Hacker News Reader

Comment by masspro | Hacker News Reader

They don't care. Source: got swapped on TMo, front-line CSR fixed it but no one else at the business cared; would not even refund my final bill. Solution: move to Google Fi. It has a word-of-mouth reputation for being resistant to this, which I believe if nothing else because Google has almost no human support to bribe/phish.

View on HN

Google Voice too. No human tech support. It's kind of weird how having no human to talk to can be a good thing in these high security matters. No social engineering attack surface.

I've just realized that, even though I've used Google Voice as my primary phone number since before it was Google Voice -- for about 18 years now -- I have never really had a problem with it[0], and I've also never paid a dime for it[1].

It seems like a well-oiled machine.

0: Well, some places don't like using GV for 2FA (and demand a "real" cell phone number), and some other places don't think it can do short-code messages at all, but those aren't issues that anyone at GV could ever solve even if those people did exist.

1: Yeah, sure. I'm the product. Blah blah.

> I've used Google Voice as my primary phone number since before it was Google Voice

I've still got my .10 Grand Central introductory credit.

I use Google voice as my main number on my Pixel, but also on a burner phone to harass overly aggressive recruiters. When I set up Google voice in the burner it made me load it with credit but surprisingly all the calls and texts I've made with it are free.

GV numbers are in some database as being VOIP. If there was some there that could do something, they could get the numbers out of that database.

Do these databases see through number portability, or are they just verifying that the area code + prefix is assigned to a traditional telco?

Because you can port a landline to Google Voice for $20, and, in my experience, random Internet "phone number lookup" sites still show it as a landline years later.

CNAM is the database you're looking for, maybe LIDB too. Once you port the number the CNAM should change.

The number gets classified differently in the "official" phone number database when you port it to a new carrier, including Google Voice. I used to have my US number in GV but ran into a lot of the 2FA issues as as well as trying to use it overseas extensively. Eventually, Google will figure it out to the point where it is no longer tenable to try and keep working around it. I caved and bought a $5/mo eSIM plan from Tello. They don't seem to care that I'm not in the US 10 or 11 months out of the year. I can use wifi calling to send/receive texts for 2FA for free, and iOS even supports using the data of one SIM/eSIM as the "wifi" for a different phone line also present on the device. So even if I'm out, I hop into settings, turn on the second line, it uses my EU data plan to fetch new messages via "wifi calling" and then I get my 2FA code or whatever. Takes about 30 seconds in total.

Is it the most convenient thing ever? No. I have an older iPhone because I'm a cheap bastard so I turn off the other line when I'm not using it, otherwise it will constantly look for a compatible roaming signal which it will never find because I have not authorized any international charges on that account (battery drain).

Many services won't even text 2FA codes to voip numbers, google voice included.

Some may call, most not even that.

Its more of a recent thing, but I am a little worried about how common it is becoming. I've used my GV number since atleast 2007 for everything.

My bank accounts at banks I like have never complained about my Google Voice number and still don't. My bank account at Bank of America had some security check I needed to complete at some point and my Google Voice number that had been in their system for a decade I was told was not eligible anymore and I needed to actually use my real phone number.

I could almost put up with it if it was for things that need to be secure, but my 7-11 rewards account rejected my phone number at the gas pump a few years ago and Target rewards also started blocking my GV number.

Sometimes, it's like neither loyalty nor consistency nor history actually mean anything.

"I have cheerfully been using your service in this exact same way for seventeen years."

"FUCK YOU! GET OUT!"

Things are pretty stable because Google Voice has barely changed in the past decade, but when things do go wrong there's no one around to look into it.

There was a time many years ago when Google Voice would intermittently fail to ring or even forward calls to another number when I tried that, and then give no indication that a call was ever made to your number that you missed (I verified it by asking when people I knew called me and said I never got back to them), which is pretty bad when you're expecting to receive important calls sometimes. This went on for months. I received bare minimum support which didn't even come close to helping the issue even though my issue was voted to the top of the support boards because many other people were having the same issue at the time. I'm glad you personally haven't had an issue but you should be prepared to have one at some point and get essentially no help.

what if you lose access to google voice yourself?

There is usually a way to get into your own account. It’s just harder than fibbing to a customer support agent in a chat box.

Imagine making a mean comment on YouTube and losing access to your bank account (everything runs on SMS 2FA)

No human to talk to, no appeals process. Don't trust Google, they are indifferent.

My class read a science fiction story in CS about a guy getting executed on death row for a late library book in a comedy of errors where a series of automated systems glitch out and a detached bureaucracy is slow to react. Or something like that.

I feel like it should be required reading to protect against "automate all the things" hubris.

Sounds somewhat reminiscent of the Terry Gilliam film Brazil. Basically a fly dies and gets caught in a teletype machine, causing the name on an arrest warrant to be misprinted. This snowballs into all sorts of darkly humorous and depressing hijinks.

Literally a bug in the system.

Do you remember what it was called?

I had a fuzzy memory of this story from years back, and recently stumbled across it recently on Wikipedia: https://en.wikipedia.org/wiki/Computers_Don't_Argue

Basically a modernized version of the premise of "The Trial" by Franz Kafka. An unknown authority charges the character with a unstated crime and bureaucracy chugs along on errors and assumptions.

I think this is one of the reasons that Google Plus failed. It's like if North Korea set up a social network. Nobody would post cause post the wrong thing and get executed.

