12 ms·

Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the bigg

Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the biggest tech companies in the industry do it anyway. I recently got locked out of my Amazon account because I made a large purchase after not ordering anything for ~6-7 months. During the reset process, they tried really hard to get me to set a phone number 'for account security'. From what I could tell from their documentation, it's not even just used for 2FA, it's literally just a way to prove my identity if I need to reset my password. I refused, and then a few days later Amazon called me up to reconfirm the order anyway, even though I had never given them my number. Their entire account recovery process from that point on was based on me having access to information that was already listed on my account, that the hacker would have 100% had access to. It was all just security theater, literally the only thing that mattered was I had access to my email and a phone number. Fastmail (to its credit) allows you to have 2FA without a recovery number, but it requires you to add a recovery number, activate a real 2FA app, and then delete the number. At least it doesn't (as far as I know) use the number on its own for account recovery. Twitter's CEO got hacked because Twitter trusted phone numbers as identity, and they still haven't changed the policy, because collecting phone numbers is fun or something. In theory, a 2FA over SMS is better than nothing. In practice, it trains customers to be insecure and should be avoided. It trains customers to think that identity verification over text is OK. In practice, you can't trust companies not to use it for advertising, or to start using it as identity verification in the future. In practice, there are very, very few legitimate reasons why a company should ever need my phone number, and pretty much none of them have anything to do with security. 99% of your users should be using a 2FA app instead of a phone number. Companies like Twitter should be shamed for misusing security information this way, but they should also be shamed for using insecure authentication methods. I'm convinced that 5 years from now, we're going to look back at SMS authentication the same way we looked at serving login pages over HTTP.

