Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are phone numbers considered a secure personal identifier?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 46 posts

Ask HN: Why are phone numbers considered a secure personal identifier?

#1

Post by diveanon »

I travel quite a bit and change phone numbers often. Most of the time when I am traveling I am in locations that have poor or nonexistent cellular service.

This often causes problems with services (Paypal, banking apps, messangers, etc.) due to my inability use two factor auth and text-message based confirmation messages.

It seems to me that phone numbers are a horrible identifier due to the way they can be transferred between users of a carrier. Services like Ting have made short term numbers easy to use, and I often get two-factor auth messages from previous users of a number.

Is this purely a business case for data mining, or is there a legitimate security reason for relying on something as ephemeral as a phone number for critical identification mechanisms?

I have debated using Twilio to create my own number pool of international numbers and a way to check my messages via a web portal instead of relying on messaging. Are there any current apps / services that already do this effectively?

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#2

Post by irjustin »

You raise 2 points.

First is traveling quite a bit with poor cell signal. This one is unfortunate especially with banks that have no alternative 2fa other than a phone based OTP.

Why phone? I would believe it's the one thing that near ubiquitous that has a very low barrier to entry. I never had to train my mother how to use OTP when it's an SMS. If she was required to use google authenticator, I'd probably get a phone call every time she had to login.

As for "phone numbers are a horrible identifier" I would say it is "secure enough" for many scenarios.

Typically 2fa systems require a bad actor to have both a password and a physical device.

To be pedantic, the OTP is not considered an identifier, but a password that requires a physical device.

The barrier of a bad actor having both my PW and my device (as a PW) is supposed to raise it high enough that it's unrealistic. Obviously this doesn't work 100% of the time, because phishing and social engineering.

So, sure my device can change hands, but it is unlikely to have changed hands AND that same person has my password AND they are a bad actor.

I live overseas (US expat). To get around many OTPs from US based services I use: https://anveo.com/. Google Voice cannot do shortcode SMS for places like Bank of America. The website looks like it was built in 1995, but it's effective.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#3

Post by swombat »

Counterpoint: I’ve had the same number for 20 years. In all that time, I’ve had maybe 5 instances where I needed to get a confirmation number and couldn’t get enough reception.

It works well enough, the vast majority of the time, for the vast majority of people. You’re an extreme edge case.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#5

Post by ricardobeat »

swombat wrote: post #3

Counterpoint: I’ve had the same number for 20 years. In all that time, I’ve had maybe 5 instances where I needed to get a confirmation number and couldn’t get enough reception. It works well enough, the vast majority of the time, for the vast majority of people. You’re an extreme edge case.

Over 1.4 billion people travelled internationally in 2018. You’re making an assumption based on a single data point, just as you imply the author to be.

Do you use PayPal? It’s impossible to even login while you are abroad.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#6

Post by thepangolino »

swombat wrote: post #3

Counterpoint: I’ve had the same number for 20 years. In all that time, I’ve had maybe 5 instances where I needed to get a confirmation number and couldn’t get enough reception. It works well enough, the vast majority of the time, for the vast majority of people. You’re an extreme edge case.

Counter counter points:

1. I’ve also had a single phone number for over 20 years and quite frankly stopped counting the number of times I’ve been locked out of my accounts due to bad reception.

2. SMS is an insecure communication channel.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#7

Post by rubito »

irjustin wrote: post #2

You raise 2 points. First is traveling quite a bit with poor cell signal. This one is unfortunate especially with banks that have no alternative 2fa other than a phone based OTP. Why phone? I would believe it's the one thing that near ubiquitous that has a very low barrier to entry. I never had to train my mother how to use OTP when it's an SMS. If she was required to use google authenticator, I'd probably get a phon…

You are an immigrant, not an expat.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#8

Post by jedberg »

Because most software engineers don't get proper security training, and make mistakes like this all the time. And even when they have the proper training, they often get outvoted by product managers who either don't have the training or don't care.

It's insanely easy to "steal" a cell number for a few minutes by advertising that number to a small carrier. Phone numbers are not at all secure.

But since most people aren't targeted and there is no easy replacement, phone based 2fa lives on.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#9

Post by jedberg »

rubito wrote: post #7
irjustin wrote: post #2

You raise 2 points. First is traveling quite a bit with poor cell signal. This one is unfortunate especially with banks that have no alternative 2fa other than a phone based OTP. Why phone? I would believe it's the one thing that near ubiquitous that has a very low barrier to entry. I never had to train my mother how to use OTP when it's an SMS. If she was required to use google authenticator, I'd probably get a phon…

You are an immigrant, not an expat.

I suspect you're trying to fight the "white people are expats brown people are immigrants" stereotype, which is noble. But there is a good argument to be made that Americans are unique in the sense that we are still taxed by America when we leave, so we need a word that describes Americans living abroad.

Re: Ask HN: Why are phone numbers considered a secure personal identifier?

#10

Post by dis-sys »

No - it is not a secure personal identifier (in many countries).

According to Australian laws, someone can port your mobile number to his/her sim card by filing an online form, as long as they know your date of birth and account number, that person can take your phone number away in minutes. Nothing need to be done in person, no ID will be asked. In fact, the laws are made to explicitly forbid such checks under the name of giving consumers easy way to transfer to a different provider. You will get a SMS on your phone notifying you that someone has ported your number away and the next thing that is going to happen is that the offender is going to recover your paypal/gmail/online banking password using your phone number - time to say goodbye to your money in your account.

The story here is simple - phone numbers are misued by many as some kind of personal identifier, it is a feature with close to zero security protection in many countries. Mobile providers don't have any motivation to further secure it as they never claimed it to be secure and they didn't make $ out of it.

Post reply on HN