4 ms·

I know life can be frustrating when you don't fit the conventional profile. It's been the same for me. But organisations like banks need to have systems that

I know life can be frustrating when you don't fit the conventional profile. It's been the same for me. But organisations like banks need to have systems that adequately balance security, usability and ubiquity, and it turns out that phone number authentication is optimal across those criteria. Of course it's not perfect, but empirically it works better than the alternatives (otherwise they'd already have changed it), so we're stuck with it, no matter how much it might frustrate the likes of you and me. I'm finally old enough to realise that for certain things, like banking, the world is better off that way, else it would would descend into chaos (even more than it already has), and nobody would be able to get anything done. And maybe it's only possible for people like us to get away with existing on the fringes thanks to the fact that most people are keeping society going by getting things done, and for that reason it's perhaps justifiable that for things like this it's up to us to find a way to fit in with their ways of doing things.

herbst 10y ago
I shouldnt have mentioned banking, it seems that this is what most people agree with that numbers make sense. And hence i agree to that as well. One of my banks offers the following 2 alternatives: * Paper TAN (which most likely will go away in the next years) * Card reader that scans your EC card Both completely valid for my situation, my other bank does none of both. Both however are completely valid just not as confidient for the bank i guess. My whole point is having alternatives, or at least a workflow to fix this issue for people who do not have a fixed phone number (anymore). Its sucks to have way less security as everybody else (because i cant enable 2FA) when email was always there and pretty much just as good. It sucks even more to not be able to create a account because somehow they dont want your current number (I mean how crazy is that that you can not make a Twitter account with one of the most popular Thai providers? How is that not a huge issue?)
- tomhoward 10y ago
  Yeah, I get what you're saying. But for every new system/feature/mechanism a service provider builds to accommodate every increasingly narrow edge-case, there's a huge additional cost and commitment in development, maintenance and support. So the reality is it just comes down to dollars. If you're in the mainstream, you'll be looked after. If you're in the fringes, well, you're in the situation you're in now. That's how the world works. Whilst complaining might help you to feel better, it's not going to change much unless there are big dollars at stake for the service provider.
  - herbst 10y ago
    I agree for the most part, but i also hope that my rant helps to put this thought into peoples heads. With several smaller providers i had to talk to when i lost my number it became clear they simply did not spend a single thought on this edge case yet. Some of them now have a workflow to solve this cases, which is really all i am asking for.
lostboys67 10y ago
But the OP does have a point that you don't own the phone number your countries PTT or Regulator does. And for google if you have multiple people using the same google accounts which you would do for many google services 2FA can really mess you up eg if I WFH I cant login to some of our GA GTM and GSC accounts.
- tomhoward 10y ago
  The vast majority of people keep the same phone number for a long period of time; at least a few years in most cases, and several decades in some cases. The telephony system relies on that being the case, which is why it has the nice byproduct of being an identity verification channel for banks and other service providers. So it doesn't matter who strictly 'owns' the phone number. What matters is that it can be relied on to be linked to a given person over an extended period of time, which it usually is, which is why the system usually works. And when it doesn't work, a fallback process is available, which makes the system work even better. So all's good! It's easy to point out ways in which the system fails in all kinds of scenarios where people don't/can't fit in with the way the system is designed, but it's ultimately futile. Service providers will run their system in whatever way is secure enough and usable enough for enough of their customers to be satisfied to stay as customers. There's really nothing more to say about it!
- manigandham 10y ago
  > multiple people using the same google accounts Why would you do this? Whether personal or work related, Google has always said to keep accounts tied to an individual.
  - Nadya 10y ago
    Team managing a GA account for a client. Which is not uncommon for internet marketing companies.
    - lostboys67 10y ago
      exactly any non trivial site that uses google products will have accounts used by multiple people one person doesn't run all of proctor and gambles PPC
mtgx 10y ago
> otherwise they'd already have changed it Do you really believe that? I was just reading someone comment's on Reddit yesterday about him working for a bank that only recently stopped working with credit card number transfers in the clear... Some if not most of the banks just use ancient technology for the same reason most other big corporations do - they don't really "get" the security "value" so they don't bother to invest hundreds of millions of dollars in new infrastructure.
- tomhoward 10y ago
  I'm also old enough to realise that patterns of conduct across global industries like this, don't emerge for purely dumb reasons. "Don't bother to invest" could be a cynical way of saying they can't justify the financial cost, personnel commitment, organisational upheaval and multi-dimensional risk to adopt the new infrastructure. But it's not as if they're sitting around doing nothing; all the banks have vast teams of people constantly maintaining and improving their software and infrastructure, doing whatever is necessary to minimise losses and maximise gains. Those who don't do it enough or do it right go out of business.

