?

Are any of them better than google mail servers?

Are they even "more private"?

Note that last question is serious because just logging into a server is ASTOUNDINGLY DIFFERENT from having a Google Account set up on your phone!

That's dead wrong (in my humble opinion); but I'll listen to any argument you can come up with that backs up your claim.

As I see it (logically speaking), the whole point of 2SV/2FA is to provide Google with a "second something" which "only you" own, and inherently, logically, sensibly speaking, that is an explicit TRADE of your privacy for security.

It's basic logic, as I see it.

The whole point of 2SV/2FA is to trade privacy for security

If you've found a magical way around that, then please let me know because that's the Holy Grail that would negate the need for web-OAUth.

Trading away your privacy for your security is the whole point of 2SV/2FA. There is no way around that sordid fact, is there?

2SV/2FA requires a "second something" that only you own

That "second something" IS your privacy.

How are you going to obtain that security key without buying it?

Are you going to steal it?

Did you get it for free?

Note I do not know anything about these hardware security keys; I'm simply apply basic logic and sense and reason to the problem set.

Basic logic is my guide.

The way I understand it, you can't use 2SV/2FV WITHOUT trading privacy for security.

If you have a way to pay for things WITHOUT impacting your privacy (which, in this particular case, needs to be easier and more private than web-OAUth), then I'm all ears, as I have spent two decades on trying to figure out HOW to do that simple task of buying something without losing privacy in the process (and no, I don't use bitcoin as that is not easier than not buying something).