Phone numbers are not proper verification • Hacker News Board

Re: Phone numbers are not proper verification

#21

Post by keypress » Mon, Jan 16, 2017, 9:11 AM UTC

devoply wrote: post #14

herbst wrote: post #13

Earlier quoted context omitted.

Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that…

Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.

Man in the middle.

Re: Phone numbers are not proper verification

#22

Post by devwastaken » Mon, Jan 16, 2017, 9:13 AM UTC

Desktop authentication programs are no better. Authy has a terrible interface, which didn't tell me I should actually create an account to have my authentications synced. I had to use my email and password, so I thought I did have an account, but I did not. This caused me to lose authentication for various programs that luckily I was able to get back.

>And to make it worse, finding malware on a Android phone is way harder than noticing something is off on a desktop.

Thats if you notice. Plenty of malware is not going to be noticable if its programmed to actually steal something from you.

Phone numbers aren't a perfect way to verify things, but that is why you have both mobile authentication, and/or numbers. Many people still do not use smartphones, and even if they do, you can drop it or have it die in thousands of ways that will make the data unrecoverable. Phone numbers, largely, are not going to change for people.

Re: Phone numbers are not proper verification

#23

Post by Freak_NL » Mon, Jan 16, 2017, 9:13 AM UTC

herbst wrote: post #13

mark242 wrote: post #10

This rant is exactly why phone numbers are a good way to do two-factor. The author lost control of their phone number ("as i quit the account shortly...") and subsequently had an extremely hard time authenticating to their bank, Google, Twitter, etc. Getting a new phone number set up is time consuming, even with a Twilio-like service. This is a good thing. Your IMEI number isn't portable, and until there is a physica…

Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that…

In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x.

I never changed back, so now I receive a new sheet of numbered codes whenever I've used a certain number of them. Nowadays I scan this sheet of codes, run an OCR task, and import the codes in my password manager¹. So when the bank asks for code 519:

    pass -c bank/ing/tan/519

And I have the code on my clipboard.

I wonder how long ING (my bank) will allow this method to exist… The alternative used by Dutch banks is a small token generating device they provide to all customers (I think only ING mentioned above doesn't do this yet). This requires no phone number either, just the (tiny) physical device.

I wonder what happens if I tell my bank that I no longer have a phone number I can be reached at?

1: https://www.passwordstore.org/

Re: Phone numbers are not proper verification

#24

Post by herbst » Mon, Jan 16, 2017, 9:14 AM UTC

atemerev wrote: post #20

craigds wrote: post #11

Earlier quoted context omitted.

I've had the same mobile number for the last fifteen years too. In NZ at least (not sure about other countries) it's trivial to take your number with you when you get a new SIM from any mobile provider. Though this wouldn't work across countries obviously.

And I have changed (lost) around 10. People and their behavioral patterns are drastically different. (ADD sucks). At least 2 of them are now reused and given to other people.

This so much. And you can probably dont even remember which services they are bound to. The service now probably sends "you" a SMS and the people realize they have access to something they should not have to. Just crazy IMO.

I rant about this for a while now, and many people say stuff like "you can just take your phone number with you". Its on par for me with "I have nothing to hide, why would i worry". Its just short sight and projecting personal use on the world.

Re: Phone numbers are not proper verification

#25

Post by keypress » Mon, Jan 16, 2017, 9:14 AM UTC

I've got an odd issue with a Google mail account. That has no email or phone number associated with it. On my main laptop, I can access the account with username and password, on another computer, I'm locked out - because of security checks. The credentials don't matter. Which really bothers me. I'm effectively locked out the account.

I don't really care for a telephone either.

Re: Phone numbers are not proper verification

#26

Post by devoply » Mon, Jan 16, 2017, 9:15 AM UTC

keypress wrote: post #21

devoply wrote: post #14

Earlier quoted context omitted.

Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.

Man in the middle.

The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.

Re: Phone numbers are not proper verification

#27

Post by glandium » Mon, Jan 16, 2017, 9:17 AM UTC

aestetix wrote: post #18

+1 I do not have a mobile phone, and have run into countless issues with so-called security systems which demand a mobile number, everything from airports to online services like Twitter. It's amazing how many services become unavailable when you have no phone number to provide.

I have a mobile phone number, but it's VoIP and can't receive SMS. That excludes me from many types of services that absolutely want to send an SMS.

Extra bonus, I moved out of my country of origin a few years ago. The Visa card I have from a bank in my country of origin needs 2FA to be used to purchase things on the net. The second factor is a code sent by SMS. Even if I had a phone number that can receive a SMS, the bank won't let me change the configured phone number because they can only accept a phone number in my country of origin. IOW, I barely can use that card.

Re: Phone numbers are not proper verification

#28

Post by martin-adams » Mon, Jan 16, 2017, 9:18 AM UTC

In the UK mobile networks are required to offer number portability[1].

I don't know if that means a mobile network can take your number away, but just like managing the registrar on a domain, you can manage the portability of your number.

[1] https://www.ofcom.org.uk/phones-telecoms-and-internet/inform...

Re: Phone numbers are not proper verification

#29

Post by herbst » Mon, Jan 16, 2017, 9:18 AM UTC

Freak_NL wrote: post #23

herbst wrote: post #13

Earlier quoted context omitted.

Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that…

In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x . I never changed back, so n…

Same. I also use paper tan right now and one bank account which i have to call if i want something (which i dont care much about, because its not ment to be accessed anyway) but yeah its just a question of time the bank does not send out TANs anymore.

My bank (or both of them) had no solution when i told them that i dont plan on having a phone number anymore. The one accepted it that they cant call me and send paper TANs, the other did not do paper tans for a few years now.

Btw: Your solution to store them sounds nice. Probably gonna adapt that

Re: Phone numbers are not proper verification

#30

Post by MichaelBurge » Mon, Jan 16, 2017, 9:19 AM UTC

Phone numbers work between phone companies. Are they administered by the government or other central organization? I wonder if you could own phone numbers if you bought them straight from the source.