Hacker News Reader

Comment by MrVandemar | Hacker News Reader

> 2. People don't have their phone on them all the time (and some don't even have a smartphone).

I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service.

ChatGPT that everyone is spamming on every discussion? I can't even sign up for it (I'm not really bothered about that; it seems like a dangerous crutch than a useful technology).

The problem is the developers have smartphones, their friends have smartphones, their bosses have smartphones and their clients have smartphones. Everyone they know have smartphones and live in places with reception. So they don't or can't imagine something different.

View on HN

I have a common name, so a ton of people think they have my email address when logging into things. I suspect this triggers 2FA much more than normal as I am constantly logged out of things and have to use 2FA to log back in. Lately I had a pretty funny series of events.

I kept the number from the last country I lived in solely for 2FA of accounts from that country and after almost a year I've managed to change over most things but not all. A week ago I decided to change that physical sim to an esim as I only need to enable it occasionally. I did the process for this, and at the end I got a link to last country's app store. The only way to install the esim is to use this app and it is only in last country's app store. I haven't logged into that for a while so it needed email confirmation. I haven't logged into the associated gmail address for a while so that needed 2FA confirmation by SMS. So I'm now locked out of an email address, apple id, and phone number.

I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time.

Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locked out of my bank, will have to fork out $50+ just to call them, then hope I can convince them I am who I say I am. Then do the dance again next year when they do it again.

Can we all just do authenticator apps?

> outrageous fees for Google FI

Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous?

As an alternative, Google Voice will host your phone number for free. It works with every WiFi connection and even while traveling internationally. Have you considered that?

>Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous?

It's pretty outrageous if you already have a local sim, so you're basically paying google $20/month to only receive SMS messages.

That's interesting, will have to check that out. People have mentioned online sms, which sounds pretty much like what I need.

But yeah re:Google Fi, $240/y to recieve maybe 3 sms is pretty bad imo. And unlimited is only within US.

If you use Google Voice, don't get too attached to the number. They'll reclaim it in a heartbeat for various reasons.

Can't you find a cheap prepaid provider that has roaming access? Since you're not going to be making calls, the balance drain should be minimial, although you still have to top up a certain amount (depends on the carrier) to keep the sim active.

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS.

So by forcing me to add my phone number some services actually decrease the security of my account.

You’re absolutely right on that last part.

Making phone numbers required for signing up was only nominally to improve security. Overall, it’s a net negative for privacy and security, and only benefits the service provider by allowing them to track you (they can buy data on that phone number and create a profile on you) + reducing the number of people calling/emailing them because the user is locked out of their account.

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue.

This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Don't sim cards have PIN authentication enabled by default?

Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.

Interesting... i usually buy prepaid sim cards outside of EU (due to "fuck-you" roaming prices), and every time I bought one, in multiple countries, I had to scratch off the silver "paint" to get to the random pin written on the sim card (the large plastic part, the one that you break of the mini/micro/nano sim from).

Yes, but as I moved between countries and bought SIM cards from many carriers all carrier employees offered me to disable the pin "for convenience". Let's say your phone died, and you put it on a charger. A phone would eventually turn itself back on, but if your sim is locked you. wouldn't be able to accept incoming calls until you unlock the phone and unlock the phone. Without a sim pin once your phone turns on you become available again. People like that.

Also, even if you want to keep the pin on many people would set it to something convenient like 1111 or 9999. In fact, one of the carriers I used had 1111 s a default pin code for all their SIM cards.

So, while security is there in theory, in practice it's rarely in place.

This is the main reason I changed my SIM to an e-SIM

> pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Can they do this without connecting to a cell tower? Otherwise, the carrier would notice the pairing of your SIM to the new IMEI, and further security steps would be possible.

While what you described is theoretically possible, I've never seen any mobile provider implement it. The reason is fairly simple: if you cared about the security of your sim, you'd set a sim pin. If you don't, you don't set a pin. Requiring reauthentication every time your IMEI is going to cause a massive increase in support calls for very little security gain.

>I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service.

Have you tried enabling Wi-Fi calling or switching to a carrier that supports it? At least for my carrier and iOS, you can send/receive SMS messages (yes, the green bubbles) through Wi-Fi.

