Hacker News Reader

Comment by pete5x5 | Hacker News Reader

A month ago I had a call with Twilio sales / onboarding to consider switching to them from our current IP phone provider. Ironically, I was unable to complete the process because my current work number, which is IP based, would not pass their "put in your number so we can make sure you're a human" verification test because IP numbers are not supported.

I do [edit: NOT] use my personal cell number for anything for security reasons, so even after their insistence that it was safe to use I refused and therefore I was unable to get past the first step of the signup process and went with another provider. After reading this I am feeling validated that I didn't cave.

View on HN

Just ask twitter about it... They will tell you you're a bot unless you pony up a "real" phone number, and then they get breached and tell people: sorry you will get doxed now because we lost your data, but you shouldn't have used your real phone number[1].

[1] "If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account."

https://privacy.twitter.com/en/blog/2022/an-issue-affecting-...

"They will tell you you're a bot unless you pony up a "real" phone number ..."

This is my 2FA mule:

https://kozubik.com/items/2famule/

There are others like it, but this one is mine.

While I consider this a very elegant solution, I find it hard to justify paying $8/month for a cellphone plan because others don't do their homework.

Yes, but because so many others don't do their homework, you have to take it upon yourself to protect yourself. $8/month does seem like a stupid fee to pay, but for those willing to do it, it isn't that much. Those kinds of companies may even have a pay for 12 months in advance and it get a lower rate.

What I suggest if you have the opportunity to go anywhere south of the USA is buying a 2$ claro SIM chip and putting 2$ on it at least once every 3 months or so in order to maintain it (Can even maintain payments over the internet as long as you can understand the Spanish website). This makes the monthly cost around 66 cents a month/$7.92 a year for an SMS verification mule, and it will receive texts anywhere that has GSM band 1 without having to activate roaming or anything expensive like that.

Is there a way to automate this? I would be afraid of forgetting to top it up and then having the whole thing fall apart. Personally, it is worth $5/mo to me (Tello's cheapest plan: no data, 500 voice minutes, unlimited text) to not have to deal with manual payments.

I dunno about automating this but I have a calendar for that

> I find it hard to justify paying $8/month for a cellphone plan because others don't do their homework.

Whenever I hear things like this, I like to remind people that they should be most concerned about outcomes, not about what satisfies their indignance. I agree that this situation is ridiculous, but being mad about it isn't going to change the state of the world. If you're genuinely worried about giving out your primary phone number for 2FA or account verification purposes, then this is a solution for you. Being pissed at companies for leaking data is not a solution.

You are absolutely right, and it's definitely a rational choice to give in and buy a dedicated cell phone plan for this purpose.

To my defense, I didn't argue that being pissed at some company would solve anything :)

Could do it cheaper with some more obscure MVNOs https://prepaidcompare.net/

you can provision in API/IP-enabled "mobile" number through a provider like Twilio or competitors, do everything in software (or do nothing regarding custom software and just enable SMS forwarding in the provider's UI), and pay fractions of pennies per SMS, plus a monthly fee for the number like $1.50.

See my comments elsewhere in thread, but a "VOIP" number is a ridiculously tiny corner case in the world of telco, hence lack of support.

I wish this were the case - believe me, I have tried many different API provided phone number endpoints and they are discriminated against by banks, google, etc.

In fact, twilio even started offering special numbers that are flagged and "vouched for" that should be treated as non-VOIP ... but they aren't.

If you really need it to work, it needs to be a number from a physical SIM card.

Unfortunately, many services have started blocking any number not currently associated with AT&T, T-Mobile, Verizon or a major regional carrier. Even legitimate 'mobile' numbers from tiny carriers and MVNOs are getting blocked.

Nope. I had a "burner" voip used for providing to retailers/etc who wanted a phone number for no reason. I would migrate the number yearly. Unfortunately those are now rejected.

This is clever. Don't mind if I borrow your idea. I wonder if I can automate the setup...

