Hacker News Reader

Comment by Semaphor | Hacker News Reader

This is somewhat hilarious. Just 5 days ago I was complaining about Twitch’s new "Only verified users" setting which requires me to give them my phone number. One of the reasons I said I’ll not do that was "hacks, leaks". And now this. Sure, I’ll give you my phone number to add TOTP (Why even?) after I’ve just been shown how secure that data is.

View on HN

I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing?

Meanwhile, Twitch has had a significant bot spamming problem.

I’m also subscribed to a few channels. I’m pretty sure that is a far stronger signal that I’m not a bot than getting my phone number. And unlike most people, I only had 2 or 3 spam calls, and maybe 10 spam SMS on the number I’ve had for almost 20 years.

Ok so you don't want them to have your phone number but you're ok with them having your payment details?

Pretty much my PayPal account, only.

And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nithing I could do.

> And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nothing I could do.

> so what am I losing?

The fact that they can use this number to correlate against contact lists collected from other people.

Now I don't think Twitch itself is doing this, but they may provide this information to marketing platforms such as Facebook which will use this data for ad targeting (and they definitely have a lot of people's contacts and can infer social graphs very well as a result).

Which came first? You giving your phone number away online, or the scam calls?

Scam calls just end up ringing every working number these days and if you pick up even once you're already on the list of "real people". Targeted scamming of even just 100,000 potential victims is just wasted effort when with the same setup you could do untarget scamming of 100,000,000 potential victims.

Probably not everyone has disposable phone numbers or even know how to manage them, or even choose not to do it out of a personal decision

> I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing?

The only scammers who know my number are my phone-provider and my mom. Other scammers either never call me, or just don't know the number. Protecting your number is possible.

> Meanwhile, Twitch has had a significant bot spamming problem.

Which can be solved without this. The bot-problem is more about people not using the existing tools well and twitch sucking in their handling. Adding another features they won't use will not make anything better. Especially as the phone-number only rises the bar for bots.

The twitch tools for dealing with spam suck ass. You basically get a blacklist of words and follower/subscriber only chat modes.

You can also restrict to following-age, certified e-mail, and some more. That experienced mods do have little to no problems with bot speaks kinda for itself. Additionally, there are also a bunch of requested features on twitch-side which could had defused the problems even more, without opening the privacy-box.

Anyone who has your number in their contact list might have uploaded their entire contact list.

It literally takes only one person who has your number to reveal your number.

For every conscientious person like you, there are 100 kids, who don't even have fully formed brains, desperate to participate in this system.

Twitch has a huge problem with waves of hate bots spamming and overwhelming smaller streamers, and it's been getting worse.

They really need that verification option just to avoid getting run off the platform.

This is a readily solvable problem i.e. the only phone number I use/give online is a VOIP# that just redirects to voicemail immediately (and blocks the call if it's on my SPAMMER list of persistent annoyances).

For friends/family they have my cell# and it only lets calls through if they're in my contacts.

How much does your VOIP cost?

I use voip.ms and is pay-as-you-go so it's nominal e.g. $1-2/mnth. It allows setting up all sorts of call handling rules (time-of-day, CID lists, call trees).

Even though it should not be, this approach is a luxury that can only be afforded by those who do not need to take live calls from previously-unknown numbers. Job hunters, medical patients, etc.

It’s readily solvable not to require a phone number to add a TOTP app.

The point isn't to authenticate control of an account, it's to tie the account to some kind of expensive-to-replicate real-world cost, ideally one that most potential customers are already paying for.

Phone numbers are nice because the marginal cost to a customer is low (they probably already have one) while the marginal cost to a bad actor is high (it's expensive to acquire many of them or to change one once it's been identified as malicious).

My current phone contract: 3.99€/month

My current twitch subscriptions: 11.97€/month

I can’t really see how they need my phone number to make it too expensive to be a bot.

And if that is the thing, then that’d makes them even more shady, claiming it’s for account security when it’s for their bit protection.

From what I can see their 2FA is not inhouse. They're using twilio's Authy (first time I've heard of it, honestly) so maybe the phone numbers are not in the leak.

I’m assuming they may have had access to private API keys so unfortunately Authy may not be immune. That is unless Authy hides those details from their customers.

Authy does hide those details from their customers.

Reply on news.ycombinator.com