Ask HN: Why are phone numbers considered a secure personal identifier?

Why does everyone assume that two factor authentication by mobile means SMS? The SIM card (Subscriber Identity Module) has the features necessary to do it and this is used in Norway to provide 2FA for logging in to banks and state services like tax and health.

> I travel quite a bit and change phone numbers often. Most of the time when I am traveling I am in locations that have poor or nonexistent cellular service.

Use Twilio or VOIP.ms, very cheap. You can do 2fa easily, just top up $20. I find that the biggest cost for me personally doing this is the $1/month phone number rental fee. I use maybe ~50c every month on 2fa. It's an already solved problem.

> I have debated using Twilio to create my own number pool of international numbers and a way to check my messages via a web portal instead of relying on messaging. Are there any current apps / services that already do this effectively?

VOIP.ms has a very nice SMS gateway, they will automatically relay SMS messages to your email address. You pay a bit of a premium for it (eg, of SMS cost 0.001c, you pay 0.0015c if I recall correctly) - but it's almost immediately delivered without issue.

Common fallacy is that phone numbers uniquely identify a person or a geographic location. Neither has ever been true but that is the real reason banks want your phone number so bad. It wasn't so long ago that you couldn't even get a loan or credit card in the US without a phone in your name.

My phone number came from an old alt.phreaking post and has run busy continuously since at least 1982. If banks try to SMS authenticate me then instead of their app or web banking, I just link the account to another bank that doesn't do SMS. These days I pay for everything with credit cards anyway and the bank is just there to insure and hold my funds until I pay the cards, so I don't need much from them besides an ATM card and the ACH numbers.

I've noticed that all of the synchrony branded credit card sites require SMS only for password changes, and when prompting you they pull a list of every phone you've ever owned from a Transunion skip-trace database. If they wanted to authenticate me again before entering an area of elevated security they could just ask for my password again - but they don't, and they don't ask for any credentials when changing the phone number, so that suggests to me that security isn't the reason they are prompting for SMS authentication.

SMS validation or not, don't try to access the web portal for a Synchrony issued credit card from outside the US, they typically block the account with SMS validation for 3-4 days. Several times I've forgotten to turn of my VPN and ended up sending them paper checks in order to pay my bill on time.

Plus I think we've sufficiently proven that phone numbers are susceptible to SS7 and social engineering attacks, anyone with my mother's maiden name, DOB, and social security number can take over my phone and all the information is easily acquired from Transunion or Experian. The best thing NIST ever did as depreciate SMS auth for all the reasons I just described. The worst thing NIST ever did was backtrack on the first thing.

There are financial services companies out there that give a damn about security. Shout out to Robinhood for enabling strong passwords (32 characters!) and standard TOTP. They are the only financial services company I've found that offers TOTP. As soon as they have a cash management account I think that is where I'm going to park my funds.

(E*Trade has 2FA also but you have to buy a hardware dongle from them. I appreciate the effort but paging Captain Marvel just the same.)

I wrote about this a while back. https://medium.com/@gregcohn/burners-dont-hack-uber-people-d...

TL;DR Phone numbers are not unique ID keys for people. But it seems like many companies view it as an easy, cheap 2nd factor (generally, "something you have"), to be combined with a strong password ("something you know").

The problem of course being that SIM-bound number can be hacked or stolen, and non-SIM-bound numbers are not actually "something you have". If a Google Voice number is controlled by the same login as a gmail account, there goes your 2nd factor.

A lot of people do use Burner for this per the link above. (I'm a founder).

They aren't secure.

I had a phone number hijacked a few years ago, and it took a lot of perseverance to retake control of the number. The phone company (AT&T) didn't know how to handle it. What they did understand is how to close an account. So one of the times I regained control (only to be sure I'd lose it again, soon) I quickly got them to delete the account. That did it.

Ever since that happened and I see a system for 2FA that is based on a phone number, I think it's just security theater, they must know there's nothing secure about it.