5 ms·

This rant is exactly why phone numbers are a good way to do two-factor. The author lost control of their phone number ("as i quit the account shortly...") and s

by mark242 10y ago

This rant is exactly why phone numbers are a good way to do two-factor. The author lost control of their phone number ("as i quit the account shortly...") and subsequently had an extremely hard time authenticating to their bank, Google, Twitter, etc. Getting a new phone number set up is time consuming, even with a Twilio-like service. This is a good thing. Your IMEI number isn't portable, and until there is a physical token on your phone that is also portable, a phone number is the next best option.

herbst 10y ago
Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution. On the other side i control my email address, my private key, my home address to a degree, but never my telephone number.
- devoply 10y ago
  Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.
  - herbst 10y ago
    Which i control even less... I dont doubt there are solutions, but the only one i've seen so far that is kind of optimal is Github which allows me to disable lost 2fa access through verifying with a git push like command based on public/private key.
    - devoply 10y ago
      I don't know what control means to you. You mean stuff that you don't have to pay for? Stuff that can't be taken away from you? I have had the same number with VOIP.ms for 5 years. Even used it from Mexico. It does not seem to me to be out of my control.
      - herbst 10y ago
        Control means i own it. You never own telephone numbers, maybe you do in some countries i dont know, but they usual contract is that you rent them and they can be taken away from you anytime. Sure they usually dont, but building a security system on something like that is obviously suboptimal.
        tyingq 10y ago
        Not sure I understand the difference between renting a telephone number and renting a domain, or email address, or even a home address. All can be taken away for various reasons, failure to pay rent/renewal/mortgage, legal confiscations, etc.
        SomeStupidPoint 10y ago
        As far as I can tell, it's just a whine services don't let you use a preferred rented identity listing (that is arguably less tied to the real world). There's not a lot of genuine security or legal analysis to be found here.
        herbst 10y ago
        Some other guy went a bit more into genuine security if thats your thing: https://www.devever.net/~hl/e164 https://www.devever.net/~hl/e164
        herbst 10y ago
        According to my telephone contract it can be taken at any time and i am not entitled to my telephone number. This is something you dont find with domains.
  - keypress 10y ago
    Man in the middle.
    - devoply 10y ago
      The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.
- Freak_NL 10y ago
  In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x. I never changed back, so now I receive a new sheet of numbered codes whenever I've used a certain number of them. Nowadays I scan this sheet of codes, run an OCR task, and import the codes in my password manager¹. So when the bank asks for code 519: pass -c bank/ing/tan/519 And I have the code on my clipboard. I wonder how long ING (my bank) will allow this method to exist… The alternative used by Dutch banks is a small token generating device they provide to all customers (I think only ING mentioned above doesn't do this yet). This requires no phone number either, just the (tiny) physical device. I wonder what happens if I tell my bank that I no longer have a phone number I can be reached at? 1: https://www.passwordstore.org/ https://www.passwordstore.org/
  - herbst 10y ago
    Same. I also use paper tan right now and one bank account which i have to call if i want something (which i dont care much about, because its not ment to be accessed anyway) but yeah its just a question of time the bank does not send out TANs anymore. My bank (or both of them) had no solution when i told them that i dont plan on having a phone number anymore. The one accepted it that they cant call me and send paper TANs, the other did not do paper tans for a few years now. Btw: Your solution to store them sounds nice. Probably gonna adapt that
  - nom 10y ago
    Here in Germany we get a Digipass 2FA device from our bank (something like this [0]). For every transaction, you put your banking card in, hold it up to the flashing pattern on the screen, and it creates a TAN for you. Very convenient and secure. I thought this is more common in Europe, but apparently it's not? Although, our banks are increasingly pushing towards App-based 2FA because it's cheaper.. but I'm very confident they'll continue to support as it is the common way to do online banking. 0: https://www.vasco.com/products/two-factor-authenticators/hardware/card-readers/digipass-836.html https://www.vasco.com/products/two-factor-authenticators/har...
- icebraining 10y ago
  Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution. I don't get it, why are your prepaid cars only valid for a few months? Do people just lose their number regularly? Around here you can get a prepaid SIM, and you only need to make a single call per six months to keep it active. Even an initial 10€ payment is enough for years of service. Can't you get the same in Switzerland?
  - herbst 10y ago
    No thats what i ment. I need to use it within N period to keep it. If i just receive SMS every other month it will die after a while. Also as mentioned i cant get it again, prepaid is kind of contract less. If i loose the sim i am not entitled to get the same number again.
    - sethammons 10y ago
      Could just set a reminder to call someone or an automated service once every period...
      - herbst 10y ago
        Thats a very cool idea actually. Would depend on not changing my phone or resetting it and forget about it so probably faulty, but i keep that in mind.
- lmm 10y ago
  > My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Maybe the bank is not interested in serving people like you - and why should they be? A bank needs to be able to loan money to fulfil its function - everything else they do is about enabling the loan business. To be able to make loans they need to be able to have some hope of being repaid, so they need a reliable way of contacting someone tied to that person's identity and expensive to mess with. Emails are ignorable and untraceable. Home address fulfils those functions but isn't really practical as a sole means of contact - would you like them to place suspicions transactions on hold while they send you a letter and wait for your reply?
  - herbst 10y ago
    As mentioned in some other comment my bank was a bad point, i see why its more relevant for banking. While one of my banks is perfectly happy with what i am doing and offers me paper TANs and contacts me via letters the other isnt. I am more about everything else than banking tho. Things that dont have the need to contact me ASAP and still use SMS for authentification purposes. (Personally i dont even mind verification, i have a number, just not for long)
  - SomeStupidPoint 10y ago
    My bank emails me about suspicious transactions. There's a link for if I authorized it and a link for if I didnt. In fact, basically everything my bank does is by email, except a few legal documents amd sending replacement cards, which are by mail. I cant count the number of times they called me on a single hand.
- mark242 10y ago
  "I dont have a fixed telephone number anymore. How to handle that?" Get a fixed telephone number.