My first thought was "paying for a second SIM just for that sounds like a pain", but then I read to the end and saw that you're using a service for $8/mo. Had no idea such a thing existed. I clicked through their plans, and it looks like you can reduce that down to $5/mo if you ditch the data plan and select 100 voice minutes / unlimited text. I figure for such a device, you can just connect it to wifi, and don't need a data plan.

I guess it's nice to have the backup, though, in case the local internet connection goes down. The 500MB/mo plan bumps it to just $6/mo.

I'm a fan of US Mobile personally. They let you make a custom plan that has ONLY sms, so you don't pay for what you don't need. Can also add minutes at will for $1. Bonus of choosing the underlying carrier.

Are you not worried that permanent, 24/7 connection to the charger, will destroy the battery, make it blow up, swell, or something in that line?

Modern phones have overcharge protection, as long as that's in tact (no reason to think it wouldn't be), it'll be completely fine. The worst that might happen is your battery capacity will degrade slightly faster than it would otherwise.

It's Lithium not Nickel-Cad

$8/month is ridiculously high for what you're doing with that. You're effectively paying over a dollar per text message?

I kept contacting support every time my account got blocked for not providing a number stating that i refused to provide a phone number. I think after the second or third time they decided i was human and haven't had a block since.

Recently I got an email receipt for event tickets that I didn't purchase. Looking at my credit card showed no transaction, so it was probably just a case of someone entering the wrong email address while checking out. The receipt happened to include a phone number, and I was about to text this person to tell them about the mistake when I realized that this would be a great way to insidiously associate an email address with a phone number. The iMessage hacks demonstrate that this would be a great vector for someone in possession of some 0days.

Realistically, was I being targeted? No. But it's a sad state of affairs that I have to even think about such things. I ended up looking up the company online and finding their contact email address to let them know about the mistake, so they could contact the person directly (which they did, and thanked me).

You mean you do not use your personal cell for those things.

Good for you. Your refusal and my refusal protect one another, refusing collectively is stronger than refusing alone.

Good catch, edited in the *not*. I agree, if everyone refused then it would change. I asked them what would happen if I tried to use a Twilio number to verify, but they did not seem amused by the irony.

I refuse to give my mobile number, or use my mobile number for anything. SMS auth, main contact, anything.

My SMS spam is almost non-existent, compared to others.

But one thing, beyond my desire to not give out my number... it is pointless regardless.

When I worked in office, I had mobile access. At home, a bit rural, my access is nil via 4g/5g. I just have no access.

My mobile forwards after 6 rings to my voip, so that works well. But for SMS auth? Hello! I cannot do that!

I have been an ebay customer for 21, yes 21 years. I can no longer log in, as they now insist I enter a mobile number to continue.

Gee thanks ebay.

(No, SMS won't work via voip, they check numbers, even ported numbers)

21 years. Years of thousands, even >10k spent reliably per year.

Gone as a customer.

Calling paypal support, results in people literally unable to understand ... anything. They repeat a mantra off their screen without deviation. Many cuatomer support people I spoke to, were barely paying attention.

I really don't get it. SMS is barely secure to begin with.

They are willing to throw away accounts, just for pennies on tracking.

21 years.

voip.ms have SMS support: https://wiki.voip.ms/article/SMS

It does say that short number support is not guaranteed, though.

eBay and etc all ban these. It's not a "supported" issue.

And you know this for a fact? Because you tried it out yourself? Right?

Somehow, even though you say they ban them, I was able to submit it and get a verification message. Funny how that works, when someone just parrots the same thing without actually trying it out.

Proof: https://imgur.com/a/75yKkFl

Yes. I had to close my eBay account last year. They would not take my Google Fi or non-voip.ms VOIP number. Using my VOIP number also immediately got my Twitter account banned before making a single post.

It's annoying as hell because I would very much like to sell a thing or two and don't have many platform choices.

