Hacker News Reader

I moved my Google Voice number to OpenPhone [1] (YC S18). No relation besides being a paid ($10/month) customer. If you have T-Mobile in the US, they have a similar offering called DIGITS [2] you might try (although OpenPhone offers more features for the price).

[1] https://www.openphone.co

[2] https://www.t-mobile.com/offers/t-mobile-digits

View on HN

I signed up for OpenPhone just now, but then noticed that the only thing you need to log in to someone's account is their email and a 6 digit code emailed to their account. There are no password or 2FA options. I haven't tested how rate-limited the login attempts are, but it seems like too much to ask for customers to trust that they exist and work, especially when the apparent attack success probability is already > 1/1M.

Your access to your email account is your password (magic link-esq). Agreed that 2FA is desirable (not sure if it's on their roadmap, will have to ping them and ask). If 2FA is a hard requirement, building your own solution on top of Twilio is preferable (as they require 2FA).

Thanks. I agree with you, except a 6 digit code is worse than a good random password, or magic link with e.g. 64 bits of entropy.

Thanks for the suggestions!

Reply on news.ycombinator.com