7 ms·

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, thi

by zaroth 7y ago

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process. Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps). A mandatory time delay (12 or 24 hours) could be imposed. This would slightly inconvenience people who lost their SIM and need to setup a new one. This seems like a reasonable cost/security trade-off for losing a SIM card. Mission critical numbers should be implemented as forwarding services that separately route to the cell phone anyway, so “this number must be live right now” is not a reasonable excuse to compromise everyone’s security. You could also mandate a short delay (4 business hours) and high value targets that sometimes take international flights could opt-in to longer (24/48 hour) waiting periods. The expectation should be that 99% of users keep the default. Using SMS as a second factor has trade-offs. This isn’t news because every single authentication mechanism presents a unique set of trade-offs in terms of cost of provisioning, ease of use, possibility of loss, possibility of spoofing, replay, etc. SMS is an extremely powerful authentication factor due to its availability, cost, and accessibility. It’s worth it to shore up protection against SIM swaps not in the least because it would improve the security posture of SMS as an authentication factor. It would still not make SMS perfect. Nothing is.

cat199 7y ago
hugely important point. helped a less-tech-savvy neighbor 'reset her skype' account that was tied to 'her phone number', only to find that the account bound to that phone number, which she had recently acquired, was publically searchable and connected with some sort of anime sex fetish subculture, presumably from a previous owner of that phone number.. she was using this phone / skype account for a job interview. needless to say, a searchable skype account connected to her phone number with such a public profile could have had a hugely negative impact on her job search, and she wasn't even aware of it's existence until she happened to stumble upon it.. not good.
- whywhywhywhy 7y ago
  Never really made any sense to me whatsoever why we all switched over from having to use phone numbers instead of email addresses as sign in over the past few years. I get why businesses want to harvest peoples phone numbers and phone books but you'd hope at least some would think of the implications to users first.
  - lotsofpulp 7y ago
    Using phone numbers as authentication is a cheap and effective way to prevent spam, as well as track users with a unique ID.
    - alistairSH 7y ago
      But phone numbers are not unique. They are regularly re-assigned to new customers.
      - lotsofpulp 7y ago
        It’s a good enough solution. Especially for those with disposable income, they’re not changing numbers often, if ever.
        alistairSH 7y ago
        Good enough, as long as you don't get assigned a number that previously belonged to a porn-addicted weirdo, or criminal, or dead-beat who doesn't pay their bills, or any number of other not-nice things that can turn your life into a hot mess despite never doing those things yourself.
        lotsofpulp 7y ago
        I meant good enough for the business.
  - blackflame7000 7y ago
fulafel 7y ago
It's really ½FA, worse than 1FA authentication because it's sufficient to clear any 1 of the 2 factors.
- penagwin 7y ago
  I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck. If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA
  - choward 7y ago
    It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.
    - r1nkgrl 7y ago
      Using your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?
      - deleted 7y ago
        [deleted]
      - theossuary 7y ago
        A password is a factor of authentication, so by definition is 1FA. Any service which allows access to the account through social engineering could be labeled as having less than 1FA. If an attacker could access your account without knowing any of your secrets, then it's really 0FA.
      - daveFNbuck 7y ago
        Suppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected? To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.
rkrzr 7y ago
Thanks for clarifying this. This article completely missed this point and hand-waved over this, although this should have been the most important message: Twitter should not allow SMS as a single factor. Lots of account take-overs could have been prevented if they had added this obvious security measure.
codedokode 7y ago
> Number porting should require an SMS to the existing SIM This is done by some carriers in Russia as far as I remember. > with the ability to respond NO to cancel the proces There is no such possibility, but you can visit carrier's representative. > A mandatory time delay (12 or 24 hours) could be imposed. Some carriers do this for SMS. Here is a quote from one of the carrier's website: > To protect you from scammers, after replacing a SIM card SMS messages from banks and commercial online services will be blocked for 24 hours. You will be able to send and receive SMS from other users and popular messengers and applications instantly. > SMS is an extremely powerful authentication factor But it discloses person's identity and location.
