Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Companies must stop requiring people to link their phone numbers

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Companies must stop requiring people to link their phone numbers

#41

Post by bluecalm »

>>Stick to emails. People barely ever change their emails.

As someone who uses the same gmail address since 2004 I thought that's what everyone does. Then I've started selling software and to avoid collecting personal data I've decided to link licenses to email addresses. Having sold 10k+ commercial licenses I get to deal with email address related problems about once a day (email address expired, blocked, access was lost, the provider doesn't allow using it from current location, the company closed, the university doesn't let you use it anymore etc.).

Fortunately security doesn't really matter that much to us. Worst that can happen is someone gets to use additional license. We don't collect any personal information so there is nothing to leak. If that wasn't the case though and we had any kind of personal information linked to licenses I would really like to avoid using email addresses for anything. The simple: "Hey, my name is X Y, I lost access to abc@test.com address, can you please let me use another address" becomes a security nightmare.

It's one of the things you learn once you start doing something on a bigger scale. Some other things which I've learnt actually happen but never happened to me: SSDs fail, RAM fails quite often, a lot of stuff fails with some Windows settings that won't ever fail on 10 computers you test it on etc. etc.

Re: Companies must stop requiring people to link their phone numbers

#42

Post by doggodaddo78 »

smt88 wrote: post #6

> With the growing number of people working remotely from anywhere It's growing, but it's still tiny. Most companies doing this are willing to lose users who don't have permanent phone numbers in order to gain a quick, easy, semi-reliable way to prevent fake account registrations. > Stick to emails. People barely ever change their emails. This is factually wrong. People get married, get divorced, change employers, gr…

Personal emails DO NOT change a lot. This is dishonest because they change extremely infrequently as a universal contact identifier.

I had an email startup. Emphasis on had. People are very reluctant to switch email providers and email addresses.

What may change more are business, affiliation, and ephemeral email addresses, but most people don't go around changing their personal email addresses like bathroom wallpaper.

Re: Companies must stop requiring people to link their phone numbers

#43

Post by Spooky23 »

justinclift wrote: post #23
ramraj07 wrote: post #19

Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to auth…

> But everyone understands and has a mobile phone already ... This is NOT true. I used to live in part of Cornwall (South East UK) which has no mobile tower coverage. So, no mobile phone #. That became an extraordinary PITA once some idiotic major companies decided the "everyone has a mobile" meme was true. Mandatory 2FA using mobile number only text messages -> worst idea ever. :( :( :(

It’s even dumber where in the name of security they disable things like Google Voice that allow you to get SMS messages without cellular.

Chase bank in the US decided to break this recently. Like you, geography means I don’t have a mobile in many scenarios.

Re: Companies must stop requiring people to link their phone numbers

#44

Post by smt88 »

doggodaddo78 wrote: post #42
smt88 wrote: post #6

> With the growing number of people working remotely from anywhere It's growing, but it's still tiny. Most companies doing this are willing to lose users who don't have permanent phone numbers in order to gain a quick, easy, semi-reliable way to prevent fake account registrations. > Stick to emails. People barely ever change their emails. This is factually wrong. People get married, get divorced, change employers, gr…

Personal emails DO NOT change a lot. This is dishonest because they change extremely infrequently as a universal contact identifier. I had an email startup. Emphasis on had. People are very reluctant to switch email providers and email addresses. What may change more are business, affiliation, and ephemeral email addresses, but most people don't go around changing their personal email addresses like bathroom wallpape…

Like I said, there are various life stages where your email address changes. A lot of people sign up for things with their employer-provided email address as well.

Phone numbers really only change when someone moves to a different country or absolutely can't port their number, which is rare these days. They change much less frequently than phone numbers change.

Source: API logs from an auto insurance backend that I maintain

Re: Companies must stop requiring people to link their phone numbers

#45

Post by smt88 »

mtnGoat wrote: post #31
smt88 wrote: post #6

> With the growing number of people working remotely from anywhere It's growing, but it's still tiny. Most companies doing this are willing to lose users who don't have permanent phone numbers in order to gain a quick, easy, semi-reliable way to prevent fake account registrations. > Stick to emails. People barely ever change their emails. This is factually wrong. People get married, get divorced, change employers, gr…

I can get thousands of valid phone numbers for temporary use in 15 minutes. I’d say they are both about equal. No one needs quadrillions of anything, thousands is enough to do 99% of tasks.

> I can get thousands of valid phone numbers for temporary use in 15 minutes.

Not cheaply. Even on cheaper VoIP services, that would cost you $1,000+/month. Not a great price point if you're trying to spam something like a social network or post fake reviews, because each of your accounts is unlikely to generate enough to pay for the number.

Plus, many of the numbers will already be blacklisted because they're VoIP numbers or because they've been used for spam already.

> No one needs quadrillions of anything, thousands is enough to do 99% of tasks.

My point is that there are ~8 billion possible phone numbers in the US, when you account for reserved numbers. Many are already in use, many are blacklisted. Each costs $6-12/year to own through the major VoIP services.

There are essentially infinite email addresses, and each costs ~$0/year.

Which one do you want to use as a point of friction for signing up for your service?

Re: Companies must stop requiring people to link their phone numbers

#46

Post by ramraj07 »

jwandborg wrote: post #34
ramraj07 wrote: post #26

Earlier quoted context omitted.

I'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?

"here" is relative. Here's one data, this one from Canada: https://youtu.be/LlcAHkjbARs at 3:48

Seems like it's a problem in countries where companies bend over backwards to appease customers, also including when they shouldn't. In other places the agent will just go you're SOL if you called asking to change ownership.

Re: Companies must stop requiring people to link their phone numbers

#47

Post by httpsterio »

ramraj07 wrote: post #26
j0ba wrote: post #22

Earlier quoted context omitted.

OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number. This is not speculative. I've literally had to help relatives with this exact security breach. Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your o…

I'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?

Very untrue, it's a pretty common way of stealing social media accounts like Twitter and YouTube accounts. Happens all over the place, definitely in places like USA.

Re: Companies must stop requiring people to link their phone numbers

#48

Post by quickthrower2 »

smt88 wrote: post #6

> With the growing number of people working remotely from anywhere It's growing, but it's still tiny. Most companies doing this are willing to lose users who don't have permanent phone numbers in order to gain a quick, easy, semi-reliable way to prevent fake account registrations. > Stick to emails. People barely ever change their emails. This is factually wrong. People get married, get divorced, change employers, gr…

And also people on networks that won’t deliver their providers messages. I can’t sign up for Twitter for example.

Re: Companies must stop requiring people to link their phone numbers

#49

Post by quickthrower2 »

kiseleon wrote: post #30
paulcole wrote: post #15

Earlier quoted context omitted.

I’m the only one at my company who uses a USB key for 2FA. Zero interest in an app on my personal device.

The exception I make is that I use Google Authenticator for my work 2FA (via Okta). I also have a yubikey set up but our VPN application doesn't work with it.

Yeah I have no problem using GA for work stuff, but I’d be interested in reasons against it.
Post reply on HN