tictok4 7y ago
>biggest tech companies in the industry do it anyway. because it provides identity.
- ubercow13 7y ago
  No it doesn't, it just provides proof that you currently have access to that phone number. Phone numbers are not identity.
  - criley2 7y ago
    So, then, the only option is multi-factor biometrics. Everything else is just "not identity", right? And even then, biometrics can't usually differentiate between twins. For twins, there is arguably no way for software to demonstrate identity, ever. Social security? Proves you're holding a card. Biometrics? Proves you're one of multiple with these exact genetics. Etc. I literally cannot think of a way to definitively and authoritatively tell twins apart in software.
    - simpss 7y ago
      I have a public/private key-pair from my local government. Comes with my passport and is guaranteed by the gov to represent a single person only. Although, I wouldn't want to give the public key to google/amazon/facebook/twitter :)
      - criley2 7y ago
        In the twin example, what is to prevent your twin from taking your documentation and receiving a public/private key in your name? Or simply access that key of yours and use it? The public/private key only prove you hold the keys, not that you are you. Not identity, just proves you have access to the keys.
  - propogandist 7y ago
    Most people aren't walking around with one time phone numbers, they have a phone number that's shared by family, friends and co-workers that will consistently resolve to the same individual whenever someone wants to connect. Being a unique number that is tied to a single individual, it can function as a proxy for identity. This, obviously, assumes you are operating like the average user.
jdm2212 7y ago
For the 98% of people who aren't high-value targets (CEOs, journalists, etc), a phone number is a perfectly adequate second factor.
- kofejnik 7y ago
  ... until you become a medium-value target for someone (maybe in a business-related dispute), and now your email is easily hackable
- danShumway 7y ago
  I have two objections to this. First, I disagree that only high-value targets are at risk. I think, in general, targets are at risk for SIM-jacking. You can be a target because you're Jack Dorsey, but you can also be a target because you suddenly get swept up in a Twitter controversy, or because you run a corporate social media account, or because an ex-partner decides they want revenge over something. A lot of our security protects against untargeted attacks because they're more common, but targeted attacks can't be completely ignored. The second problem I have is that high-value targets use Facebook, Twitter, and Amazon, and they should be able to use these sites without worrying that their accounts are by-default insecure. We're not talking about a local library account, these are the biggest tech companies in the world. The president of the United States uses Twitter. I think that taking a strong stance on security is important in that scenario. I'm assuming (hoping) that Trump's account is secured with a phone-number that isn't public and that can't be SIM-swapped. But who knows, Dorsey's wasn't.
- bradleybuda 7y ago
  Especially in the absence of a universally available, universally usable alternative. The user experience of TOTP authenticator apps, paper recovery codes, and (so far) U2F tokens just isn't there yet, and the negative impact to individuals from being inadvetantly locked out by the loss of their second factor is massive. SMS for recovery is deeply flawed, but it's 1) better than nothing and 2) better than any current alternative for the vast majority of people.
  - ubercow13 7y ago
musicale 7y ago
> It was all just security theater, literally the only thing that mattered was I had access to my email and a phone number. Don't they need a phone call to identify that it's really you by matching your voice print against Alexa recordings? ;-)
- jethro_tell 7y ago
  Alexa, who am i?
GhostVII 7y ago
I think it is important to separate out criticisms of 2FA over sms, and companies who say they have 2FA. I think even in practice 2FA over sms is definitely better than nothing, it's a lot harder to both guess someone's password, and put in the work to hijack their phone number. But as you said, many big tech companies say they have 2FA, when they really are just giving you two ways of logging in, where one of those ways is incredibly insecure. It seems crazy to me that recovery numbers are a thing. I mean I'm sure it helps reduce customer service load, since people just recover over sms rather than trying to call and get their account re-activated, but it is so insecure.
- danShumway 7y ago
  I am sympathetic to claims that 2FA over SMS is better than nothing, because technically it is completely true. You're right. However, as a user, I go back to the idea that I can't think of many companies I trust to only use my phone number as 2FA and not as identity verification. So I'm am skeptical that it is good to train users to trust SMS 2FA, because those same users will probably not be able to distinguish between 2FA and identity verification when they sign up for other services. It is better to teach users a simple rule (never give out your phone number) than a complex rule (only give out your number for this specific use-case). The other big thing I just can't get past is that nearly everyone today has a smartphone that will run a 2FA app, and that even users who don't have a smartphone would be better served by getting codes delivered to their email. So sure, it's better than nothing. But there are even better options that exist that aren't that hard for us to switch to. In practice, even if you know you're only going to use SMS for 2FA, I now lean towards saying you shouldn't use SMS at all. Treat email like the backup SMS option, and just get rid of phone numbers entirely. Maybe the dynamics of that change for some developing countries? But Twitter, Facebook, and Amazon all know what country I live in. If they want to offer an SMS option for India because of some extenuating circumstance I can't think of, they should still have the good sense to at least discourage SMS verification for accounts that are based in the USA or Europe.
  - beerandt 7y ago
    Yeah, this is basically the same thing that happened with social security numbers. Companies promised only to use it to verify they had the correct credit file, but +/- 90 years later it's a defacto ID that no longer has any security value. Edit: I suppose phone numbers can at least be changed, but that doesn't really solve the problem for 2fa as it might for SS numbers.
scolby33 7y ago
If you hold down Alt/Option on the Fastmail security page you can enable 2FA without a phone number. Their helpful support person cautioned me to not lose my 2FA device or recovery codes :)
themagician 7y ago
I actually blame AT&T and Verizon for this. They make it FAR too easy to transfer a number to a new phone. 2FA aside, losing control of your phone number can cause all sorts of damage. If it was harder to transfer a number to a new phone it wouldn't be that bad to use that method of 2FA for non-critical services.
- codazoda 7y ago
  Then blame the government because telco's didn't used to allow number transfering. Then consumers complained and the government made it mandatory. /Citation needed/
  - themagician 7y ago
    They didn't allow number transfers between carriers, but they did always allow number transfers within carriers AFAIK. Perhaps there was a time when numbers were hard tied to SIMs and I'm too young to remember?
- maest 7y ago
  Is it really the telco's fault, though? It seems that telcos suddenly found themselves pushed in the business of identity management and proffing without haing any intention of doing that. Telco's never made any claims about tieing your identity to your phone number - they just move information around. Blaming telcos is like blaming a hammer for not being big enough when you're tring to drive a screw with it.
  - themagician 7y ago
    It's definitely not like that at all. It's not even really identity management. It's just way too easy to transfer a phone number. A simple protocol like, sending a text or email to the information on file and then waiting 24 hours to complete the transfer would be enough to stop 99% of number transfers. Instead they process these transfer instantly, often using very little information to verify that the request was legitimate. You can often sweet talk the customer service reps with simple, "I forgot what information I used to sign up." They process that request and then it ruins your life and haunts you for the next 5 years.
kevin_thibedeau 7y ago
What happens when you have a "proper" second factor and lose it?
- danShumway 7y ago