legohead 7y ago
SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.
- Spivak 7y ago
  It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement. I would bet on “log in with phone number” being better than “log in with password” across a population any day.
  - legohead 7y ago
    It's less secure than even passwords. Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his phone. Most of the time it will pop up right on the front screen even if locked. If he misses it, I just wait for him to unlock the phone and look at his SMS. How would you like it if passwords just popped up visible to all on your phone?
    - drewmol 7y ago
      I'm usually the one on my phone, and when I'm not the user I'm almost always aware of who the user is and I've granted them permission to access the device. The level of security cannot be not objectivly measured across all threat surfaces or catagories of potential bad actors. The parent poster said "login with phone number" but that should be understood as login with a one time password by demonstating access to the receiving end of a fairly private and relatively difficult to intercept communication channel (physically controlling the client registered to receive messages destined for your phone number on the SS7 network). The authentication factor effectively becomes something have (your phone) whereas a password is something you know which allows for a much larger pool of potential bad actors (with a realistic means of gainig access). SMS factor works more like a physical key your in possesion of that can be used to set a new combination (secret/password) for future access. In practice, combinations (passwords) are forgotten much more often than keys (phones) are lost or compromised.
excalibur 7y ago
> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud This would work to the thief's advantage in the case of physical device theft. The notification should definitely be a thing, but it should not be possible to cancel the process without talking to the carrier directly and verifying your identity to them.
- ender89 7y ago
  Fun fact, the person who stole the sim probably worked for the carrier, or used someone who worked at the carrier that they either knew or had leverage over. You already have to verify your identity to the carrier if you want to make changes to your account, and while you might be able social-engineer your way past it, but I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes. Saying the carrier needs to be sure before making changes is useless if the person at the carrier is circumventing it. Plus they already do it.
  - ergothus 7y ago
    > while you might be able social-engineer your way past it, My personal experiences and various accounts I've heard make this "might" shift to "fairly easily". Why are you so confident that it has to be someone with inside knowledge? > I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes I do not share your trust. I'd be shocked if he didn't NOW, but you are basing your assumption off of what...that he recognized his status as a high profile target? Were that the case I doubt this vulnerability would have existed.
nullc 7y ago
My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.
- ineedasername 7y ago
  > "the only protection is to not give them your phone number in the first place." That has its own risks. If you don't provide it to google and your account gets hacked, it's extremely hard to get it back. (My wife lost her original gmail account that way about 2 years ago. And of course there was no way to get any live support to try & fix it) Basically if you don't provide your number, you're more open to the more prevalent traditional hacking. If you do provide a number, you're more open to a slightly less prevalent type of hacking. It doesn't leave much to choose from.
  - velosol 7y ago
    > "It doesn't leave much to choose from." With Google anyway you're down to 2FA using an authentication app (possibly U2F but I haven't checked on that recently) and backup codes which should also protect you from traditional hacking.
  - rkagerer 7y ago
    I've read of many cases of folks losing access to their personal Google account through no fault of their own, and winding up helpless to get it back. Almost happened to me after I was victim of a SIM Swap. From the article, even the Twitter CEO has this problem: While he has managed to get back his social media accounts, he has not regained access to two Google email accounts that held years of communications. If anyone with directional authority at Google is out there: It would be really decent of you to provide some means of customer service for consumers stuck in this catch-22. I can't accept there's no reasonable way to perform an identity confirmation beyond the laughably limited self-help measures currently in place. If it's a matter of economics, make it pay-per-use.
- iamnotacrook 7y ago
wobbly_bush 7y ago
