Hacker News Reader

Comment by lotsofpulp | Hacker News Reader

I understand why websites need to use captcha. I do not understand why websites that have user accounts cannot offer the option of 2FA TOTP, or even SMS login to avoid captcha.

Hilton.com is a big annoyance.

View on HN

I really hate giving my phone number to any service, especially since i might need a second account there, or they might sell my data (or get hacked).

I also hate sites that force you to do so... eg. twitter, where it decides it won't let you register without a phone number (making a new twitter account for a project), then won't allow you to use the phone number, because you already used it for your primary account.

Coincidentally I just made my first Twitter account. I can't remember the exact boxes you need to click but there is a way to sign up without giving out your phone number.

The issue is that it may flag your account as more suspicious. After three days I had my account flagged. I couldn't view tweets or use the account in any way. On log in it would redirect me and ask for my phone number for "verification". Funny how they can verify something they never received. It took about ten days for support to correct but my account is active again and they still don't know my phone number.

I don't understand why they need it when they've already accepted and verified a login request, just need captcha to finish it off? (i.e. you don't get the captcha with bad creds)

I mean, maybe I can see/accept an argument for that. But when I have a recent order? When I'm logging in from the link you just emailed me?

A bot can trivially generate TOTP tokens from a shared secret and receive/process incoming SMS to extract the code.

Then use the fact that I am a paying customer of Hilton’s for years to mark my account as a human. I have the Hilton credit card, I am a Diamond member, what else do they want?

I know why they force me though, I use content blockers on macOS and iOS to block tracking and ads, but that is not a good reason.

Can you share those content blockers? I recently acquired my first iOS device and have been suffering through the ads.

I use Wipr. Firefox Focus is a free one for iOS though.

Not who you asked, but I use Firefox Focus as a content blocker. Since iOS only has Safari and WebViews (Safari in different clothes), you enable content blockers by going to Settings > Safari > Content Blockers.

AdGuard is where it’s at on iOS.

I can think of few behaviours more human-like than using a content blocker. :)

SMS is expensive.

It's less expensive than losing customers due to a bad UX.

But more measurable.

TOTP is free, and can simply be made an option to avoid CAPTCHA.

It's amazing that they still charge for something smaller than an average packet.

Reply on news.ycombinator.com