Hacker News Reader

Comment by teej | Hacker News Reader

It's insane to me that the only thing standing between me and having my life ruined is some minimum wage cell phone store employee.

Text message based 2FA needs to die.

View on HN

The only solution I have found to this is to have accounts for which I never give out the account number to anyone and only leave a little bit of cash in the accounts I transfer money out of.

Seems the problem would be solved if someone would hold the phone companies accountable.

These problems seem easily solvable with MFA and a VPN, and if anyone should be an expert in networks, you would think it would be a telecom company.

This is gross negligence being passed off to the public as standard operating procedure.

It also causes stupid trouble for those of us that travel alot, or split time between countries. SMS 2FA is my sworn enemy.

Yes, so much this. I want to be more secure but don't want the solution tied to my American phone number. I've even thought of getting a dual-sim phone just so I won't get locked out of my accounts when abroad and using a local sim.

Started to use Google Voice everywhere after telling my bank about it. They were OK, as long as they can call it from a landline. So I can slowly move away from SIMs.

Virtual numbers from providers like Twilio, Plivo or Signalwire help too. They have 2FA mostly and couldn't be SIM-swapped (I hope). Google account security is quite good too.

I am afraid of google killing it eventually. I wonder if there's an alternative. Interestingly, Google Voice is now part of gcloud, so there might still be some hope for it.

> minimum wage

Seems unnecessary.

I think it’s relevant and it’s not a smear against the worker, but the job.

If you’re making minimum wage, how much do you really care about your job in general? You’re probably regarded as disposable.

I understand that interpretation and I think it's valid. I also think that particular string "some minimum wage worker" has a long nose to look down and you shouldn't condescend or distrust lower compensated employees.

I always interpretted "minimium wage" as "cheap to bribe and often effectively anonymous" in the objection in security contexts as that tends to matter more than lack of attention or aptitude. More of an argument to the opposite that the company should be either treating the access to the secure data/job better or promoting more loyalty. Plus any form of validation/licensing/training (say like bonded couriers for example) essentially requires both being paid for and the marginal cost encourages raising the rate so they don't change jobs as readily means it is no longer minimum wage even if it is still low on the worker totem pole.

I 100% agree.

I also trust fast food employees to effectively sanitize, even if their position does not command a wage increase.

I stand by my initial argument with the wording and I'd rather not tangent down ethics, policy, hypotheticals.

I am just expressing a bad taste, that is all.

There are plenty of ways to ruin someone’s life with access to their phone number beyond compromising their accounts with 2FA.

What really needs to die is giving privileged access to underpaid monkeys.

> What really needs to die is giving privileged access to underpaid monkeys.

This in uncalled for.

I worked for Software Etc. for a while. I remember thinking "they pay us peanuts and they expect monkeys".

This was demonstrated by the two fat binders filled with procedures for EVERYTHING that were supposed to followed to the letter.

You might reconsider this opinion once you or someone you know loses money and/or time because of some CS idiot. I’ve had my fair share of such incidents (so much that I’m paying 10x more for an enterprise-grade leased line just to not have to talk to them ever) and I no longer have any sympathy for those people.

Heh.

I started my tech career in a call center. Were there people there that shouldn't have had that job? Sure. Do those people deserved to be belittled by calling them monkeys? No fucking way. Show some damn respect for your fellow man.

I was a "CS monkey" for two years at Google. A job I was overqualified for but it was the only thing that got me into a major tech company.

(Nobody at big tech companies ever bothered to even phone screen me for SWE roles)

Also your enterprise account managers often are clueless and just ask the support team - certainly what happened in my experience.

People is keyword here, monkeys is not.

Or they could pay workers with privileged access more.

Reply on news.ycombinator.com