Indian laws require a police report before telecom operators can transfer a line to a new SIM card. I was always surprised how easy it is in US to transfer in comparison.
- vishnugupta 7y ago
  I guess that's only for lost SIM cards? I've got my number transferred to new SIM card, about 30 times over last 10 years, without any police report. Had to produce ID proof which is quite convenient.
  - wobbly_bush 7y ago
    In those cases you would have the physical possession of the old SIM, so I guess no one can just claim to be you. Example form for others reading till here - https://discover.vodafone.in/documents/pdfs/simreplacement/sim_replacement_form_mah.pdf https://discover.vodafone.in/documents/pdfs/simreplacement/s...
- avip 7y ago
  In India I had to give a photocopy of my passport, my permanent address in India, and a letter of referral from an Indian citizen to get my Airtel sim card. It was one of the weirdest experiences I've had in the country.
jethro_tell 7y ago
It's always kindof annoyed me they don't offer a u2f auth mechanism. Can't be that hard for a company of that size.
- kbar13 7y ago
  they do https://www.yubico.com/works-with-yubikey/catalog/twitter/ https://www.yubico.com/works-with-yubikey/catalog/twitter/
  - jethro_tell 7y ago
    Hey, nice. Setting this up now. They didn't have it last time I checked.
vxNsr 7y ago
> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps). Better yet, a YES text should be required with a port
- hirsin 7y ago
  You've led a fortunate life, if you've never had a phone utterly and completely destroyed or lost. Having the SIM ruined is a rough time. I believe t-mobile has a nice requirement of being able to mark you number as "show up in the store and show your ID"
  - vxNsr 7y ago
    > I believe t-mobile has a nice requirement of being able to mark you number as "show up in the store and show your ID" Yup, and yet I've heard of stories of people social engineering their way around that. the telecom companies need to make it impossible for a CSR to access your account at all without actual verifying data from you.
- thorwasdfasdf 7y ago
  Or require YES text for immediate port. Then if you can't do that because you've lost your phone, then it should delay for 24 hours, then do the port.
drewmol 7y ago
There's an MVNO owned by the Canadian ISP tucows called Ting, I used them for my primary mobile service for some time (I would still but I wanted access to Verizon's 700 and 800 Mhz bands for better coverage at my residence so I switched). Anyhow last time I checked they've since added several awesome (and self configurable via their account dashboard) features like multi factor auth settings for # porting, comprehensive forwading options, port locking, locking a line to a sim or device, among other security related overlays to their service some assible via REST API, IIRC. They offer live, immediatly accessable by phone call, north american based (US/Canada), friendly, usually native english spreaking knowledgable support agents and start their minimum service tier pricing at $6/line/month with the ability to toggle (block) voice, sms and data services for each line. For < $90/yr you can configure a pretty secure dedicated line for 2FA.
- vageli 7y ago
  > There's an MVNO owned by the Canadian ISP tucows called Ting, I used them for my primary mobile service for some time (I would still but I wanted access to Verizon's 700 and 800 Mhz bands for better coverage at my residence so I switched). Anyhow last time I checked they've since added several awesome (and self configurable via their account dashboard) features like multi factor auth settings for # porting, comprehensive forwading options, port locking, locking a line to a sim or device, among other security related overlays to their service some assible via REST API, IIRC. They offer live, immediatly accessable by phone call, north american based (US/Canada), friendly, usually native english spreaking knowledgable support agents and start their minimum service tier pricing at $6/line/month with the ability to toggle (block) voice, sms and data services for each line. For < $90/yr you can configure a pretty secure dedicated line for 2FA. Wow, I use this company for my elderly father for a resounding monthly bill of ~$7/8 for years and had no idea they were also Tucows.
  - StudentStuff 7y ago
    Tucows has been terrible in handling a client of mine's issues, their domain has no SPF or DKIM, and thus their email is unreliably making it to customer's inboxes. If anyone has pointers on how to get a domain & email address that are both bought & hosted with Tucows up to snuff with the email security standards of yesteryear (SPF & DKIM), I would really appreciate it!
thorwasdfasdf 7y ago
> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud This is an excellent idea. And I wish all the cell phone carriers would adopt this, if not already.
PopeDotNinja 7y ago
I don't like being limited to 2FA using SMS. As soon as your phone isn't available, you're out of luck :P
- TwoBit 7y ago
  Just get a Google phone number. My Google phone number is secret and non-port-able.