  The consequences of getting locked out of my bank account because I've lost my 2FA method are pretty bad -- that would be a major inconvenience. They are better than the consequences of getting locked out my bank account because someone stole my phone number -- especially since the first thing someone who SIM-swaps will do is change the recovery number to point to a separate phone they own. I'll have to go through the exact same recovery steps, just with the added pressure of having money siphoned from my account. Most 2FA app setups come with one-time backup codes that you can write down in paper and stick inside a safe or your wallet. If you don't think customers will do that, and you're still worried about account recovery, using email instead of SMS is preferred. For all the crap I regularly give Google, their security team is top-notch, and I generally trust most people's Gmail accounts to be more secure then their phone numbers. The only scenario I can think of where a service couldn't rely on email for account recovery is if you yourself are an email service like Fastmail.
  - koolba 7y ago
    A big difference is your bank (likely) has a physical branch where you could show up with your ID card, debit card, etc. the inconvenience can be addressed directly if there’s an emergency. For online only businesses there’s no escape hatch.
    - danShumway 7y ago
      In my specific case, I use an online-only bank. But I'm being petty with that objection, my bank still has enough information about me that I could verify my identity via a combination of a scanned ID card, proof of residence, etc... In general, point taken, that's a good distinction for most people. However, substitute 'bank' out for any online-only service and the problem persists, because any reasonably smart attacker who SIM-swaps my account will still immediately change the phone number to point to themselves. If my Amazon account gets hacked, and the attacker goes into account recovery and changes the phone number, Amazon still needs a non-SMS based escape hatch for me to get the account back. The problem hasn't gone away. So why not just use the non-SMS escape hatch all the time? In Amazon's case, if they don't have your phone number they'll do account recovery over email. That's almost strictly safer, and just about as convenient as SMS.
cwkoss 7y ago
I recently had a third-party seller from an Amazon purchase send me a marketing postcard. Item was "fulfilled by Amazon", so transmitting my address to the seller was not needed to fulfill my order. The postcard contained a call-to-action to visit a URL. Fortunately, I was suspicious and went there in an incognito window, because it redirected to use a signed-in facebook session to send themselves a message, presumably to harvest more data about me. I wrote a review on the product condemning this practice and Amazon removed the review as "not about the product". Quite frustrating - seems Amazon just doesn't care about customer privacy.
- agret 7y ago
  > I wrote a review on the product condemning this practice and Amazon removed the review as "not about the product". Quite frustrating - seems Amazon just doesn't care about customer privacy. The way Amazon reviews works is that it combines reviews of the same product (even different variations of the same product) so mentioning anything about an individual seller in "ask a question" or "write a review" is meaningless as it applies to the whole site. It makes sense why they would take this action.
  - cwkoss 7y ago
    Do you know if there is a way to "report a seller" or something like that? I was unable to find any option for this in their support system.
    - Qub3d 7y ago
      I was going to say yes, and also show you how to review a seller, but I'm shocked to report that apparently Amazon removed any way to directly review or comment on a seller as of their latest site design. So I suppose there isn't outside of emailing or contacting Amazon support directly. That's a real shame, because if anything I suspect sellers on Amazon have become less trustworthy in general, not more.
      - cwkoss 7y ago
manjana 7y ago
Have you ever heard about Blur? It lets you mask your true identity by offering masked email addresses, credit cards and phone numbers. The company behind Blur is called Abine. Their core service which is providing masked cards and phone numbers requires American citizenry and a fee. But IMO, it's well worth it.
aasasd 7y ago
It's not for 2fa that phone numbers are required. It's to deter spam accounts. Though, if sim-swapping is too costly to do en-masse, then I guess it might be an effective 2fa method for an average user. But not for ones likely to be targeted.
greggman2 7y ago
Apple always asks for a phone number. Google I don't think you can sign up without a phone number. Yes, it drives me crazy. I'm travel often and stay abroad often. I use different sims so my phone number changes so even if they wanted to contact me via the phone number to send an SMS or whatever they often can't. I can sign up for an internet run number but the entire point is I don't want a have to deal with a phone number in 2019. People don't call me anymore. If they want to talk they use one of the 150 messenging services that are free.
Kalium 7y ago
> Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the biggest tech companies in the industry do it anyway. From the security side, this is incredibly frustrating. Very often there's someone in product management who insists that users love SMS-factor. That it's great because users don't have to use a special app or transfer it when they change phones. They will be backed up by an engineer who swears that SMS is great because using a TOTP app is an unacceptable corporate imposition on their personal device. Meanwhile, someone in finance quietly sobs as they pay the Authy or Twilio bill, but nobody seems to care about the opex budget.
- toastal 7y ago
  How does FIDO fit in here?
  - Kalium 7y ago
    It's a good idea. Inconveniently, it's also one that most consumers are unfamiliar with and not really prepared to implement. This is not made easier by the hardware complexities. What if the user has a slightly dated PC (USB A), an iPhone pre-USB C, and a modern Mac?
gnopgnip 7y ago
The phone number is not used for individual account security, it is there to increase the cost of creating accounts in most cases. For services like gmail, this is an important step in cutting down on spam In Amazon's case, the real security is the credit card info. If you tried to add a new address you would need to confirm the credit card info, even if you sim swapped the account owner.
- danShumway 7y ago
  > The phone number is not used for individual account security, it is there to increase the cost of creating accounts in most cases. Then why can I reset my password with it? The spam issue is separate. Twitter can ask a user to give them some kind of proof that they're not creating duplicate accounts. There's nothing in that process that requires them to then take that info and make the account less secure. Once they've verified the user is human, they could just throw the number away -- instead, they use it for account recovery. Even with Amazon: > In Amazon's case, the real security is the credit card info. I was able to recover my account with just an email address and a phone call. I'm pretty sure you're right that an attacker couldn't enter a new address. I'm not sure whether re-entering credit card info is required to use Amazon locker. I'm also pretty sure it's not required for digital purchases like music and movie rentals, although I guess it wouldn't be as big a deal for Amazon to refund those later. But this goes back to the same question: if the real security is the credit card information, then why is the SMS recovery option there? It's not secure, we have to rely on other mechanisms on top of it to keep people from doing really harmful stuff. Amazon still won't let you set up a 2FA method without a phone number. SMS 2FA has nothing to do with spam, it's just bad security. You can do spam prevention without incorporating the number into 2FA or account recovery.
mattacular 7y ago
What practical ways are there for a company like Twitter to verify your identity for purposes of account restore verification without using some increasingly unreliable piece of info like phone or social security numbers? The available alternative today is a token 2FA, which has to be setup and requires some savvy, and a number of one-off security codes which are issued at account creation and then the user must figure out how to store securely, indefinitely. Forcing this on the avg Twitter user is obviously a nonstarter.
- ghaff 7y ago
  It's certainly a conundrum. Depending upon the type of account involved, there has to be some reasonable medium between 1. Accounts/resets performed because you asked nicely and maybe provided some laughably easy-to-obtain information and 2. Showing up at the Twitter office in San Francisco with notarized copies of your birth certificate, latest utility bill, Social Security Card, etc. And that happy medium will doubtless be both vulnerable to a determined targeted attack and a sufficient PITA for some users that they'll end up losing access to an account.

