5 ms·

I just went to see what my recovery options are for my phone provider's portal. It creates a temporary password that it's sent to your phone through SMS so you

by josu 10y ago

I just went to see what my recovery options are for my phone provider's portal. It creates a temporary password that it's sent to your phone through SMS so you can access your account. This makes sense, since the only way to gain access to your account is either cracking your password or controlling your phone. I have no idea why Verizon would give access to the account through a voice call, instead of sending an SMS to your phone number. I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. If you were to find yourself in that situation, Verizon's position should be: OK, first sort out the phone thing, this is, go to a store and get a new SIM card and/or phone, and then we'll reset your account.

zeveb 10y ago
> I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. 'I just lost my phone, and I haven't logged into the portal in years. All my passwords were on my phone. I'm out of the country/in the sticks and there is no Verizon store nearby.' Yes, Verizon's response ought to probably be something like, 'go to a Verizon store where an employee will verify your identity,' but that of course means trusting many more than just call-centre employees to verify identity; it also means that a government identity-card issuer would still be able to covertly reset one's number.
- josu 10y ago
  > it also means that a government identity-card issuer would still be able to covertly reset one's number. Sure, but that seems like a much greater crime than just impersonating somebody on a phone call, plus greater exposure and chances of getting caught. > and I haven't logged into the portal in years. My point is exactly that, in which situation would you need to urgently access your portal?
  - zeveb 10y ago
    > My point is exactly that, in which situation would you need to urgently access your portal? The lost-phone situation: the number-owner has lost his phone, has bought a new one and wishes to change service immediately. It's not at all unlikely, and is likely to be perceived as urgent (I certainly wouldn't want all my account access messages going to a lost phone …).
    - hx87 10y ago
      > I certainly wouldn't want all my account access messages going to a lost phone … Wouldn't that be solved by a fail-deadly setup where your phone is automatically wiped unless you perform a specific action?
      - zeveb 10y ago
        That particular issue, yes — but it wouldn't help me set up a new phone.
- kalleboo 10y ago
  I thought a significant portion of Americans simply don't have ID as well? (or voter ID laws wouldn't be controversial)
  - Kadin 10y ago
    The bar for "allowed to vote" is very different from "allowed to reset a cellphone account". One needs to never block any legal voter from voting, the other can be a balance between ease of access and ease of fraud. I would be very cautious conflating the two cases, because they are very different.
    - 21 10y ago
      So what happens if as a non-US citizen which just happens to be around voting day I enter a voting station and ask to vote (and obviously lie about my identity)
      - hx87 10y ago
        You'd have to know who to impersonate, successfully impersonate them (i.e. good luck trying to impersonate DeWayne Jamal Jones as an Ukrainian) and where (and on what date) they are supposed to vote, and for all that work you have affected all of one vote.
      - bhandziuk 10y ago
        You'll probably get to cast a vote. But this is so rare. The rate of true voter fraud is so exceptionally low and the kind of fraud that voter ID laws are supposed to stop is even lower still that it's just not worth it.
      - toast0 10y ago
        In order to cast enough votes to affect most elections, you would need a large number of votes. The more fraudulent votes you cast, the more likely you'll hit a voter that already voted. If there's a significant volume of double vote attempts, that's a big red flag.
      - 10y ago

by josu 10y ago

zeveb 10y ago

> I really can't think of any situation where you'd forget your password and also not be able to access your phone, while urgently needing to get into your portal. 'I just lost my phone, and I haven't logged into the portal in years. All my passwords were on my phone. I'm out of the country/in the sticks and there is no Verizon store nearby.' Yes, Verizon's response ought to probably be something like, 'go to a Verizon store where an employee will verify your identity,' but that of course means trusting many more than just call-centre employees to verify identity; it also means that a government identity-card issuer would still be able to covertly reset one's number.

josu 10y ago
> it also means that a government identity-card issuer would still be able to covertly reset one's number. Sure, but that seems like a much greater crime than just impersonating somebody on a phone call, plus greater exposure and chances of getting caught. > and I haven't logged into the portal in years. My point is exactly that, in which situation would you need to urgently access your portal?
- zeveb 10y ago
  > My point is exactly that, in which situation would you need to urgently access your portal? The lost-phone situation: the number-owner has lost his phone, has bought a new one and wishes to change service immediately. It's not at all unlikely, and is likely to be perceived as urgent (I certainly wouldn't want all my account access messages going to a lost phone …).
  - hx87 10y ago
    > I certainly wouldn't want all my account access messages going to a lost phone … Wouldn't that be solved by a fail-deadly setup where your phone is automatically wiped unless you perform a specific action?
    - zeveb 10y ago
      That particular issue, yes — but it wouldn't help me set up a new phone.
kalleboo 10y ago
I thought a significant portion of Americans simply don't have ID as well? (or voter ID laws wouldn't be controversial)
- Kadin 10y ago
  The bar for "allowed to vote" is very different from "allowed to reset a cellphone account". One needs to never block any legal voter from voting, the other can be a balance between ease of access and ease of fraud. I would be very cautious conflating the two cases, because they are very different.
  - 21 10y ago
    So what happens if as a non-US citizen which just happens to be around voting day I enter a voting station and ask to vote (and obviously lie about my identity)
    - hx87 10y ago
      You'd have to know who to impersonate, successfully impersonate them (i.e. good luck trying to impersonate DeWayne Jamal Jones as an Ukrainian) and where (and on what date) they are supposed to vote, and for all that work you have affected all of one vote.
    - bhandziuk 10y ago
      You'll probably get to cast a vote. But this is so rare. The rate of true voter fraud is so exceptionally low and the kind of fraud that voter ID laws are supposed to stop is even lower still that it's just not worth it.
    - toast0 10y ago
      In order to cast enough votes to affect most elections, you would need a large number of votes. The more fraudulent votes you cast, the more likely you'll hit a voter that already voted. If there's a significant volume of double vote attempts, that's a big red flag.
    - 10y ago