by zaroth 7y ago

cat199 7y ago

hugely important point. helped a less-tech-savvy neighbor 'reset her skype' account that was tied to 'her phone number', only to find that the account bound to that phone number, which she had recently acquired, was publically searchable and connected with some sort of anime sex fetish subculture, presumably from a previous owner of that phone number.. she was using this phone / skype account for a job interview. needless to say, a searchable skype account connected to her phone number with such a public profile could have had a hugely negative impact on her job search, and she wasn't even aware of it's existence until she happened to stumble upon it.. not good.

whywhywhywhy 7y ago
Never really made any sense to me whatsoever why we all switched over from having to use phone numbers instead of email addresses as sign in over the past few years. I get why businesses want to harvest peoples phone numbers and phone books but you'd hope at least some would think of the implications to users first.
- lotsofpulp 7y ago
  Using phone numbers as authentication is a cheap and effective way to prevent spam, as well as track users with a unique ID.
  - alistairSH 7y ago
    But phone numbers are not unique. They are regularly re-assigned to new customers.
    - lotsofpulp 7y ago
      It’s a good enough solution. Especially for those with disposable income, they’re not changing numbers often, if ever.
      - alistairSH 7y ago
        Good enough, as long as you don't get assigned a number that previously belonged to a porn-addicted weirdo, or criminal, or dead-beat who doesn't pay their bills, or any number of other not-nice things that can turn your life into a hot mess despite never doing those things yourself.
        lotsofpulp 7y ago
        I meant good enough for the business.
- blackflame7000 7y ago

fulafel 7y ago

It's really ½FA, worse than 1FA authentication because it's sufficient to clear any 1 of the 2 factors.

penagwin 7y ago
I'm not sure I would go that far - 1FA means you require either one or the other or both. But if you have neither you're out of luck. If you had parts of either, or a hint, maybe a previously used password works for "verifying your ID" then I'd call that 1/2FA
- choward 7y ago
  It's 1 FA authentication because all you need is the phone to access the account. The password is irrelevant since all you need is access to the reset code that is sent via SMS. However, since you don't really even need access to the phone and can easily social engineer access to messages sent to the phone, it's not really a full one factor.
  - r1nkgrl 7y ago
    Using your logic, doesn't the ability to social engineer access to a password make passwords less than 1 FA as well?
    - deleted 7y ago
      [deleted]
    - theossuary 7y ago
      A password is a factor of authentication, so by definition is 1FA. Any service which allows access to the account through social engineering could be labeled as having less than 1FA. If an attacker could access your account without knowing any of your secrets, then it's really 0FA.
    - daveFNbuck 7y ago
      Suppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected? To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.

rkrzr 7y ago

Thanks for clarifying this. This article completely missed this point and hand-waved over this, although this should have been the most important message: Twitter should not allow SMS as a single factor. Lots of account take-overs could have been prevented if they had added this obvious security measure.

codedokode 7y ago

> Number porting should require an SMS to the existing SIM This is done by some carriers in Russia as far as I remember. > with the ability to respond NO to cancel the proces There is no such possibility, but you can visit carrier's representative. > A mandatory time delay (12 or 24 hours) could be imposed. Some carriers do this for SMS. Here is a quote from one of the carrier's website: > To protect you from scammers, after replacing a SIM card SMS messages from banks and commercial online services will be blocked for 24 hours. You will be able to send and receive SMS from other users and popular messengers and applications instantly. > SMS is an extremely powerful authentication factor But it discloses person's identity and location.

legohead 7y ago

SMS is only as good as the cell providers security, which has been shown over and over again to be terrible. It should never be used in any ongoing authentication.

