Phone numbers are not proper verification • Hacker News Board

Re: Phone numbers are not proper verification

#141

Post by herbst » Mon, Jan 16, 2017, 3:50 PM UTC

baq wrote: post #138

herbst wrote: post #131

Earlier quoted context omitted.

My phone contract clearly stated that the contract can be cancelled anytime by the provider without prior notice. Taking away a domain is a costly, long and usually failing process. Sure i need to pay for both I agree that i worded that badly tho

> Taking away a domain is a costly, long and usually failing process. source please, including your registrar's TOS

https://www.nic.ch/terms/agb/

Or even which someone linked below (to refute my claims)

https://www.namecheap.com/legal/domains/registration-agreeme...

They also have the "remove anytime thing" but they warn you and give you 30 days to move your domains. So if they decide to close my account, they dont take my domains.

Re: Phone numbers are not proper verification

#142

Post by tomhoward » Mon, Jan 16, 2017, 3:59 PM UTC

herbst wrote: post #141

baq wrote: post #138

Earlier quoted context omitted.

> Taking away a domain is a costly, long and usually failing process. source please, including your registrar's TOS

https://www.nic.ch/terms/agb/ Or even which someone linked below (to refute my claims) https://www.namecheap.com/legal/domains/registration-agreeme... They also have the "remove anytime thing" but they warn you and give you 30 days to move your domains. So if they decide to close my account, they dont take my domains.

There may be a difference in contractual terms, but without much of a difference in substance.

The whole telephony system relies on people keeping the same phone number.

Individuals and families rely on it as a most basic necessity. Businesses invest vast sums of money promoting awareness of their phone number.

If telco providers went around taking people's phone numbers away without very good reason, there'd be uproar, and the telco system (and indeed, to some degree, the economy), would cease to work.

Re: Phone numbers are not proper verification

#143

Post by solatic » Mon, Jan 16, 2017, 4:11 PM UTC

Verifying identity is the government's job. Since time immemorial, governments have been issuing identity documents for their citizens.

So when did it become the job of the telecom industry? So why would anyone think that a telephone number can robustly represent identity?

Of course there are privacy and ethics concerns with government-issued digital identities. And they can be addressed, after we first agree with whom primary responsibility for identity assurance ought to lie, because then we can remember that all the alternatives are worse.

Re: Phone numbers are not proper verification

#144

Post by herbst » Mon, Jan 16, 2017, 4:12 PM UTC

tomhoward wrote: post #142

herbst wrote: post #141

Earlier quoted context omitted.

https://www.nic.ch/terms/agb/ Or even which someone linked below (to refute my claims) https://www.namecheap.com/legal/domains/registration-agreeme... They also have the "remove anytime thing" but they warn you and give you 30 days to move your domains. So if they decide to close my account, they dont take my domains.

There may be a difference in contractual terms, but without much of a difference in substance. The whole telephony system relies on people keeping the same phone number. Individuals and families rely on it as a most basic necessity. Businesses invest vast sums of money promoting awareness of their phone number. If telco providers went around taking people's phone numbers away without very good reason, there'd be upro…

I think i said this multiple times in this thread (and probably even in the article, not sure) but i am fully aware how unlikely this is. I just used it as additional argument that now many used to pick on.

I never heard of anyone got his number taken when they paid the fee. I highly assume most companies never done that actually.

Edit:// Its not actually the point tho, it is just a (obviously not that well) argument for my point

Re: Phone numbers are not proper verification

#145

Post by herbst » Mon, Jan 16, 2017, 4:13 PM UTC

solatic wrote: post #143

Verifying identity is the government's job. Since time immemorial, governments have been issuing identity documents for their citizens. So when did it become the job of the telecom industry? So why would anyone think that a telephone number can robustly represent identity? Of course there are privacy and ethics concerns with government-issued digital identities. And they can be addressed, after we first agree with wh…

Personally i rather give my name and my passport ID than my telephone number. At least with that data they cant annoy me or resell it to ad companies to annoy me.

