Hacker News Reader

Comment by lxgr | Hacker News Reader

Couldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel.

- I can own my email address; I cannot meaningfully own a phone number.

- Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.)

- Email works with or without a cell signal/via mobile data.

- Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.

View on HN

> - Email is international. Phone numbers aren't.

I agree with the gist of your email, but what is this supposed to mean exactly? The whole world shares a single phone (number) system, right?

Being able to send an SMS to a US phone number does not guarantee the ability to send an SMS to, eg, a Chinese phone number. SMS isn't even widely used in a lot of locales outside North America. Email works the same everywhere.

Email is not delivered reliably either. There are many blockers. Either you are not allowed to enter a perfectly working address. They might use some list of domains they think they are bad (happens to me increasingly). The programmer might have hand-crafted their own regexp for "valid" email addresses. The email provider might not accept certain incoming mails. I am on several lists that say, sorry our emails are not deliverd on hotmail, yahoo, whatever. Harmless hobby stuff, nothing spammy or illegal.

It means if you move to a different country you can probably keep your email, but you will probably lose your phone number.

Since you can have unlimited amounts of email addresses for free, they are not the ideal identifier for products for which there are “free up to a certain point” aspects or “we’d like to make sure we’re dealing with an individual person” aspects? Though surely in the latter case something better than an email OR phone number is possible.

If "proof-of-x" is desired for spam account prevention: Sure, happy to provide that as a user.

Just don‘t also tangle it to my user ID and/or 2FA recovery.

> they are not the ideal identifier for products

They are a pretty decent identifier for users. Facebook demanded my phone number for "security" purposes then turned around and used it as a unique identifier to tie me to purchase records from various businesses (e.g. Ticketmaster - why am I not surprised?) that apparently have shady tracking/advertising deals with Facebook.

This sort of information misuse and tracking (not to mention spam) is precisely what "sign in with Apple" was supposed to fix in terms of e-mail addresses, but it's currently instantly neutralized by SMS "verification" since it's a huge pain to get a different phone number just to prevent Facebook from using it as a tracking identifier.

(I guess this reminds me why I have said "no" to multiple inquiries from Facebook. The thought of being told to implement a dark pattern as part of your job is extremely unpleasant. Facebook's confusing anti-privacy settings are another example.)

And it's not just Facebook. This is seeping into other completely unexpected applications; for example I bought a game controller whose driver software setup demanded a mobile number for "verification" purposes. No, just no.

You actually rent domains, not own them unless your a large corp like fb or google

The terms of domain "rental agreements" are much more standardized and user-friendly than those applying to phone numbers in the PSTN though, in my experience.

Reply on news.ycombinator.com