Spivak 7y ago
It may very well be bad in absolute terms but compared to a single weak password it’s a huge improvement. I would bet on “log in with phone number” being better than “log in with password” across a population any day.
- legohead 7y ago
  It's less secure than even passwords. Beyond SIM card cloning, I could sit behind a target, initiate a SMS auth, and simply wait for the guy to look at his phone. Most of the time it will pop up right on the front screen even if locked. If he misses it, I just wait for him to unlock the phone and look at his SMS. How would you like it if passwords just popped up visible to all on your phone?
  - drewmol 7y ago
    I'm usually the one on my phone, and when I'm not the user I'm almost always aware of who the user is and I've granted them permission to access the device. The level of security cannot be not objectivly measured across all threat surfaces or catagories of potential bad actors. The parent poster said "login with phone number" but that should be understood as login with a one time password by demonstating access to the receiving end of a fairly private and relatively difficult to intercept communication channel (physically controlling the client registered to receive messages destined for your phone number on the SS7 network). The authentication factor effectively becomes something have (your phone) whereas a password is something you know which allows for a much larger pool of potential bad actors (with a realistic means of gainig access). SMS factor works more like a physical key your in possesion of that can be used to set a new combination (secret/password) for future access. In practice, combinations (passwords) are forgotten much more often than keys (phones) are lost or compromised.

excalibur 7y ago

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud This would work to the thief's advantage in the case of physical device theft. The notification should definitely be a thing, but it should not be possible to cancel the process without talking to the carrier directly and verifying your identity to them.

ender89 7y ago
Fun fact, the person who stole the sim probably worked for the carrier, or used someone who worked at the carrier that they either knew or had leverage over. You already have to verify your identity to the carrier if you want to make changes to your account, and while you might be able social-engineer your way past it, but I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes. Saying the carrier needs to be sure before making changes is useless if the person at the carrier is circumventing it. Plus they already do it.
- ergothus 7y ago
  > while you might be able social-engineer your way past it, My personal experiences and various accounts I've heard make this "might" shift to "fairly easily". Why are you so confident that it has to be someone with inside knowledge? > I would be shocked if someone like Jack Dorsey didn't have a password associated with his account that is required to make changes I do not share your trust. I'd be shocked if he didn't NOW, but you are basing your assumption off of what...that he recognized his status as a high profile target? Were that the case I doubt this vulnerability would have existed.

nullc 7y ago

My experience is that after you give your phone number to most companies it effectively becomes a single factor: it's trivial to get them to change passwords with that alone. AFAICT, the only protection is to not give them your phone number in the first place.

ineedasername 7y ago
> "the only protection is to not give them your phone number in the first place." That has its own risks. If you don't provide it to google and your account gets hacked, it's extremely hard to get it back. (My wife lost her original gmail account that way about 2 years ago. And of course there was no way to get any live support to try & fix it) Basically if you don't provide your number, you're more open to the more prevalent traditional hacking. If you do provide a number, you're more open to a slightly less prevalent type of hacking. It doesn't leave much to choose from.
- velosol 7y ago
  > "It doesn't leave much to choose from." With Google anyway you're down to 2FA using an authentication app (possibly U2F but I haven't checked on that recently) and backup codes which should also protect you from traditional hacking.
- rkagerer 7y ago
  I've read of many cases of folks losing access to their personal Google account through no fault of their own, and winding up helpless to get it back. Almost happened to me after I was victim of a SIM Swap. From the article, even the Twitter CEO has this problem: While he has managed to get back his social media accounts, he has not regained access to two Google email accounts that held years of communications. If anyone with directional authority at Google is out there: It would be really decent of you to provide some means of customer service for consumers stuck in this catch-22. I can't accept there's no reasonable way to perform an identity confirmation beyond the laughably limited self-help measures currently in place. If it's a matter of economics, make it pay-per-use.
iamnotacrook 7y ago

wobbly_bush 7y ago

Indian laws require a police report before telecom operators can transfer a line to a new SIM card. I was always surprised how easy it is in US to transfer in comparison.

