Looks like you can use OATH TOTP, which can be easily automated. I don't understand how this is an effective countermeasure against bots.
You can never eliminate the risk, but it's just one more point of friction which is also a not-so-unreasonable speed bump to enable for real users.
It's not in my name, I pay cash for it, I share my contacts with no one, etc.
I won't have it linked to me, and with how you can so readily be location tracked when someone knows your number, I am astonished so many people give it out.
So there goes the easiest 2fa....
Thus, even with google having my name linked to a number, it does not link to my cell phone.
Reply to comment below:
No one gets my real mobile number, so that is solved.
Why would I care if my VOIP number is in address books. That's the point of it, and why I have it
I'm not trying to hide from the government, I am preventing Google, FB, etc from linking my mobile to me, and preventing random people from tracking my location, which is trivial when they know your mobile number.
You withholding your caller ID only hides it from the receiving handset, it doesn't disguise it from the network.
Specifically, from the point of view of network analysis, a missing or unknown node becomes suspect when various connections point to it. In the era of high connectedness, that seems like kicking a goal on your own team if you're playing the "be anonymous" game.
Just to find out that phone #5 is Pete.
Whilst it could be done, things aren't quite that far along yet. Further, I believe you are presuming I intend to remain unknown from all parties.
I believe you, and a few other commenters here are jumping to an extreme interpretation. My goal is to cut automated tracking.
A key example may be photo radar, and those license plate covers which make plates illegible (presumably). In this case, should a police officer, or the government in general want to track you, yup, they could.
For example they could go through video looking for you again. Your exact car. Including, the covered plate! It really wouldn't be that hard to do, but it would take time. Effort.
However, plate readers are networked, and databases are being kept of car movements. Having that plate cover breaks this automatic tracking, even if a dedicated person may want to track.
So you raise the bar. You remove automation.
And that's the guts of it. Because profitability in this business is won by doing a few simple things, and then collecting massive amounts of data. Remove any degree of automation, and it is no longer profitable to track someone.
I bought my phone with cash, my sim card, my minutes with cash, used a fake address and name, signed up to Google with a different fake name, bought a play card with cash, which was basically zero effort for me.
I do this whenever I buy a new phone. A new, clean slate.
I then, using my already existing infrastructure, only allow people to reach my mobile via a voip number. Done.
Yet everyone here thinks this is loads of work, with zero benefit. Welp, I disagree.
My goal is not to ensure no one is capable of tracking me ; that's literally impossible. However, I do not want:
* Google to get my name, contact info, etc via my phone itself
* Google to link to me, by seeing my mobile phone in another person's contacts
This is why I give no one my mobile number.
If the Government, or if someone was suing me, or I was up to "no good", an exhaustive search would likely bear fruit. So? That's an entirely different animal.
I'm pointing out that it takes only one of your friends or acquaintances to add your real mobile number to their address book alongside your VoIP number to ruin your system. People don't think twice about giving apps access to their address book. They're also regularly scooped up by malware.
Your scheme requires you to have perfect OpSec 100% of the time. Just human nature says you've probably goofed and given out your mobile number once or twice. There are enough huge database leaks that your info has probably been leaked by someone you don't even know.
I said I don't give my mobile number out. Do you believe my friends work diligently to find this number out? And how would they get it? And why do you believe they would get it so easily.
I don't even know my number without looking in 'about phone'.
Your scheme requires you to have perfect OpSec 100% of the time. Just human nature says you've probably goofed and given out your mobile number once or twice.
I don't understand why you think I would do that? Or how it would happen by accident.
When someone asks my number, why would I give a number I never do, instead of the number I always do. Why would I even memorize my real number? I really don't understand why you think this is hard, tricky.
Or think it is a "scheme".
I use cash almost everywhere too. I have a friend who thinks this is strange, and sketchy. Cash. Sketchy. I just get bewildered when I encounter these types of thought processes...
So if you’re in the USA and you have ever called your bank’s toll-free from your mobile they already have your cell phone number. you can try to sell yourself by googling for toll-free ANACs which will read your number back to you
OATH/TOTP does not need your mobile number. It only needs the current time, a secret, and an SHA/HMAC function.
There's no phone number involved.
I also don't know what a verified account is. If it's just email-confirmed then yeah, that is trivial. If it is a payment card that worked, or even further a shipping address that worked, that can be more annoying to game.
I had thought that it was only the Pi Zero series that had strict quantity limits, and that people were supposed to be able to buy lots of 4's if they wanted to.
Also, for most users (not all) there isn't really a pressing need for a 4, since the 400 has been plentiful and is basically a 4 in a different form factor, with an attached keyboard. I figured if I wanted a 4 before they became available again, I'd just get a 400. What I really want is some more Zeros and Zero W's, but I think those are both being replaced by the more power hungry and expensive Zero W2.
I really dont know how they think they can use 2FA to stop all but the most basic of bots from buying up rpi's.
Thats quite a lot of surveillance.
You DO realize you're posting on an article about restrictions for purchasing Pis right?
So they have one IMEI, they have all for that phone.
Realistically the best protection that they could put in place is a rate/qty limit on the credit card being used. It can still be automated by using stolen cards, or one of the services that instantly creates new card numbers for you. But again it adds friction.
Also limiting the number of orders to delivery addresses would be a easy mitigation.
It wouldn’t surprise me if they are doing both of those already though.
These trivial mitigations at least filter out low-effort script kiddies. People gaming the system “for real” will put incredible effort into getting around your countermeasures. You always have to be one step ahead of them.
You still need to automate account creation and setting up of a TOTP token, that’s not “easy” for a lot of people.
With a problem like this eliminating 80% of attackers gives you 80% of the benefit, it's not an all or nothing thing.
Verifying just consists of confirming your email via a one-time token. Setting up MFA presumably just makes sure there's no impetus to hack a bunch of old accounts.
SMS is hard to create large numbers of fake accounts because getting access to large numbers of phone numbers that aren't all in the same block is pretty hard.
Where in the world do they plan to hire people for these rates?
In India, the country with lowest the Big Mac Index as in [1], it would take 6.48h for the human-bot to pay for a Big Mac. And this excludes energy and internet bills and money transfer fees. The numbers just don't work.
I post the above in hopes that you realize captca isn't useful for anything and stop annoying me with them.
I was under the impression these invisible "captcha" were much more difficult since a bunch of metadata just gets scooped off the device and sent in to some proprietary Google algorithm. I'd think it'd be hard for the service to generate enough unique fingerprints to prevent Google from detecting it's the same service solving them but maybe recaptcha just sucks