Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Companies must stop requiring people to link their phone numbers

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Companies must stop requiring people to link their phone numbers

#21

Post by gowld »

ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

Spam is a behavior, not a person. But kf you want to demand ID, just demand ID!

There's no reason to require phone or email; let the user choose their preference.

Re: Companies must stop requiring people to link their phone numbers

#22

Post by j0ba »

ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number.

This is not speculative. I've literally had to help relatives with this exact security breach.

Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your only authentication factor is much less secure than a password + 2FA.

An authenticator app, such as Authy, faces none of those security issues.

Re: Companies must stop requiring people to link their phone numbers

#23

Post by justinclift »

ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

> But everyone understands and has a mobile phone already ...

This is NOT true. I used to live in part of Cornwall (South East UK) which has no mobile tower coverage.

So, no mobile phone #. That became an extraordinary PITA once some idiotic major companies decided the "everyone has a mobile" meme was true.

Mandatory 2FA using mobile number only text messages -> worst idea ever. :( :( :(

Re: Companies must stop requiring people to link their phone numbers

#24

Post by bierjunge »

sloaken wrote: post #8

I am not sure why you do not use Google Voice. I have been using it for 9 years now. I have a OBi202 box attached, so I can use a normal hand set. It is our house phone. Yeah back in the day, people had one phone in the house and everyone shared it. But google voice I can use the box or my laptop to answer, it takes voice messages, and text messages. All in all a GREAT service.

It's available in the U.S only. If it were available here in Germany, I would love to use it, but until that I have to use some burners which is getting harder every day since you are required by law to link your ID to a phone number to activate it (even prepaid).

Re: Companies must stop requiring people to link their phone numbers

#25

Post by PaulWaldman »

With companies still requiring phone numbers, Google Fi might be a good option if you have a US address. You keep the same number as you travel worldwide and there are no international roaming charges.

Edit: There are no international data and texting roaming charges. Cell based calls can be about $.20 per minute, but wifi calling is free.

Re: Companies must stop requiring people to link their phone numbers

#26

Post by ramraj07 »

j0ba wrote: post #22
ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number. This is not speculative. I've literally had to help relatives with this exact security breach. Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your o…

I'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?

Re: Companies must stop requiring people to link their phone numbers

#27

Post by ramraj07 »

justinclift wrote: post #23
ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

> But everyone understands and has a mobile phone already ... This is NOT true. I used to live in part of Cornwall (South East UK) which has no mobile tower coverage. So, no mobile phone #. That became an extraordinary PITA once some idiotic major companies decided the "everyone has a mobile" meme was true. Mandatory 2FA using mobile number only text messages -> worst idea ever. :( :( :(

Mobile coverage is outrageously good in places like India. Except if you go to actual villages. But then if a place doesn't have running water or electricity and you're worried about logging into your bank account, I suppose reorienting priorities might be expected.

Re: Companies must stop requiring people to link their phone numbers

#29

Post by ntnlabs »

ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

I believe if in 3rd world country I would be able to sniff on GMS traffic and get OTPs easier than a regular password.

Re: Companies must stop requiring people to link their phone numbers

#30

Post by kiseleon »

paulcole wrote: post #15
physicsguy wrote: post #11

It drives me nuts that 2FA is being expected by companies, and yet they're not providing employees with a phone. If you do want me to use 2FA, provide me with a device I can do it from. I do not use my personal devices for work.

I’m the only one at my company who uses a USB key for 2FA. Zero interest in an app on my personal device.

The exception I make is that I use Google Authenticator for my work 2FA (via Okta). I also have a yubikey set up but our VPN application doesn't work with it.
Post reply on HN