tictok4 7y ago

>biggest tech companies in the industry do it anyway. because it provides identity.

ubercow13 7y ago
No it doesn't, it just provides proof that you currently have access to that phone number. Phone numbers are not identity.
- criley2 7y ago
  So, then, the only option is multi-factor biometrics. Everything else is just "not identity", right? And even then, biometrics can't usually differentiate between twins. For twins, there is arguably no way for software to demonstrate identity, ever. Social security? Proves you're holding a card. Biometrics? Proves you're one of multiple with these exact genetics. Etc. I literally cannot think of a way to definitively and authoritatively tell twins apart in software.
  - simpss 7y ago
    I have a public/private key-pair from my local government. Comes with my passport and is guaranteed by the gov to represent a single person only. Although, I wouldn't want to give the public key to google/amazon/facebook/twitter :)
    - criley2 7y ago
      In the twin example, what is to prevent your twin from taking your documentation and receiving a public/private key in your name? Or simply access that key of yours and use it? The public/private key only prove you hold the keys, not that you are you. Not identity, just proves you have access to the keys.
- propogandist 7y ago
  Most people aren't walking around with one time phone numbers, they have a phone number that's shared by family, friends and co-workers that will consistently resolve to the same individual whenever someone wants to connect. Being a unique number that is tied to a single individual, it can function as a proxy for identity. This, obviously, assumes you are operating like the average user.