Also i cant lose the knowing the number. I can easily replicate it on my own site (saving it in multiple places)

Re: Phone numbers are not proper verification

#146

Post by herbst » Mon, Jan 16, 2017, 4:15 PM UTC

kintamanimatt wrote: post #101

The solution to protect against loss is to have a backup. Keep a backup SIM from your home country (or for every country in which you have an important account), so in case of loss you can switch over to your backup and you can avoid this fuckery. In my experience it's not hard to keep a prepaid SIM active, even if it's not in active use. This advice also applies to your wallet too: have a second bank account (at lea…

Heh, i actually tried. They would invalidate my other sim if i get a second one. There is no such thing as "backup sim" with the provider i was with.

Re: Phone numbers are not proper verification

#147

Post by jsudhams » Mon, Jan 16, 2017, 4:19 PM UTC

manigandham wrote: post #126

lostboys67 wrote: post #90

Earlier quoted context omitted.

But the OP does have a point that you don't own the phone number your countries PTT or Regulator does. And for google if you have multiple people using the same google accounts which you would do for many google services 2FA can really mess you up eg if I WFH I cant login to some of our GA GTM and GSC accounts.

> multiple people using the same google accounts Why would you do this? Whether personal or work related, Google has always said to keep accounts tied to an individual.

I keep multiple gmail for each purpose.

Re: Phone numbers are not proper verification

#148

Post by herbst » Mon, Jan 16, 2017, 4:23 PM UTC

SomeStupidPoint wrote: post #110

tyingq wrote: post #106

Earlier quoted context omitted.

Not sure I understand the difference between renting a telephone number and renting a domain, or email address, or even a home address. All can be taken away for various reasons, failure to pay rent/renewal/mortgage, legal confiscations, etc.

As far as I can tell, it's just a whine services don't let you use a preferred rented identity listing (that is arguably less tied to the real world). There's not a lot of genuine security or legal analysis to be found here.

Some other guy went a bit more into genuine security if thats your thing: https://www.devever.net/~hl/e164

Re: Phone numbers are not proper verification

#149

Post by Jordrok » Mon, Jan 16, 2017, 5:28 PM UTC

Freak_NL wrote: post #15

herbst wrote: post #9

Earlier quoted context omitted.

> My inner tin foil hat says Google wants a phone number for other purposes. Just like Twitter these days. "Telephone number is optional and for your security". 2 minutes later my new accounts are always locked and i need to provide a telephone number to enable it again. They used SMS until recently, now they use a call service which only works with a fraction of numbers. (Tried 2 thai, 1 cambodian number, none accep…

Steam does this as well. Even if you add your phone number after a lot of nagging, Steam still keeps bothering you to install their Android or IOS authenticator software (even if you can't). I wish Steam would consider Fido U2F as well, but getting through to anyone who can influence this at Valve is nigh impossible. It seems to be the industry status quo now to assume that everyone uses a smartphone running either A…

Yeah, I just ran into something similar a few days ago. Every once in a while I used to go through all my trading cards and bulk sell all my duplicates for a few cents each, but apparently now they require you to use some combination of SMS and mobile app authentication to post anything on the market. Clicking through the confirmation email they send you isn't enough on its own.

So now I just don't bother with trading cards at all.

Re: Phone numbers are not proper verification

#150

Post by Jordrok » Mon, Jan 16, 2017, 5:31 PM UTC

ProblemFactory wrote: post #88

Buge wrote: post #3

Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily. You add the phone number as a factor, then add other factors (such as Google Authenticator and Yubikeys) then delete the phone number.

Can you even create a working Google account without a phone number? When I last tried that, it seemed to be mandatory from the start. It never seemed to be a security measure, but an anti-spam measure. You can buy captcha solving as a service for fractions of a cent, and bulk create thousands of accounts for sending spam. Buying working phone numbers is more hassle and more expensive, and will leave a payment trail…

You can, but it's not obvious that it's an option. I'd be willing to bet that the signup UI was deliberately designed to make it look like a phone number is required.