vishnugupta 7y ago
I guess that's only for lost SIM cards? I've got my number transferred to new SIM card, about 30 times over last 10 years, without any police report. Had to produce ID proof which is quite convenient.
- wobbly_bush 7y ago
  In those cases you would have the physical possession of the old SIM, so I guess no one can just claim to be you. Example form for others reading till here - https://discover.vodafone.in/documents/pdfs/simreplacement/sim_replacement_form_mah.pdf https://discover.vodafone.in/documents/pdfs/simreplacement/s...
avip 7y ago
In India I had to give a photocopy of my passport, my permanent address in India, and a letter of referral from an Indian citizen to get my Airtel sim card. It was one of the weirdest experiences I've had in the country.

jethro_tell 7y ago

It's always kindof annoyed me they don't offer a u2f auth mechanism. Can't be that hard for a company of that size.

kbar13 7y ago
they do https://www.yubico.com/works-with-yubikey/catalog/twitter/ https://www.yubico.com/works-with-yubikey/catalog/twitter/
- jethro_tell 7y ago
  Hey, nice. Setting this up now. They didn't have it last time I checked.

vxNsr 7y ago

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps). Better yet, a YES text should be required with a port

hirsin 7y ago
You've led a fortunate life, if you've never had a phone utterly and completely destroyed or lost. Having the SIM ruined is a rough time. I believe t-mobile has a nice requirement of being able to mark you number as "show up in the store and show your ID"
- vxNsr 7y ago
  > I believe t-mobile has a nice requirement of being able to mark you number as "show up in the store and show your ID" Yup, and yet I've heard of stories of people social engineering their way around that. the telecom companies need to make it impossible for a CSR to access your account at all without actual verifying data from you.
thorwasdfasdf 7y ago
Or require YES text for immediate port. Then if you can't do that because you've lost your phone, then it should delay for 24 hours, then do the port.

drewmol 7y ago

There's an MVNO owned by the Canadian ISP tucows called Ting, I used them for my primary mobile service for some time (I would still but I wanted access to Verizon's 700 and 800 Mhz bands for better coverage at my residence so I switched). Anyhow last time I checked they've since added several awesome (and self configurable via their account dashboard) features like multi factor auth settings for # porting, comprehensive forwading options, port locking, locking a line to a sim or device, among other security related overlays to their service some assible via REST API, IIRC. They offer live, immediatly accessable by phone call, north american based (US/Canada), friendly, usually native english spreaking knowledgable support agents and start their minimum service tier pricing at $6/line/month with the ability to toggle (block) voice, sms and data services for each line. For < $90/yr you can configure a pretty secure dedicated line for 2FA.

vageli 7y ago
> There's an MVNO owned by the Canadian ISP tucows called Ting, I used them for my primary mobile service for some time (I would still but I wanted access to Verizon's 700 and 800 Mhz bands for better coverage at my residence so I switched). Anyhow last time I checked they've since added several awesome (and self configurable via their account dashboard) features like multi factor auth settings for # porting, comprehensive forwading options, port locking, locking a line to a sim or device, among other security related overlays to their service some assible via REST API, IIRC. They offer live, immediatly accessable by phone call, north american based (US/Canada), friendly, usually native english spreaking knowledgable support agents and start their minimum service tier pricing at $6/line/month with the ability to toggle (block) voice, sms and data services for each line. For < $90/yr you can configure a pretty secure dedicated line for 2FA. Wow, I use this company for my elderly father for a resounding monthly bill of ~$7/8 for years and had no idea they were also Tucows.
- StudentStuff 7y ago
  Tucows has been terrible in handling a client of mine's issues, their domain has no SPF or DKIM, and thus their email is unreliably making it to customer's inboxes. If anyone has pointers on how to get a domain & email address that are both bought & hosted with Tucows up to snuff with the email security standards of yesteryear (SPF & DKIM), I would really appreciate it!

thorwasdfasdf 7y ago

> Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud This is an excellent idea. And I wish all the cell phone carriers would adopt this, if not already.

PopeDotNinja 7y ago

I don't like being limited to 2FA using SMS. As soon as your phone isn't available, you're out of luck :P

TwoBit 7y ago
Just get a Google phone number. My Google phone number is secret and non-port-able.