jdm2212 7y ago

For the 98% of people who aren't high-value targets (CEOs, journalists, etc), a phone number is a perfectly adequate second factor.

kofejnik 7y ago
... until you become a medium-value target for someone (maybe in a business-related dispute), and now your email is easily hackable
danShumway 7y ago
I have two objections to this. First, I disagree that only high-value targets are at risk. I think, in general, targets are at risk for SIM-jacking. You can be a target because you're Jack Dorsey, but you can also be a target because you suddenly get swept up in a Twitter controversy, or because you run a corporate social media account, or because an ex-partner decides they want revenge over something. A lot of our security protects against untargeted attacks because they're more common, but targeted attacks can't be completely ignored. The second problem I have is that high-value targets use Facebook, Twitter, and Amazon, and they should be able to use these sites without worrying that their accounts are by-default insecure. We're not talking about a local library account, these are the biggest tech companies in the world. The president of the United States uses Twitter. I think that taking a strong stance on security is important in that scenario. I'm assuming (hoping) that Trump's account is secured with a phone-number that isn't public and that can't be SIM-swapped. But who knows, Dorsey's wasn't.
bradleybuda 7y ago
Especially in the absence of a universally available, universally usable alternative. The user experience of TOTP authenticator apps, paper recovery codes, and (so far) U2F tokens just isn't there yet, and the negative impact to individuals from being inadvetantly locked out by the loss of their second factor is massive. SMS for recovery is deeply flawed, but it's 1) better than nothing and 2) better than any current alternative for the vast majority of people.
- ubercow13 7y ago

musicale 7y ago

> It was all just security theater, literally the only thing that mattered was I had access to my email and a phone number. Don't they need a phone call to identify that it's really you by matching your voice print against Alexa recordings? ;-)

jethro_tell 7y ago
Alexa, who am i?

GhostVII 7y ago

I think it is important to separate out criticisms of 2FA over sms, and companies who say they have 2FA. I think even in practice 2FA over sms is definitely better than nothing, it's a lot harder to both guess someone's password, and put in the work to hijack their phone number. But as you said, many big tech companies say they have 2FA, when they really are just giving you two ways of logging in, where one of those ways is incredibly insecure. It seems crazy to me that recovery numbers are a thing. I mean I'm sure it helps reduce customer service load, since people just recover over sms rather than trying to call and get their account re-activated, but it is so insecure.

danShumway 7y ago
I am sympathetic to claims that 2FA over SMS is better than nothing, because technically it is completely true. You're right. However, as a user, I go back to the idea that I can't think of many companies I trust to only use my phone number as 2FA and not as identity verification. So I'm am skeptical that it is good to train users to trust SMS 2FA, because those same users will probably not be able to distinguish between 2FA and identity verification when they sign up for other services. It is better to teach users a simple rule (never give out your phone number) than a complex rule (only give out your number for this specific use-case). The other big thing I just can't get past is that nearly everyone today has a smartphone that will run a 2FA app, and that even users who don't have a smartphone would be better served by getting codes delivered to their email. So sure, it's better than nothing. But there are even better options that exist that aren't that hard for us to switch to. In practice, even if you know you're only going to use SMS for 2FA, I now lean towards saying you shouldn't use SMS at all. Treat email like the backup SMS option, and just get rid of phone numbers entirely. Maybe the dynamics of that change for some developing countries? But Twitter, Facebook, and Amazon all know what country I live in. If they want to offer an SMS option for India because of some extenuating circumstance I can't think of, they should still have the good sense to at least discourage SMS verification for accounts that are based in the USA or Europe.
- beerandt 7y ago
  Yeah, this is basically the same thing that happened with social security numbers. Companies promised only to use it to verify they had the correct credit file, but +/- 90 years later it's a defacto ID that no longer has any security value. Edit: I suppose phone numbers can at least be changed, but that doesn't really solve the problem for 2fa as it might for SS numbers.

scolby33 7y ago

If you hold down Alt/Option on the Fastmail security page you can enable 2FA without a phone number. Their helpful support person cautioned me to not lose my 2FA device or recovery codes :)

themagician 7y ago

I actually blame AT&T and Verizon for this. They make it FAR too easy to transfer a number to a new phone. 2FA aside, losing control of your phone number can cause all sorts of damage. If it was harder to transfer a number to a new phone it wouldn't be that bad to use that method of 2FA for non-critical services.