herbst 10y ago

I shouldnt have mentioned banking, it seems that this is what most people agree with that numbers make sense. And hence i agree to that as well. One of my banks offers the following 2 alternatives: * Paper TAN (which most likely will go away in the next years) * Card reader that scans your EC card Both completely valid for my situation, my other bank does none of both. Both however are completely valid just not as confidient for the bank i guess. My whole point is having alternatives, or at least a workflow to fix this issue for people who do not have a fixed phone number (anymore). Its sucks to have way less security as everybody else (because i cant enable 2FA) when email was always there and pretty much just as good. It sucks even more to not be able to create a account because somehow they dont want your current number (I mean how crazy is that that you can not make a Twitter account with one of the most popular Thai providers? How is that not a huge issue?)

tomhoward 10y ago
Yeah, I get what you're saying. But for every new system/feature/mechanism a service provider builds to accommodate every increasingly narrow edge-case, there's a huge additional cost and commitment in development, maintenance and support. So the reality is it just comes down to dollars. If you're in the mainstream, you'll be looked after. If you're in the fringes, well, you're in the situation you're in now. That's how the world works. Whilst complaining might help you to feel better, it's not going to change much unless there are big dollars at stake for the service provider.
- herbst 10y ago
  I agree for the most part, but i also hope that my rant helps to put this thought into peoples heads. With several smaller providers i had to talk to when i lost my number it became clear they simply did not spend a single thought on this edge case yet. Some of them now have a workflow to solve this cases, which is really all i am asking for.

lostboys67 10y ago

But the OP does have a point that you don't own the phone number your countries PTT or Regulator does. And for google if you have multiple people using the same google accounts which you would do for many google services 2FA can really mess you up eg if I WFH I cant login to some of our GA GTM and GSC accounts.

tomhoward 10y ago
The vast majority of people keep the same phone number for a long period of time; at least a few years in most cases, and several decades in some cases. The telephony system relies on that being the case, which is why it has the nice byproduct of being an identity verification channel for banks and other service providers. So it doesn't matter who strictly 'owns' the phone number. What matters is that it can be relied on to be linked to a given person over an extended period of time, which it usually is, which is why the system usually works. And when it doesn't work, a fallback process is available, which makes the system work even better. So all's good! It's easy to point out ways in which the system fails in all kinds of scenarios where people don't/can't fit in with the way the system is designed, but it's ultimately futile. Service providers will run their system in whatever way is secure enough and usable enough for enough of their customers to be satisfied to stay as customers. There's really nothing more to say about it!
manigandham 10y ago
> multiple people using the same google accounts Why would you do this? Whether personal or work related, Google has always said to keep accounts tied to an individual.
- Nadya 10y ago
  Team managing a GA account for a client. Which is not uncommon for internet marketing companies.
  - lostboys67 10y ago
    exactly any non trivial site that uses google products will have accounts used by multiple people one person doesn't run all of proctor and gambles PPC

mtgx 10y ago

> otherwise they'd already have changed it Do you really believe that? I was just reading someone comment's on Reddit yesterday about him working for a bank that only recently stopped working with credit card number transfers in the clear... Some if not most of the banks just use ancient technology for the same reason most other big corporations do - they don't really "get" the security "value" so they don't bother to invest hundreds of millions of dollars in new infrastructure.

tomhoward 10y ago
I'm also old enough to realise that patterns of conduct across global industries like this, don't emerge for purely dumb reasons. "Don't bother to invest" could be a cynical way of saying they can't justify the financial cost, personnel commitment, organisational upheaval and multi-dimensional risk to adopt the new infrastructure. But it's not as if they're sitting around doing nothing; all the banks have vast teams of people constantly maintaining and improving their software and infrastructure, doing whatever is necessary to minimise losses and maximise gains. Those who don't do it enough or do it right go out of business.