Hacker News Reader

Comment by stephengillie | Hacker News Reader

I would like to see a customer service/tech support org where customers have to enter their 2-factor PIN at a phone menu before reaching a human support agent. You could possibly combine that with caller ID for better verification - basically use phone # like a username and the PIN as password.

Or you could just use them alongside other verification steps.

View on HN

What if they've had their mobile phone stolen and can't do 2-factor auth and that's why they're calling?

Security traded for convenience, back to square one.

Isn't this scenario why Gmail's 2-factor authorization gives you a set of one-time passwords?

What if you lose them?

At some point, there has to be a way to get back into your account. Probably, going through slow and hard to hack methods like the postal system.

Well, continuing to use Gmail as an example, there is an account recovery system, which IIRC asks for a bunch of details to try and determine if you are the account owner (account creation date, names of labels used, etc.) If Google or a third party would provide a list of these details, then you could collate that info as additional insurance against your posited scenario.

There's inevitably going to be someone who loses them or never prints them out in the first place.

BofA does this for teller transactions. To talk to a teller, you have to swipe your debit card and type your PIN. While not foolproof, I think it's a pretty nice security measure.

If you don't have your card with you, however, you can provide photo ID and they'll look up your account number. I suppose it would be possible to provide a forged photo ID to gain access to someone's account.

You would also need to enter your username or email address, though, and that's hard to do over the phone... I guess voice-to-text is improving, so that might be an option.

You don't have to actually enter your email address, you just have to prove that you know it - and telephones have the full alphanumeric set of characters on the keypad. Use a * or # for special characters, and something like "pavel@lishin.org" could be entered as "72835#547446#674".

Edit: I guess that may not be sufficient to identify you, but it could verify that you are the account holder for other services.

Some people have 20+ character long email.

You really think they are going to be happy about sitting around typing that in on their phone hoping they don't make a mistake ?

My cell phone (Pantech 5000) has a qwerty keypad. It doesn't have the old rotary phone style letter-number association. I know many people whose phones don't have this.

Ok, but you can't do dtmf with querty, so its use in a call center is somewhat less important.

With standard numbers, you could use any touch tone phone.

What I mean is the map of 2 to a,b,c is fading fast. I can't figure out how to dial 1-800-CALL-ATT by looking at my phone, much less my email address.

Voice to text works fine for limited input. So if all you needed was the letters of the alphabet (rather than words) it works pretty well.

GoDaddy essentially does this - but you have to give the human the PIN. Also, most banks do this as pointed out (fwiw, I bank with USAA and I have to call from a registered phone number and enter a pin before reaching a human.)

Reply on news.ycombinator.com