Hacker News Reader

Comment by rvz | Hacker News Reader

My point exactly why I don't use services that do this. Signal, Twitter, Facebook, Instagram, Telegram and all the like.

It is plain silly to require phone number verification as a 'security mechanism'

View on HN

The engineering of Gab (politics aside) is probably worthy of a front page HN post. They run on Mastodon and their entire codebase is open source.

"We have diverged from Mastodon in several ways in pursuit of our own goals. [...]"

https://code.gab.com/gab/social/gab-social/-/blob/develop/RE...

They started out as a Mastodon node, and then got blocked by the wider Fediverse.

https://blog.alexgleason.me/gab-block/

I laughed when his link to his article turned up a 404 at medium with account suspended. Not entirely sure yet if it was a morbid or cynical laugh.

At a more technical level, do we need a 4xx code for "memory holed"? Was this an oversight of the IETF, or should Medium and other discerning and socially responsible content providers use the other available 4xx codes?

Here, 404 "not found" is a pretty lie.

We could start off with the basic 400 "bad request". This is closer to the truth. In fact, it is too close to the truth because it means "client error". (Is it a crime yet to click on "not found" articles?)

So, ok, let's try 401 "unauthorized". This is still better than "not found" but, again, just a bit too honest.

But, really, Medium.com should be responding with 403 "Forbidden". This is the unvarnished truth from the mouth of the server.

403 - Forbidden: "The request contained valid data and was understood by the server, but the server is refusing action. This may be due to the user not having the necessary permissions for a resource or needing an account of some sort, or attempting a prohibited action e.g. creating a duplicate record where only one is allowed)."

"HTTP 451 - Unavailable For Legal Reasons” seems to be getting close?

I think those who think this misunderstand the type of security it is meant to provide. It's not about blocking account takeover attempts. Services mostly don't really care about that, because it doesn't affect the service as a whole. It's about reducing spam, bots, and other organized hostile activity towards the service as a whole. It's tough to create a bunch of accounts in a way that the site can't easily track if you have to provide a real phone number. Yes, everybody knows about buying phone services on the internet, and they do seem to have ways to block using those numbers.

Pretty much every service does this. Try signing up for a Google, Facebook, or Twitter account without providing a real phone number. Usually if it works at all, the account created will be rapidly blocked until you do provide one.

Then I will get spam through my phone number then each time I register it for 'SMS authentication'. Then you'll later ask how did these services not only get my phone number, but also upload my entire address book for 'security reasons'.

A captcha is more than enough.

You're right that you may get a lot of noisy authentication spam texts. Alas, none of the companies involved seem to care. Judging by their popularity, most of their users don't seem to care much either.

Is a captcha enough? I've never worked in bot/spam mitigation for a large public platform before, so I don't really know. Based on how universal phone number requirements are for these services, and how much trouble they seem to have gone to in order to block using easily purchased numbers, I'm going to guess that captchas aren't enough.

It's hard to say captchas are or aren't enough because you know most companies just want your phone number for ulterior motives.

i have simply assumed that the purpose of this requirement generally is for the platform owner to establish your real identity for monetization and/or indemnification, and that any benefit to the user is incidental.

who ever said that "security" meant yours? ¯\_(ツ)_/¯

It's more of a bot prevention mechanism than identification, however, I believe it encourages people to be more responsible for what they post also.

Well a captcha does just that without a phone number.

People will think twice about posting threats, child porn, and other illicit things when they have some skin in the game. This definitely cuts down on moderation requirements.

It is plain silly to require phone number verification as a 'security mechanism

why?

There’s nothing secure about phone numbers, receiving secret codes via SMS, etc

It is secure enough and it is the only reliable second factor to authorize that almost everyone possess.

It is less universal than e-mail (and potentially less-secure), and certainly less secure than TOTP. It also costs money, whereas the former two can be had for free.

Isn’t email hard to set up though? As in, Gmail silently dropping your emails even with DKIM set up properly? There’s services you can pay to have more luck, but then you’re at the same downside as texting

Yes, it absolutely is (though I do still run my own). I do know that it's easier than setting up a phone provider, however, which is more equivalent to setting up one's own ISP.

A phone isn't being used alone though. It's just one part of a 2FA system, right?

Reply on news.ycombinator.com