If you see what people post with their real name on newspaper comments, Instagram or Facebook it‘s clear that people don‘t care, or don‘t think that far ahead.

Google Plus failed for many reasons but I doubt that one was a big factor.

That’s a real reason I don’t comment on YouTube or risk using any other Google services except Gmail and Voice.

God forbid I chargeback a purchase on Google Pay (or whatever their PayPal is this year) and trip some anti-fraud system that locks me out of my 20 year old email account. We all know their support is either automated or nonexistent, so it’s not worth the risk.

Today it's commenting, tomorrow it might be watching a few bad videos

> locks me out of my 20 year old email account

And you effectively can't even run your own system, as has been discussed here many times.

But there‘s many providers that you pay actual money to (Like Fastmail) and if something goes wrong you, as a customer and not a potential ad target, are their top priority and you can call a human on the phone.

Exactly, vote with your dollars. Email is important and worth paying a few bucks a month for solid service.

Oddly enough, the EU isn’t racing to bust down the door of these “gatekeepers” and require third-party interoperability with this socially-critical service.

Pretty much just an apple thing as far as I can see.

switch to Fastmail or literally anything else :)

It's crossed my mind, but would require more effort than not commenting on YouTube or using Google Cash

You can have multiple Google accounts. Just make sure you use app-based 2FA on each so you don't get locked out.

The downside of course is if you do run into a problem, you have nor recourse.

I've mentioned this a few times and don't feel like restating it but if you're curious about my "i was locked out of every single Google service for "fraud" that I didn't commit, don't know what they were talking about, and never got a single response even after sending them my drivers license multiple times to prove my identity" story it's somewhere in my comment history.

It's probably a tiny chance it happens to many people but it's something to consider. I had nobody to talk to. No store to go to. I lost cell service for a week until I migrated everything off of google.

Just something to be wary of.

edit: I tried to dig it up it's about a year old and .. oof yeah i'm not going through pages and pages of paginated yn comments. Moral of the story is what I said above

https://news.ycombinator.com/item?id=36336256

This one seems to fit. Happy I've never had reason to write one like it.

lol That's it. Thanks, you're persistent!

Lazier than you think! You almost nerdsniped me into seeing how fast I could whip up a crawler but then I checked the search and found out it can find comments and use a custom date range.

https://hn.algolia.com/?dateEnd=1700092800&dateRange=custom&...

deletes entire account

This is less traumatizing than when I found irclogs of me from 10-14 thankfully.

My main problem with google fi is that I also use gmail heavily, and if the algorithm decides to cut me off one day for some reason, I don't want to lose access to my primary phone number and primary email address at the same time.

Still seen swaps with Google Fi. Efani is a much better option if you actually want protection. I am a cyber lawyer and that’s our recommendation to any clients who care. I can’t recall if Efani is throttled on AT&T or Verizon as MVNO, but one isn’t. Easy to ask them.

> I can’t recall if Efani is throttled on AT&T or Verizon as MVNO

T-Mobile blocks my Google Voice calls. They have to run inside a VPN.

>Efani is a much better option if you actually want protection

Their website says it's $99/month. That seems a bit steep to me considering all they're providing over a regular provider that charges $29/month is that they do a bit more verification when you claim that you lost your sim. It's not even clear whether they protect against a port-out attack, which is probably worth worrying about as well.

Presumably Efani accomplishes that additional protection by maintaining a human support staff they put more resources into training than the average carrier. That's expensive, especially when you consider that it's a relatively niche service (so small user base to amortize that cost over) and presumably only used by people that really care about sim swaps, likely because they are frequently targeted for sim swaps, and thus the training needs to really work. They also have no other lines of business like device sales/financing that could help cover those human operational costs.

That, plus the fact that it's a premium service that is mostly only useful to higher net worth / higher income people, makes it seem reasonable that it would be quite expensive relative to a regular provider.

>Presumably Efani accomplishes that additional protection by maintaining a human support staff they put more resources into training than the average carrier. That's expensive, especially when you consider that it's a relatively niche service (so small user base to amortize that cost over) and presumably only used by people that really care about sim swaps, likely because they are frequently targeted for sim swaps, and thus the training needs to really work.

According to the BLS "Computer User Support Specialists" get paid $30 on average[1]. Whatever training they give to staff to resist sim-swap attacks, I can't imagine they can't be more complicated than the certifications that "Computer User Support Specialists" have to get through, so I think it's reasonable to model their support costs at $30/hr per person. With the premium they're charging over a budget MVNO they can afford two support people per customer. How many fraudulent sim swap attacks could the worst client possibly attract? Is it really that hard to train someone to deny sim swaps until they go through 11 steps of verification like their website says?

[1] https://www.bls.gov/oes/current/oes_nat.htm

>That, plus the fact that it's a premium service that is mostly only useful to higher net worth / higher income people, makes it seem reasonable that it would be quite expensive relative to a regular provider.

I mean yeah that's the more reasonable answer. It's a luxury product and priced accordingly.

Doesn't Google Fi use T-Mobile's network as an MVNO? Are they insulated from this kind of thing still?

Same goes for Mint mobile. They are/were an MVNO now owned by T-Mobile. I have no reason to go into a store since the service just works and I never do much but confirm auto-pay is working. Looking at the site now, it's been T-mobilized with stuff like carrier-locked phones but otherwise I've seen no meaningful changes.

What were they after?

Reply on news.ycombinator.com