codazoda 7y ago
Then blame the government because telco's didn't used to allow number transfering. Then consumers complained and the government made it mandatory. /Citation needed/
- themagician 7y ago
  They didn't allow number transfers between carriers, but they did always allow number transfers within carriers AFAIK. Perhaps there was a time when numbers were hard tied to SIMs and I'm too young to remember?
maest 7y ago
Is it really the telco's fault, though? It seems that telcos suddenly found themselves pushed in the business of identity management and proffing without haing any intention of doing that. Telco's never made any claims about tieing your identity to your phone number - they just move information around. Blaming telcos is like blaming a hammer for not being big enough when you're tring to drive a screw with it.
- themagician 7y ago
  It's definitely not like that at all. It's not even really identity management. It's just way too easy to transfer a phone number. A simple protocol like, sending a text or email to the information on file and then waiting 24 hours to complete the transfer would be enough to stop 99% of number transfers. Instead they process these transfer instantly, often using very little information to verify that the request was legitimate. You can often sweet talk the customer service reps with simple, "I forgot what information I used to sign up." They process that request and then it ruins your life and haunts you for the next 5 years.

kevin_thibedeau 7y ago

What happens when you have a "proper" second factor and lose it?

danShumway 7y ago
The consequences of getting locked out of my bank account because I've lost my 2FA method are pretty bad -- that would be a major inconvenience. They are better than the consequences of getting locked out my bank account because someone stole my phone number -- especially since the first thing someone who SIM-swaps will do is change the recovery number to point to a separate phone they own. I'll have to go through the exact same recovery steps, just with the added pressure of having money siphoned from my account. Most 2FA app setups come with one-time backup codes that you can write down in paper and stick inside a safe or your wallet. If you don't think customers will do that, and you're still worried about account recovery, using email instead of SMS is preferred. For all the crap I regularly give Google, their security team is top-notch, and I generally trust most people's Gmail accounts to be more secure then their phone numbers. The only scenario I can think of where a service couldn't rely on email for account recovery is if you yourself are an email service like Fastmail.
- koolba 7y ago
  A big difference is your bank (likely) has a physical branch where you could show up with your ID card, debit card, etc. the inconvenience can be addressed directly if there’s an emergency. For online only businesses there’s no escape hatch.
  - danShumway 7y ago
    In my specific case, I use an online-only bank. But I'm being petty with that objection, my bank still has enough information about me that I could verify my identity via a combination of a scanned ID card, proof of residence, etc... In general, point taken, that's a good distinction for most people. However, substitute 'bank' out for any online-only service and the problem persists, because any reasonably smart attacker who SIM-swaps my account will still immediately change the phone number to point to themselves. If my Amazon account gets hacked, and the attacker goes into account recovery and changes the phone number, Amazon still needs a non-SMS based escape hatch for me to get the account back. The problem hasn't gone away. So why not just use the non-SMS escape hatch all the time? In Amazon's case, if they don't have your phone number they'll do account recovery over email. That's almost strictly safer, and just about as convenient as SMS.

cwkoss 7y ago

I recently had a third-party seller from an Amazon purchase send me a marketing postcard. Item was "fulfilled by Amazon", so transmitting my address to the seller was not needed to fulfill my order. The postcard contained a call-to-action to visit a URL. Fortunately, I was suspicious and went there in an incognito window, because it redirected to use a signed-in facebook session to send themselves a message, presumably to harvest more data about me. I wrote a review on the product condemning this practice and Amazon removed the review as "not about the product". Quite frustrating - seems Amazon just doesn't care about customer privacy.

agret 7y ago
> I wrote a review on the product condemning this practice and Amazon removed the review as "not about the product". Quite frustrating - seems Amazon just doesn't care about customer privacy. The way Amazon reviews works is that it combines reviews of the same product (even different variations of the same product) so mentioning anything about an individual seller in "ask a question" or "write a review" is meaningless as it applies to the whole site. It makes sense why they would take this action.
- cwkoss 7y ago
  Do you know if there is a way to "report a seller" or something like that? I was unable to find any option for this in their support system.
  - Qub3d 7y ago
    I was going to say yes, and also show you how to review a seller, but I'm shocked to report that apparently Amazon removed any way to directly review or comment on a seller as of their latest site design. So I suppose there isn't outside of emailing or contacting Amazon support directly. That's a real shame, because if anything I suspect sellers on Amazon have become less trustworthy in general, not more.
    - cwkoss 7y ago

manjana 7y ago

Have you ever heard about Blur? It lets you mask your true identity by offering masked email addresses, credit cards and phone numbers. The company behind Blur is called Abine. Their core service which is providing masked cards and phone numbers requires American citizenry and a fee. But IMO, it's well worth it.

