3 ms·

Given that I travel all the time with several different SIM cards, I live in fear that I might lose a SIM (they're tremendously easy drop, break or just fall of

Given that I travel all the time with several different SIM cards, I live in fear that I might lose a SIM (they're tremendously easy drop, break or just fall off from wherever you keep them) and have to wait for weeks before getting back home to get one. Or, you know, just travel to a jurisdiction where I can't get SMSs from my home SIM. By comparison one-time pads have been substantially easier to keep around and protect.

hocuspocus 8y ago
Services that assume phone numbers are some kind of stable ID are infuriating. Recently I wanted to log in to AirBnB. I hadn't signed in in 3 years. I was welcomed with a nice "We don't recognize this device. Get a code by text message or phone call at <number at my previous country of residence>." The thing is, I use social login on AirBnB! Specifically because I want to delegate MFA to a service where I'll keep my profile and login information up to date. I don't remember agreeing to my phone number being used as a second factor or as a way to recover my account. So I contacted their customer service and they unlocked my account within 2 days, without any further verification.
- gsich 8y ago
  Last time I used Airbnb they offered multiple verification options, including mail.
  - kweks 8y ago
    The email option is displayed / hidden depending specific factors, specifically if your GeoIP is in your original / standard country. Had to do this last week, VPN to my home country to enable code via email. Sheer stupidity.
derefr 8y ago
1. Sign up for a VoIP service with SMS support (e.g. https://voip.ms/ https://voip.ms/) 2. use a DID from that service for your 2FA 3. use a softphone app with SMS support to receive 2FA codes (or just have SMSes sent to that number forward to your email; either or) 4. when in a new country with a new SIM card, just make sure to sign up for data. Then you'll continue to receive your SMSes like normal. And your phone calls, too! (It's honestly insane that this isn't just... how phone infrastructure works, though.)
- techsupporter 8y ago
  > 2. use a DID from that service for your 2FA Except for the myriad companies who flatly refuse to permit their customers to use "VoIP" or "virtual" or anything-other-than-mobile numbers for SMS-based 2FA. My personal favorite is Zelle. I got a terms of service update a month or so ago, "you will no longer be permitted to use Google Voice other other VoIP or virtual numbers for Zelle and must provide a cell phone number to continue." Except that my cell phone service is provided by a company that buys blocks of data service and voice and SMS ride on that data, so the number "validates" as a VoIP number. I contacted my financial institution, "what do I do you have this number and it's worked great and it's the only number I have." Sorry, can't use Zelle any more.
  - drewg123 8y ago
    Tell me about it. I use Google voice for everything and have for years. My bank won't do 2FA with anything but their own RSA dongle (no thanks) or a phone number, and won't accept the GV number. I don't want to give them the underlying phone number (t-mobile), since: (a) t-mobile is famous for being socially engineered to give out sims on other people's accounts. (b) I have no loyalty to this plan. I've had 5 or 6 underlying phone numbers since I started using grand central (now google voice) in the 2000s. I don't even know what my t-mobile number is (i have to look it up on my phone's settings).
    - frosted-flakes 8y ago
      Isn't number porting a thing in the US? It should be quite easy to bring your number to a different carrier.
  - derefr 8y ago
    Hack I used to get around that: at the time I was signing up for the VoIP provider, I had an existing cellphone number with a regular carrier. The VoIP provider let me transfer my cellphone number to them, just as if they were another cellular carrier. The number still shows up in directories as being owned by the original carrier (which I think is true in all cases where you transfer a number; the number is sort of "on loan" from the original carrier's assigned number space.) No 2FA (or KYC/AML) processes flatly reject my number, because it looks entirely legitimate to their heuristics. Still, sometimes the actual activation codes just mysteriously never arrive. Then I switch to using the actual DID associated with my (data-only) SIM, and the codes arrive instantly. I'm not sure whether this is their sending system being smarter about virtual numbers than their pre-check heuristics; or if it's just some weird gateway failure between my old and new carriers when (I presume) they try to forward the SMS from their SMSC to the VoIP carrier's SMSC.

hocuspocus 8y ago

Services that assume phone numbers are some kind of stable ID are infuriating. Recently I wanted to log in to AirBnB. I hadn't signed in in 3 years. I was welcomed with a nice "We don't recognize this device. Get a code by text message or phone call at <number at my previous country of residence>." The thing is, I use social login on AirBnB! Specifically because I want to delegate MFA to a service where I'll keep my profile and login information up to date. I don't remember agreeing to my phone number being used as a second factor or as a way to recover my account. So I contacted their customer service and they unlocked my account within 2 days, without any further verification.

gsich 8y ago
Last time I used Airbnb they offered multiple verification options, including mail.
- kweks 8y ago
  The email option is displayed / hidden depending specific factors, specifically if your GeoIP is in your original / standard country. Had to do this last week, VPN to my home country to enable code via email. Sheer stupidity.

derefr 8y ago

1. Sign up for a VoIP service with SMS support (e.g. https://voip.ms/ https://voip.ms/) 2. use a DID from that service for your 2FA 3. use a softphone app with SMS support to receive 2FA codes (or just have SMSes sent to that number forward to your email; either or) 4. when in a new country with a new SIM card, just make sure to sign up for data. Then you'll continue to receive your SMSes like normal. And your phone calls, too! (It's honestly insane that this isn't just... how phone infrastructure works, though.)

techsupporter 8y ago
> 2. use a DID from that service for your 2FA Except for the myriad companies who flatly refuse to permit their customers to use "VoIP" or "virtual" or anything-other-than-mobile numbers for SMS-based 2FA. My personal favorite is Zelle. I got a terms of service update a month or so ago, "you will no longer be permitted to use Google Voice other other VoIP or virtual numbers for Zelle and must provide a cell phone number to continue." Except that my cell phone service is provided by a company that buys blocks of data service and voice and SMS ride on that data, so the number "validates" as a VoIP number. I contacted my financial institution, "what do I do you have this number and it's worked great and it's the only number I have." Sorry, can't use Zelle any more.
- drewg123 8y ago
  Tell me about it. I use Google voice for everything and have for years. My bank won't do 2FA with anything but their own RSA dongle (no thanks) or a phone number, and won't accept the GV number. I don't want to give them the underlying phone number (t-mobile), since: (a) t-mobile is famous for being socially engineered to give out sims on other people's accounts. (b) I have no loyalty to this plan. I've had 5 or 6 underlying phone numbers since I started using grand central (now google voice) in the 2000s. I don't even know what my t-mobile number is (i have to look it up on my phone's settings).
  - frosted-flakes 8y ago
    Isn't number porting a thing in the US? It should be quite easy to bring your number to a different carrier.
- derefr 8y ago
  Hack I used to get around that: at the time I was signing up for the VoIP provider, I had an existing cellphone number with a regular carrier. The VoIP provider let me transfer my cellphone number to them, just as if they were another cellular carrier. The number still shows up in directories as being owned by the original carrier (which I think is true in all cases where you transfer a number; the number is sort of "on loan" from the original carrier's assigned number space.) No 2FA (or KYC/AML) processes flatly reject my number, because it looks entirely legitimate to their heuristics. Still, sometimes the actual activation codes just mysteriously never arrive. Then I switch to using the actual DID associated with my (data-only) SIM, and the codes arrive instantly. I'm not sure whether this is their sending system being smarter about virtual numbers than their pre-check heuristics; or if it's just some weird gateway failure between my old and new carriers when (I presume) they try to forward the SMS from their SMSC to the VoIP carrier's SMSC.