Hacker News Reader

Comment by TMWNN | Hacker News Reader

>Caution: never use eSIM with your real phone number; always get a new phone number just for use with eSIM.

Yet again, having ported my phone number to Google Voice (GrandCentral back then), and never giving out whatever my current SIM's phone number is, pays off

View on HN

"Yet again, having ported my phone number to Google Voice (GrandCentral back then), and never giving out whatever my current SIM's phone number is, pays off ..."

Agreed.

My phone number lives at twilio and I couldn't tell you the physical phone number on my SIM card ... I have no idea what it is without looking it up.

In addition to the obvious benefits of never caring whether you lose your phone or being vulnerable to a SIM swap there are other "telco superpowers" that come along with this arrangement:

- I can text you, from my number, from the command line (curl API)

- I can lose my phone and still send and receive SMS (again, curl API)

- I can "sanitize" incoming text messages to ascii-256, block attachments, block or alert on silent SMS, etc.

- block lists for incoming voice and SMS

- CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice).

Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A:

https://kozubik.com/items/2famule/

>- I can text you, from my number, from the command line (curl API)

For SMS, Google Vooice both sends to and receives from email. I have a cronjob set up to `mail` a TextNow number that needs activity every 28 days to stay alive.

>- CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice).

Oh, I like this. I tend to delete most of my SMS-via-email, and the texts are always searchable in my Google Voice account, but can definitely see the appeal of always archiving all incoming texts with my mail so that I can use `mairix` for search.

>Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A:

Nice. I do use my phone's SIM (now eSIM) number when (and only when) 2FA won't take Google Voice, but if I decide that is a meaningful security flaw, your approach would work.

Speaking of telco superpowers, I don't know if Twilio lets you do this but Google Voice has always supported voice calls by browser. The only time I make or answer a phone call on my phone is when I am away from my computer. When iOS 8 appeared, I'd enjoyed the equivalent of Continuity for years.

How does this work? I thought GV and other VOIP numbers are becoming universally blacklisted by everyone because "sekhurity".

It’s funny, I ported my number to Google Voice, two years later I got kicked off Zelle because VOIP numbers are banned. So how do I send and receive money? Sign up Zelle with email instead. Yes, a VOIP number is a security threat (never mind Wells Fargo has known everything about me financially since forever), but a random email address is A-OK.

I can get SMS "security" codes from most services to my google voice number, but one of my banks just flat out refuses, and let me tell you it can be a huge pain in the ass if a few circumstances line up so that you cannot receive a "security" clear-text msg on your approved phone.

Sending SMS costs $$$, and the gateways are closely-guarded. There are bad actors hammering on logins to elicit SMS codes, and Zelle is charged for the service according to that volume.

There’s no separate Zelle login, and Wells Fargo proper hasn’t banned my phone number, so this explanation makes no sense whatsoever.

Zelle is a separate company that likely operates its SMS sending system separately from Wells Fargo.

There are a few stupid sites that ban VOIP numbers, but thankfully it's still very rare. The vast majority (like 90-95%) accepts just fine.

Source: GV user since Grand Central days.

I had a big carrier number that I later transferred to google voice and I've never had any issues with it since.

I have a ton of accounts. The only ones I know of actively blocking it are Elan Financial(credit card servicer) and maybe Chase. Not sure on Chase, it doesn't block it, just doesn't seem to gets msgs for 2fa.

Everything else (including paypal, fidelity, schwab, sofi, discover, capital one, to name a handful) work fine.

Your act (of going presumably SIM-less) has increased the surface area of attack on your own line by at least a thousand-fold over traditional mobile phone provider but still (probably barely) safer than eSIM.

The Internet is more harsh than telco backend infrastructure.

Genuinely curious about why you believe that. Carriers are notoriously sloppy with handling SIM swap attacks, while Google is notoriously hard to get into an account (even your own, if you happen to lose your password or 2FA).

One word: Backend.

> "One word: Backend."

Sorry, I still don't get it. Telco's backend is a mess. It has a profusion of processes and frontend systems for customer service teams to interface with user records, which creates all sort of loopholes. Any sufficiently motivated attacker can pull a SIM swap attack, as it happens frequently, and the weak link is always a variation of: a clueless agent somewhere trying to help a poor "customer" who dropped their phone in the toilet, and needs to urgently to recover the number.

Or are you suggesting that Google's GV backend is riskier than the carriers?

Actually, let's not mince words. SIM swap attacks are also enabled by literally criminal employees getting paid by other criminals for their access to the telco system.

Reply on news.ycombinator.com