3 ms·
The value of asking for an arbitrary phone number is as a challenge of last resort. Let's say that you have given the provider no useful second factor, so the a
by jsnell 6y ago
The value of asking for an arbitrary phone number is as a challenge of last resort. Let's say that you have given the provider no useful second factor, so the account is potentially quite vulnerable to credential stuffing The phone number acts as a mechanism for rate limiting and imposing an economic cost on attackers.
To hijack accounts at bulk, you also need to procure phone numbers in similar quantities. The cost of a phone number is low, but so is the value of the average hijacked account.
- tjoff 6y agoIt is for marketing reasons.
- paulryanrogers 6y agoIt can be for more than one reason
- tjoff 6y agoBut the latter disqualifies it for the former.
- RNCTX 6y agoThe cost of google voice is free. If you go post something on craigslist and show your phone number as a contact method, I guarantee you that you will soon get spammed by google 2FA notifications. Around me they seem to be primarily set to a Vietnamese language. I live in the same city as the AT&T headquarters. AT&T and Google could also have systems to help prevent these scams, for instance I could specify the languages I speak and if SMS messages arrive in a different language, they could allow me an SMS command to flag a sender as the trigger-er of the phishing attempt. However, AT&T could also make a phone app for billing that loads menus in less than 30 seconds to a minute, and considering they've done neither I suppose I'll take the billing app first since it gets more use than craigslist does. After all, we only pay them 60 dollars a month for a phone and another 60-100 dollars a month for DSL for quite literally decades, so I wouldn't want to strain them by requesting too much in the way of a basic level of service.