Comment by LWIRVoltage | Hacker News Reader

Comment by LWIRVoltage | Hacker News Reader

That is interesting but we run into something that is now prevalent- I don't use it, but Twitter requires a phone number at singup, right?

This is the same issue that is going on really heavily right now with Microsoft Accounts(and they are about to force the entire playerbase of Minecraft to give a phone number by pushing them to Microsoft accounts starting a day or two from now) (Note:This occurs without trying to use TOR during MS account creation, the system will lock you out afterwards- I assume TOR would be even more difficult)

To my understanding, even Protonmail has a odd requirement where you have to verify by making a donation, if you try to initially sign up with TOR- and sure, they might only keep a hash , but this is a risk as someone could generate a hash of all potential phone numbers and them compare.

Logging in via TOR afterwards to protonmail is good and all, but you aren't fully private then and can be compromised with out recourse it appears. [VPN would probably be the way to get around this][Protonmail is still probably the strongest option, especially since they won that court case they sued the Swiss gov in after being made to help the french government in that one case- now they are not able to be coerced at all - nontheless this signup TOR quirk is the only major thorn.]

I get the feeling no one realizes that you have these additional hoops to creating an account on any service- and that data they force you provide, could be subject to a subpoena in a jurisdiction where they don't like something you did, etc ,etc. And no, VOIP numbers and burner numbers are now auto-detected by these services and pre-blocked en masse.

I agree with another poster, Signal is probably okay in needing one, and they are working on removing that and providing unique identifiers at least, along with stripping as much metadata as they can. Other services seem to be going towards a point where you're at the mercy of whoever can compel or read the data they required of you to use services that did not require this.

I wish services would instead turn towards TOTP and other authentication, to avoid spam. The fact that that sort of substitute doesn't allow one to bypass giving up details like Phone numbers- suggests it's about the data, not authentication or anti-spam, since they offer no alternate.

Another one is Telegram, a service which requires you to install an app on a mobile device and provide a phone number. It markets itself as a privacy app...

It looks like almost all trendy “privacy” apps require a phone number: Signal, Protonmail…

At this point privacy is yet another marketing buzzword for platforms.

"Buy a VPN subscription. [insert fears] We promise your data is safe with us."

"Perform KYC verification to earn Brave BAT tokens. We want to protect your privacy."

"We're not like that other big platform. This time is different. Centralize your data with us."

How would you use TOTP to mitigate spam exactly?

If the idea is to stop some sort of massed emailing or posting or whatnot, using TOTP as a requirement to take those actions would slow that down to once every 30 seconds-

if it's a matter of access and authentic access(as Microsoft's 'message' when they lock you out notes<suspicious activity>)) TOTP on actions a user may do, should cut down on the idea that an account is hacked.

An initial idea -

If they are worried about account creation being too fast, I suppose one idea then would be a TOTP client-side program that generates a unique account-generation code, one would need to create an account on a service to begin with- and time limit that from both sides, if the worry is a lot of accounts being generated in too short a time. This way, one can always kill the client code generator, and reinstall it, but overall that doesn't get around the fact you need that to make a full account on the service, and this would slow down creation from someone while not using phone numbers or other meta-data that would be usable against them from a privacy perspective.

I would also look at how the teams from Signal, etc- are tackling that while reducing meta-data

if the idea is indeed about having some method to track the user in a way you can discover other info about them through subsequent means directly, then that's ...what we'd want to avoid.

> If the idea is to stop some sort of massed emailing or posting or whatnot, using TOTP as a requirement to take those actions would slow that down to once every 30 seconds-

No, it wouldn't.

If the service required a TOTP code every time an account wanted to make a post (which would be absurd), that would prevent each account from posting more than once every 30 seconds. But, even if that were desirable, it could be accomplished much more easily with a server-side rate limit.

A spammer has access to many accounts, and would easily be able to generate a TOTP code for each one of them every 30 seconds. TOTP is not a rate-limiting feature, and provides absolutely no benefits here.

> they are about to force the entire playerbase of Minecraft to give a phone number by pushing them to Microsoft accounts starting a day or two from now

Insisting on phone numbers would be a breach of the GDPR. Having entered into a contract a business cannot then demand additional personal information as a condition of fulfilling the contract.

...Does their current method get around this? They let you make the account, then a week or two later at most when you log in, it flags you and tells you due to 'suspicious activity', you now have to enter a phone number to get in specifically- as the account is now locked out otherwise. And VOIP numbers and burner numbers are autodetected and the system says to find a different number...

Since they allow you to initially make the account, i wonder if that lets them 'attempt to' bypass this -

Also, if that became a pain point eventually, they could make it so accounts made with European IP addresses from certain regions avoid this. (I think i've read on Reddit that european players get affected, but after contacting microsoft and citing GDPR with a form, they unlocked it- alas, the US and the rest of the world is forced to give a number then (not counting south korea which is a special case i've read)

Reply on news.ycombinator.com