Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phone numbers are not proper verification

b1nary.ch

Post reply on HN
Print view View original

61–70 of 159 posts

Re: Phone numbers are not proper verification

#61

Post by herbst »

calanya wrote: post #56

The author's concerns are well justified, however they suggest to provide an alternative.

Thank you. I dont really get the however. Do you mean i missed to provide a solution? Thats true, other than my github example i did not provide any solutions.

My current mission is to plant this thought into peoples heads, especially those who implement such systems (why i posted on HN). All i really want right now is a workflow to help people having similar issues, if a company is aware when they build such a system they will also be able to find individual solutions that fit into their market.

Like my bank can offer paper tan, Github can offer private key authentification, and Twitter should not ask for a telephone number at all because they allow multiple accounts per number anyway. Also 2FA should be possible with Email and not only SMS.

Re: Phone numbers are not proper verification

#62

Post by herbst »

tomhoward wrote: post #55
herbst wrote: post #52

Earlier quoted context omitted.

I shouldnt have mentioned banking, it seems that this is what most people agree with that numbers make sense. And hence i agree to that as well. One of my banks offers the following 2 alternatives: * Paper TAN (which most likely will go away in the next years) * Card reader that scans your EC card Both completely valid for my situation, my other bank does none of both. Both however are completely valid just not as co…

Yeah, I get what you're saying. But for every new system/feature/mechanism a service provider builds to accommodate every increasingly narrow edge-case, there's a huge additional cost and commitment in development, maintenance and support. So the reality is it just comes down to dollars. If you're in the mainstream, you'll be looked after. If you're in the fringes, well, you're in the situation you're in now. That's…

I agree for the most part, but i also hope that my rant helps to put this thought into peoples heads. With several smaller providers i had to talk to when i lost my number it became clear they simply did not spend a single thought on this edge case yet. Some of them now have a workflow to solve this cases, which is really all i am asking for.

Re: Phone numbers are not proper verification

#63

Post by HappyTypist »

keypress wrote: post #25

I've got an odd issue with a Google mail account. That has no email or phone number associated with it. On my main laptop, I can access the account with username and password, on another computer, I'm locked out - because of security checks. The credentials don't matter. Which really bothers me. I'm effectively locked out the account. I don't really care for a telephone either.

Can't you just add an email?

Re: Phone numbers are not proper verification

#64

Post by HappyTypist »

whyoh wrote: post #60
keypress wrote: post #25

I've got an odd issue with a Google mail account. That has no email or phone number associated with it. On my main laptop, I can access the account with username and password, on another computer, I'm locked out - because of security checks. The credentials don't matter. Which really bothers me. I'm effectively locked out the account. I don't really care for a telephone either.

Yeah, that can happen, it's one of the reasons why I don't recommend Google accounts anymore. Hardware/software factors ("new devices"...) trigger their automatic security checks and can easily lock you out of your account, even if you did nothing wrong. Big providers are more and more tailoring to the lowest common denominator (people who can't manage passwords, get malware...) and pushing for mobile authentication.…

Are you using long, automatically generated passwords? I've had two very similar Google accounts that I log in at the same time on PCs, and one account with a 15 char password kept wanting additional checks. It stopped when I changed the password to 16 chars.

Re: Phone numbers are not proper verification

#65

Post by tehabe »

A friend of mine switched their mobile phone number but forgot to change it in their Microsoft account. Now they can't completely use it because their is a one month waiting period to get the new number accepted without validating the account with the old number. Thankfully you can add also email addresses for that but we forgot that.

Re: Phone numbers are not proper verification

#66

Post by HappyTypist »

photon-torpedo wrote: post #33

Somewhat off-topic, but honest question: In the article the author says that he OWNs his email domains. Is this really possible? In my understanding it's more like you rent the domain name from the registrar, and you need to keep renewing it. My question is (please forgive my ignorance in this matter): what prevents the registrar from some day raising the price for your domain to astronomical values? Maybe some well-…

Because you must be able to transfer out.

Re: Phone numbers are not proper verification

#67

Post by herbst »

akjainaj wrote: post #57
herbst wrote: post #54

Earlier quoted context omitted.

Valid arguments indeed. Many roll well with not allowing common mail providers (there are available lists) and as i own my own domains i welcome that. If they require telephone number i would at least expect them to support a wide range of providers and not only some. Like i really cant get over the fact that Twitter locks out the most popular Thai provider. They however could also send me a letter, or have me auth w…

You live in Switzerland. If you can create a phone number with a Thai carrier from there, I am sure you understand why Twitter refuses to deal with such a carrier.

I dont. I live in Thailand right now, tomorrow maybe in Vietnam. Right now i might be a edge case but remote work is growing fast.

You can create throwaway SMS numbers for a few cents with several online providers, some even accept Bitcoin payments and dont ask for a name and Twitter accepts them happily. Its just the third party provider they use that did not implement that specific carrier yet.

Edit:// Also i am curious now why you think i had a thai phone number while living in switzerland? :D There are countries like austria that dont even ask for a passport for prepaid directly next to it, why would i go thai?

Re: Phone numbers are not proper verification

#68

Post by herbst »

tehabe wrote: post #65

A friend of mine switched their mobile phone number but forgot to change it in their Microsoft account. Now they can't completely use it because their is a one month waiting period to get the new number accepted without validating the account with the old number. Thankfully you can add also email addresses for that but we forgot that.

A lot of services use Authy, where you also "easily" can change your phone number. But it also takes 2 weeks, for someone that moves country monthly is just a suboptimal solution.

Sure it makes sense to slow this process down for protection purposes. But my "edge case" will only get more common when remote work will get more common.

Re: Phone numbers are not proper verification

#69

Post by herbst »

hocuspocus wrote: post #51
craigds wrote: post #11

Earlier quoted context omitted.

I've had the same mobile number for the last fifteen years too. In NZ at least (not sure about other countries) it's trivial to take your number with you when you get a new SIM from any mobile provider. Though this wouldn't work across countries obviously.

As a developer in Europe, moving across countries isn't a particularly crazy pattern I believe :) Also in some countries keeping your number isn't cheap. And even when it's technically easy, your phone plan might be provided by your employer, in this case it might be very tricky to get your number migrated when you change jobs.

And i highly assume we are a growing amount of people (remote working and actually moving). We may be a rare edge case now, but may aint in a few years anymore.

And yes keeping my phone number as it was would cost me $80/month. With a provider i hated like the pest.

Re: Phone numbers are not proper verification

#70

Post by herbst »

hocuspocus wrote: post #51
craigds wrote: post #11

Earlier quoted context omitted.

I've had the same mobile number for the last fifteen years too. In NZ at least (not sure about other countries) it's trivial to take your number with you when you get a new SIM from any mobile provider. Though this wouldn't work across countries obviously.

As a developer in Europe, moving across countries isn't a particularly crazy pattern I believe :) Also in some countries keeping your number isn't cheap. And even when it's technically easy, your phone plan might be provided by your employer, in this case it might be very tricky to get your number migrated when you change jobs.

And i highly assume we are a growing amount of people (remote working and actually moving). We may be a rare edge case now, but may aint in a few years anymore.

And yes keeping my phone number as it was would cost me $80/month. With a provider i hated like the pest.

Post reply on HN