> The process to close the account may take up to 30 days from this notice. eBay will send a message to the email address registered on file, confirming that the account has been closed and, unless on hold, restricted, or suspended, that data associated with the account has been deleted.

I am curious if it is because they care slightly less if it's a CA VOIP number, if it came from a decent pool of numbers, or something else. Or if they will lock you out later and force you to contact the "risk assessment" team and use this as a datapoint.

See my sibling comment about having a mobile number without a mobile phone

> I am curious if it is because they care slightly less if it's a CA VOIP number, if it came from a decent pool of numbers, or something else. Or if they will lock you out later and force you to contact the "risk assessment" team and use this as a datapoint.

Interestingly it's an old landline number that got ported over to voip.ms, so you'd expect that if it were trusted due to reputation, it'd also only be accepted as a landline. Yet the validation experience has no problem with it.

I think this might be related if it was a port. My numbers from Twilio and other services are all either Bandwidth or Onvoy or Peerless and refused (all of these are basically pure VOIP and have no reputation of landline or mobile).

Just FYI you don't need a mobile phone to have a mobile number:

* Numbers are generally designated when they're created by regulatory agencies as "landline", "mobile", "VOIP", etc.

* You can provision yourself a mobile number in a provider like Twilio or a competitor if you don't like them, and it will have all the capabilities you want

* Thanks to technological advancements, you can do things like overlay mobile capabilities on non-mobile numbers, but only if you're running all of the traffic through a company that has that tech

* "VOIP" numbers are a vanishingly small corner case for these companies and are a pain in the ass to support. They are a tiny portion of the numbering space and lots of smaller Telco companies just won't complete calls or texts to/from VOIP numbers. Companies like Twilio rely on those smaller companies for last-mile completion or origination of calls.

TL;DR Provision yourself a "mobile" number using an API-enabled SaaS telco platform, which you can use exactly how you want, no actual mobile phone needed, with all the capabilities you want. The "VOIP" number will only continue to cause you more and more issues over time.

I've had an ebay account nearly that long, but I hardly use ebay after it became whatever it became. To the point, ebay recently sent me an email saying that they were going to close my account for lack of use. se la vie

Just for future reference, the proper spelling is “C’est la vie” (French)

i actually googled that, and it c'est was not returned and i got a bunch of se. whatchagonnado?

...stop using search engines that tailor themselves to idiot queries more and more every year?

Similar experience when Twilio started requiring SMS 2FA. I offered to use U2F or TOTP, but no, it must be SMS.

I don’t have a work number and this is an absurd reason to get one, so we just canceled the account.

That's strange. I have TOTP 2FA on my Twilio account. AFAIK there is no requirement for it to be SMS.

Twilio Support:

> We're aware that some users would much rather prefer not to use SMS for 2FA usage […] this is a known issue

> Please be noted that as of right now, you can only access [TOTP] after submitting a valid phone number. If possible, we'd recommend you just provide a personal phone number as a workaround

I’d already borrowed a coworker’s phone once for the initial account verification, but requiring it multiple times crossed a line.

They've even started requiring this for their subsidiaries, like Sendgrid. It's very offputting.

> After reading this I am feeling validated that I didn't cave.

The /r/twitch subreddit is full of people who think you should absolutely give twitch your phone number for verification (fun fact: Twitch doesn’t even allow you to turn on 2FA until you give them your phone number). Even when a few days later, twitch got their data leaked, they’ll reaffirm that you are an idiot for caring.

And those are users, not even companies.

While I fully approve not using your phone, the company should issue you one, what is the security benefit of not using a personal phone? It's not really different from a company phone.

You can treat a company phone as adversarial (e.g. leaving it at home or on airplane mode) without impacting your normal life. An MDM solution can usually get real-time location information, not to mention potentially access other personal information. And your real number should not be associated with work things as a matter of course, in my opinion.

Reply on news.ycombinator.com