Why can't they just use something like a proof-of-work mechanism to combat spam?
There are also now services that do this for you so you don't even have to buy the SIM card yourself. They add some new phone numbers every day and publish the numbers along with every SMS they receive on a public site with ads on it. The "higher end" ones give you your own personal throwaway phone number but then you have to pay the $5.
This means sites should immediately stop using this verification method because it obviously isn't going to stop adversaries with even trivial resources, and the security implications of encouraging vulnerable populations to use random sites like that is hugely bad.
SMS verification is also ridiculous to begin with because phone numbers get recycled quickly and users should neither lose their account just because their phone number changed nor have some stranger enabled to steal it.
It costs zero dollars and takes the same amount of time as the SMS verification would on a regular phone. If the sign-up site is continuously vigilant enough to find and prohibit every number on every one of these sites (not so cheap to implement) then there are sites that give you immediate access to a non-published number for $5. Even this is not "enormous resources" by any means.
But the even bigger implementation cost is that there are many people who don't have a personal cell phone number to receive SMS, and you're either disenfranchising them or pushing them to use sites like that which obviously allow anybody to see the verification codes sent to the phone number which is now associated with their account.
> A significant amount of online properties use SMS for 2FA and authentication
Using SMS for optional 2FA is a mediocre security practice but is mostly harmless (because people can opt out; though it still makes it possible to lose your account if you use it, your number changes and then the site requires you to authenticate with it).
Using it for mandatory 2FA has the problems discussed.
But I also want to point out that actual major sites exist that use SMS as the sole and mandatory authentication factor, and they are very powerfully incompetent.
I don't believe there is a level of work that one could do that would both be too expensive for scammers and not grind your battery to a halt.
Like, the first point of an anti-spam system on a forum is so that you can't just upvote your own crap to the front page.
Wonder why this never caught on. /s
Like, this poor solution is probably the best thing on some dimension, I would just wonder if it's a dimension worth caring about.
The objective seems to be eliminating the requirement of registration at all. Why? Why would I care to enable people to upvote/downvote content that don't care to spend 1 second registering? I also don't think you can make a convincing case that the friction of registration makes or breaks any websites when almost all of the most popular websites require registration. Seems to be me users are willing to jump the hurdle by the millions if they care to engage.
It can't be a matter of privacy because the site could be logging your IP address in both cases.
It can't really be friction because you could make the most frictionless process possible. Maybe clicking upvote summons a tiny tooltip where you enter a username and password. EZBoard forums back in the day had that -- You would write your whole post and the submit button would assign you a random username that you could then customize.
I just see a forum that made the questionable decision to let you infinitely manipulate rankings without even trying to stop you, the actual impl of that (no registration, PoW puzzle, etc.) rather irrelevant.
> It it allowed to embed captchas that prevent bots?
> Yes. The website operator has not only a vested interest in using captchas but is even obligated to do so as they have to guarantee website availability.
(I don't understand what this obligation is about - surely it's my own choice whether my website is up or down?)
> Is it allowed to embed Google captchas on the website?
> Website operators should strongly consider alternatives. If Google reCAPTCHA is used regardless, the responsible should be aware that they must be able to prove that this use is lawful according to [data privacy law]. When unable to explain how Google uses user data, the user cannot be informed transparently and the lawful use cannot be established.
They are likely either saying that the uptime of the service relies on the use of captchas (i.e. it's a technical obligation), or it is implying that the majority of sites are commercially operated, wherein the operator has a financial/legal/contractual obligation that they deliver a working product.