For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc.

I do still get them from android phones. Its weird, i have no idea why.

>I do still get them from android phones. Its weird, i have no idea why.

If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]?

[1] https://en.wikipedia.org/wiki/Rich_Communication_Services

> If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]?

And, in my experience, Android pushes you heavily to enable RCS; every time you open its messages app, there's a chance that it will randomly ask you to enable it, with a large button to enable and a small link to dismiss the dialog without enabling. I never tried, but I expect that once enabled, it'll never ask again, so it might have been enabled by accident sometime in the past.

SMS 2FA often blacklist VOIP and similar systems to avoid abuse. Try receiving SMS 2FA at a Twilio number, for instance – it’s super unreliable. There are virtually no providers where you can reliable receive 2FA via SMS programmatically, with the exception of a handful of companies who use large banks of real SIM cards.

Twilio has a whole support article on why you probably don't receive certain SMS messages: https://support.twilio.com/hc/en-us/articles/223133447-Not-R...

If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service.

You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).

Lots of services do not offer that ability, especially when signing up.

I have never had a problem with Authy in that regard.

Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.

You are not if you use 2FA.

Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.

Yep, banks are notorious for this.

E.g., ING in Australia.

Unfortunately this point is a bit of FUD about Passkeys (or just off topic). Passkeys themselves don't require internet access. Syncing them across devices might require internet access in the same way that password managers might require internet access to sync across devices.

Living on a boat last year, I had a similar problem: we had internet access, but no phone service. Getting into my bank account, or any financial account, became a righteous nuisance; I had to drive inland until I found cell service, use my phone as a hotspot, attempt to log in, then wait for the SMS. Realize after getting home that there was another bill to pay? Oops, guess you're driving back into town again!

FWIW, ChatGPT asks for your number just as an "are you a human" method. It never uses it for 2FA (at least never for me), so as long as you have service the one time your signing up, you'll never get another OTP challenge.

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

I assume he is talking about SMS. Maybe a virtual SMS inbox is the solution.

> If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network

It might seem surprising these days, but the parent poster might have network access through means other than a phone.

I do :-)

The only reason I have a smartphone is because many services (especially government services, like tax and the NHS) require a mobile phone so you can receive SMS. It's like how the government used to produce documents as MS Office files; they were forcing the public to go along with their choice of software company.

Most government docs are now PDFs, happily. But forcing people to choose between Android and iPhone (or forgoing service) is pretty nasty - these devices are expensive.

Then use that other device for the auth flow? I'm not surprised by that, but am surprised by your implication that it would still involve your phone.

In rural areas you can be in an area where you have a gigabit fiber connection and no cell service at all. Wi-Fi calling being added to the main carriers has been a game changer for rural access.

This really shouldn't have to be said, but wired internet and cellular internet are two different things.

This an excellent example of the assumptions that are unknowingly carried by many developers.

Every company's customer base is going to look different. This requires research, and developer empathy and life experience cannot substitute for research.

> it seems like a dangerous crutch than a useful technology

Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”.

I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.

> Hallucination is a separate problem, which is solved by using fine-tuned models.

They won't solve the main cause of hallucination: prompt has zero connection to generated text other than probability.

ChatGPT do not generate answers, it comes up with something that looks like an answer. There is a good chance it is the answer, but you can't guarantee it.

I believe this particular problem won't be solved, unless researchers teach machines how to reason. But then we would have greater concerns than hallucinations.

Yes, but pattern matching and probability will solve for the vast majority of usecases. Heck, it already works quite well and offers value.

I don’t need 100% truth, because reading multiple docs myself and piecing things together has tons of potential pitfalls too.

To quote Hofstadter:

I frankly am baffled by the allure ... of letting opaque computational systems perform intellectual tasks for them. ...when it comes to using language in a sensitive manner and talking about real-life situations where the distinction between truth and falsity and between genuineness and fakeness is absolutely crucial, to me it makes no sense whatsoever to let the artificial voice of a chatbot, chatting randomly away at dazzling speed, replace the far slower but authentic and reflective voice of a thinking, living human being.

https://www.theatlantic.com/ideas/archive/2023/07/godel-esch...

Reply on news.ycombinator.com