aasasd 7y ago

It's not for 2fa that phone numbers are required. It's to deter spam accounts. Though, if sim-swapping is too costly to do en-masse, then I guess it might be an effective 2fa method for an average user. But not for ones likely to be targeted.

greggman2 7y ago

Apple always asks for a phone number. Google I don't think you can sign up without a phone number. Yes, it drives me crazy. I'm travel often and stay abroad often. I use different sims so my phone number changes so even if they wanted to contact me via the phone number to send an SMS or whatever they often can't. I can sign up for an internet run number but the entire point is I don't want a have to deal with a phone number in 2019. People don't call me anymore. If they want to talk they use one of the 150 messenging services that are free.

Kalium 7y ago

> Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the biggest tech companies in the industry do it anyway. From the security side, this is incredibly frustrating. Very often there's someone in product management who insists that users love SMS-factor. That it's great because users don't have to use a special app or transfer it when they change phones. They will be backed up by an engineer who swears that SMS is great because using a TOTP app is an unacceptable corporate imposition on their personal device. Meanwhile, someone in finance quietly sobs as they pay the Authy or Twilio bill, but nobody seems to care about the opex budget.

toastal 7y ago
How does FIDO fit in here?
- Kalium 7y ago
  It's a good idea. Inconveniently, it's also one that most consumers are unfamiliar with and not really prepared to implement. This is not made easier by the hardware complexities. What if the user has a slightly dated PC (USB A), an iPhone pre-USB C, and a modern Mac?

gnopgnip 7y ago

The phone number is not used for individual account security, it is there to increase the cost of creating accounts in most cases. For services like gmail, this is an important step in cutting down on spam In Amazon's case, the real security is the credit card info. If you tried to add a new address you would need to confirm the credit card info, even if you sim swapped the account owner.

danShumway 7y ago
> The phone number is not used for individual account security, it is there to increase the cost of creating accounts in most cases. Then why can I reset my password with it? The spam issue is separate. Twitter can ask a user to give them some kind of proof that they're not creating duplicate accounts. There's nothing in that process that requires them to then take that info and make the account less secure. Once they've verified the user is human, they could just throw the number away -- instead, they use it for account recovery. Even with Amazon: > In Amazon's case, the real security is the credit card info. I was able to recover my account with just an email address and a phone call. I'm pretty sure you're right that an attacker couldn't enter a new address. I'm not sure whether re-entering credit card info is required to use Amazon locker. I'm also pretty sure it's not required for digital purchases like music and movie rentals, although I guess it wouldn't be as big a deal for Amazon to refund those later. But this goes back to the same question: if the real security is the credit card information, then why is the SMS recovery option there? It's not secure, we have to rely on other mechanisms on top of it to keep people from doing really harmful stuff. Amazon still won't let you set up a 2FA method without a phone number. SMS 2FA has nothing to do with spam, it's just bad security. You can do spam prevention without incorporating the number into 2FA or account recovery.

mattacular 7y ago

What practical ways are there for a company like Twitter to verify your identity for purposes of account restore verification without using some increasingly unreliable piece of info like phone or social security numbers? The available alternative today is a token 2FA, which has to be setup and requires some savvy, and a number of one-off security codes which are issued at account creation and then the user must figure out how to store securely, indefinitely. Forcing this on the avg Twitter user is obviously a nonstarter.

ghaff 7y ago
It's certainly a conundrum. Depending upon the type of account involved, there has to be some reasonable medium between 1. Accounts/resets performed because you asked nicely and maybe provided some laughably easy-to-obtain information and 2. Showing up at the Twitter office in San Francisco with notarized copies of your birth certificate, latest utility bill, Social Security Card, etc. And that happy medium will doubtless be both vulnerable to a determined targeted attack and a sufficient PITA for some users that they'll end up losing access to an account.