Hacker News Reader

Comment by throwawaaarrgh | Hacker News Reader

Then we require a phone number for everything (it's not easy to make unlimited new phone numbers) and use OIDC to authenticate to one of a couple providers. You won't be able to do anything on the internet without logging in first, but the login is safe at the identity provider.

If you think about it this is no different than showing your ID to get into a bar.

View on HN

The problem is that this time, it's not a bar, it's just any store (or really, anywhere) you go.

and they're recording your ID number and sharing that with other stores to track your purchases.

I trust any bar more about privacy than anyone on the internet. Their incentive to maximize consent to stalk me and my behavior is close to non-existing.

Phone numbers are a cheap and reusable resource. Pushing the problem on another site with OIDC doesn't help either, if their CAPTCHAs have the same limitation.

"Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database.

Some places might require all that but a lot don't need in-person, id card. And there's also sms verification services that charge you a few cents per verification, and they use "real" numbers.

In the US, you can walk in a T-Mobile store and get a SIM card for cash, no questions asked.

Also once you are sitting on a few dozens phone numbers, you can use them again and again to spam or abuse different services (possibly for sale). It's not like CAPTCHA solutions that you have to do every time.

You'd think so, but no.

I signed up for T-Mobile service early this year with no ID, and paid cash.

The store is so eager to complete the transaction that it keeps a government ID document in a drawer and the sales people whip it out whenever anyone looks queasy about providing information.

I didn't resist giving my information. All I did was pause because I wasn't sure if I brought my ID with me. Even that little hesitation was enough for the clerk to say, "Don't worry about it. I got you covered" and he pulled out the ID.

So I have a T-Mobile account that I can pay for with cash and no ID on file, and someone else's address.

Now, if a government was really interested in me, it could probably pull the security camera video or follow the signal around or whatever. But it turns out that KYC is easily bypassed when the incentives are right.

> Then we require a phone number for everything (it's not easy to make unlimited new phone numbers)

There are services that allow you to verify for as low as $0.03/activation and their stock is massive and diverse so that's not a solution

It is though. It's how every major company validates new customers without captcha.

Reply on news.ycombinator.com