Hacker News Reader

Comment by cookiengineer | Hacker News Reader

Note that some countries have prepaid SIMs that are regularly reassigned to new SIMs...as soon as 6 months after the last "refill" of the card.

This happened to a customer where their IT sysadmin got a prepaid phone and registered this as a recovery number in a critical system (read as: full control over infrastructure).

And yes, the company forgot to refill the SIM card only to realize a year later that some script kiddie got the phone number by accident and was curious enough to lookup where the number was being used. DNS entries and ASN entries were enough OSINT to form an attack strategy.

What you gonna do then? As it turns out, this was a shitstorm of problems to deal with through hours (probably days) of support hotline calls.

Remember folks: 2FA via SMS is useless. Avoid phone numbers like the plague, everywhere.

View on HN

Couldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel.

- I can own my email address; I cannot meaningfully own a phone number.

- Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.)

- Email works with or without a cell signal/via mobile data.

- Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.

Since you can have unlimited amounts of email addresses for free, they are not the ideal identifier for products for which there are “free up to a certain point” aspects or “we’d like to make sure we’re dealing with an individual person” aspects? Though surely in the latter case something better than an email OR phone number is possible.

If "proof-of-x" is desired for spam account prevention: Sure, happy to provide that as a user.

Just don‘t also tangle it to my user ID and/or 2FA recovery.

> they are not the ideal identifier for products

They are a pretty decent identifier for users. Facebook demanded my phone number for "security" purposes then turned around and used it as a unique identifier to tie me to purchase records from various businesses (e.g. Ticketmaster - why am I not surprised?) that apparently have shady tracking/advertising deals with Facebook.

This sort of information misuse and tracking (not to mention spam) is precisely what "sign in with Apple" was supposed to fix in terms of e-mail addresses, but it's currently instantly neutralized by SMS "verification" since it's a huge pain to get a different phone number just to prevent Facebook from using it as a tracking identifier.

(I guess this reminds me why I have said "no" to multiple inquiries from Facebook. The thought of being told to implement a dark pattern as part of your job is extremely unpleasant. Facebook's confusing anti-privacy settings are another example.)

And it's not just Facebook. This is seeping into other completely unexpected applications; for example I bought a game controller whose driver software setup demanded a mobile number for "verification" purposes. No, just no.

> - Email is international. Phone numbers aren't.

I agree with the gist of your email, but what is this supposed to mean exactly? The whole world shares a single phone (number) system, right?

Being able to send an SMS to a US phone number does not guarantee the ability to send an SMS to, eg, a Chinese phone number. SMS isn't even widely used in a lot of locales outside North America. Email works the same everywhere.

Email is not delivered reliably either. There are many blockers. Either you are not allowed to enter a perfectly working address. They might use some list of domains they think they are bad (happens to me increasingly). The programmer might have hand-crafted their own regexp for "valid" email addresses. The email provider might not accept certain incoming mails. I am on several lists that say, sorry our emails are not deliverd on hotmail, yahoo, whatever. Harmless hobby stuff, nothing spammy or illegal.

It means if you move to a different country you can probably keep your email, but you will probably lose your phone number.

You actually rent domains, not own them unless your a large corp like fb or google

The terms of domain "rental agreements" are much more standardized and user-friendly than those applying to phone numbers in the PSTN though, in my experience.

Many providers don't give you a choice. Many major banks default to using SMS for 2FA. I'm sure if they get breached the government will bail them out so why should they change?

"FDIC insured"..

I use a GV number for 2FA over SMS as the last mile solution.

Me too, but some banks/payment services don't allow that – ostensibly for security reasons...

Even when I did get a "real phone number" (that concept irritates me to no end), one of these first required me to send a phone bill as a "proof of me owning that number" before they would let me set it for 2FA.

I guess that's just what happens when blending/confusing the three distinct concerns of spam/fraud protection, 2FA, and user identification (for inbound P2P payments) into a single identifier.

Reply on news.ycombinator.com