Hacker News Reader

Comment by Jordrok | Hacker News Reader

Yet another reason why requiring phone numbers for account creation/verification is an awful, user-hostile idea. I've always hated services that do this.

View on HN

Facebook pressured people into adding their phone number under the guise of account safety, however, their true motive was to harvest phone numbers.

As far as I'm concerned it's not only user-hostile, but deliberately malicious. Moreover, there's no excuse for services to use phone numbers for 2FA.

It’s actually to reduce trolls, bots, etc. the easier it is to make an account the lower quality most accounts will be.

Yep. “Suspicious activity detected, please add a mobile number to confirm you’re account” 24h after creating a new account like clockwork.

Microsoft did this when I signed up to play Halo Infinite. I had a few hours of play time doing nothing at all suspicious and deleted the game rather than give them my phone number.

Not nearly as bad in my book as the despicable people who haphazardly give access to their contacts. I don't care if you dox yourself.

Yes, though least it's a free product. Now imagine MS doing the same trick with paying customers who spent at least $30 thinking they'd get to own a copy of Minecraft.

Not only that, but their Android apps all do their very best to convince folks to allow access to their phone's contact list as well. Even more phone numbers for the "All Seeing Eye of Zuckerberg's Giant Database of Everyone™".

One reason many well-meaning security teams want mobiles is that phone numbers "cost" money for (most) attackers to create but do not create much additional burden for (most) legitimate users.

In a sense they are used as a kind of "hashcash" to raise the cost of fake accounts.

You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range).

It's also something the service provider has to do and I can't verify as a user.

> You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range).

So store two hashes, one being the whole number, another being the number excluding the last 2 digits. These aren’t difficult problems to solve. The bigger issue is that they’re not revenue generating solutions, but rather the opposite.

Genuinely curious - what's a better way to verify accounts aren't bots?

Sell a service rather than sell your users and suddenly the bots are far less of a problem. In essence make users pay, bots will become shy

Allow bots but also give users the tools to filter out bots that Twitter keeps to itself.

there isn't one. but that's irrelevant because the services that require your phone number don't do it for the sake of security or to combat bots, they do it to gather data. when you give a megacorp your phone number, they get your real name, your relationships, and a myriad data points to sell.

this is the reason why all megacorp mobile apps and every other free flashlight/calculator/alarm app require access to your contact list.

>but that's irrelevant because the services that require your phone number don't do it for the sake of security or to combat bots

Discord allows you to enable phone number verification at a per-admin level basis; and it is done to reduce spam and bots. You can't just pretend the problem doesn't exist.

Twitter is at least partly asking for phone number in order to fight spam. I am aware a big motivator is also to link you to an advertising profile.

twitter is a great example of phone number verification doing fuck all against bots

yes, that’s all great, but it goes out of its way to ignore the very _very_ real problem of malicious users and bots.

i’m a privacy junkie, but we can’t just handwave those away and pretend they don’t exist.

You send out a mass DM asking if this account is not a bot to not respond.

Just kidding but this happened to me when I used IRC back in around 1993-1994. For some reason I would respond anyway and would get banned for a time.

Captcha's, rate limiting, slight changes to the way you interact such as changing words, changing positions, etc.

This is a solved problem, but these things create friction for the user. And friction is the opposite of what modern tech says you want to provide to your user.

Get them to endlessly scroll, comment thoughtlessly.

I don't mean to suggest the burden is on you to provide one, but what alternative even comes close to requiring a phone number for account creation... perhaps a credit card authorization?

Reply on news.ycombinator.com