by mark242 10y ago

herbst 10y ago

Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution. On the other side i control my email address, my private key, my home address to a degree, but never my telephone number.

devoply 10y ago
Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.
- herbst 10y ago
  Which i control even less... I dont doubt there are solutions, but the only one i've seen so far that is kind of optimal is Github which allows me to disable lost 2fa access through verifying with a git push like command based on public/private key.
  - devoply 10y ago
    I don't know what control means to you. You mean stuff that you don't have to pay for? Stuff that can't be taken away from you? I have had the same number with VOIP.ms for 5 years. Even used it from Mexico. It does not seem to me to be out of my control.
    - herbst 10y ago
      Control means i own it. You never own telephone numbers, maybe you do in some countries i dont know, but they usual contract is that you rent them and they can be taken away from you anytime. Sure they usually dont, but building a security system on something like that is obviously suboptimal.
      - tyingq 10y ago
        Not sure I understand the difference between renting a telephone number and renting a domain, or email address, or even a home address. All can be taken away for various reasons, failure to pay rent/renewal/mortgage, legal confiscations, etc.
        SomeStupidPoint 10y ago
        As far as I can tell, it's just a whine services don't let you use a preferred rented identity listing (that is arguably less tied to the real world). There's not a lot of genuine security or legal analysis to be found here.
        herbst 10y ago
        Some other guy went a bit more into genuine security if thats your thing: https://www.devever.net/~hl/e164 https://www.devever.net/~hl/e164
        herbst 10y ago
        According to my telephone contract it can be taken at any time and i am not entitled to my telephone number. This is something you dont find with domains.
- keypress 10y ago
  Man in the middle.
  - devoply 10y ago
    The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.
Freak_NL 10y ago
In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x. I never changed back, so now I receive a new sheet of numbered codes whenever I've used a certain number of them. Nowadays I scan this sheet of codes, run an OCR task, and import the codes in my password manager¹. So when the bank asks for code 519: pass -c bank/ing/tan/519 And I have the code on my clipboard. I wonder how long ING (my bank) will allow this method to exist… The alternative used by Dutch banks is a small token generating device they provide to all customers (I think only ING mentioned above doesn't do this yet). This requires no phone number either, just the (tiny) physical device. I wonder what happens if I tell my bank that I no longer have a phone number I can be reached at? 1: https://www.passwordstore.org/ https://www.passwordstore.org/
- herbst 10y ago
  Same. I also use paper tan right now and one bank account which i have to call if i want something (which i dont care much about, because its not ment to be accessed anyway) but yeah its just a question of time the bank does not send out TANs anymore. My bank (or both of them) had no solution when i told them that i dont plan on having a phone number anymore. The one accepted it that they cant call me and send paper TANs, the other did not do paper tans for a few years now. Btw: Your solution to store them sounds nice. Probably gonna adapt that
- nom 10y ago
  Here in Germany we get a Digipass 2FA device from our bank (something like this [0]). For every transaction, you put your banking card in, hold it up to the flashing pattern on the screen, and it creates a TAN for you. Very convenient and secure. I thought this is more common in Europe, but apparently it's not? Although, our banks are increasingly pushing towards App-based 2FA because it's cheaper.. but I'm very confident they'll continue to support as it is the common way to do online banking. 0: https://www.vasco.com/products/two-factor-authenticators/hardware/card-readers/digipass-836.html https://www.vasco.com/products/two-factor-authenticators/har...
icebraining 10y ago
Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution. I don't get it, why are your prepaid cars only valid for a few months? Do people just lose their number regularly? Around here you can get a prepaid SIM, and you only need to make a single call per six months to keep it active. Even an initial 10€ payment is enough for years of service. Can't you get the same in Switzerland?
- herbst 10y ago
  No thats what i ment. I need to use it within N period to keep it. If i just receive SMS every other month it will die after a while. Also as mentioned i cant get it again, prepaid is kind of contract less. If i loose the sim i am not entitled to get the same number again.
  - sethammons 10y ago
    Could just set a reminder to call someone or an automated service once every period...
    - herbst 10y ago
      Thats a very cool idea actually. Would depend on not changing my phone or resetting it and forget about it so probably faulty, but i keep that in mind.
lmm 10y ago
> My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong. Maybe the bank is not interested in serving people like you - and why should they be? A bank needs to be able to loan money to fulfil its function - everything else they do is about enabling the loan business. To be able to make loans they need to be able to have some hope of being repaid, so they need a reliable way of contacting someone tied to that person's identity and expensive to mess with. Emails are ignorable and untraceable. Home address fulfils those functions but isn't really practical as a sole means of contact - would you like them to place suspicions transactions on hold while they send you a letter and wait for your reply?
- herbst 10y ago
  As mentioned in some other comment my bank was a bad point, i see why its more relevant for banking. While one of my banks is perfectly happy with what i am doing and offers me paper TANs and contacts me via letters the other isnt. I am more about everything else than banking tho. Things that dont have the need to contact me ASAP and still use SMS for authentification purposes. (Personally i dont even mind verification, i have a number, just not for long)
- SomeStupidPoint 10y ago
  My bank emails me about suspicious transactions. There's a link for if I authorized it and a link for if I didnt. In fact, basically everything my bank does is by email, except a few legal documents amd sending replacement cards, which are by mail. I cant count the number of times they called me on a single hand.
mark242 10y ago
"I dont have a fixed telephone number anymore. How to handle that?" Get a fixed telephone number.