7 ms·
Twitter used phone numbers provided for security to target ads (2019)
- andrei_says_ 6y agoThis is serious abuse of privacy. I presume there are privacy laws covering this? And therefore the possibility of legal action on a large scale?
- KaiserPro 6y agodepends on the small print really. I suspect that it would be vague enough to allow "any data you provide to allow us to tailor your experience to you"
- DoofusOfDeath 6y agoIs there a way we (regular humans) can turn small-print-abuse against these companies? For example, could some of us: 1. Create a website or piece of software that we expect will be used by some employee of Facebook, Twitter, Microsoft, etc., from their employer's computers. 2. Include Terms of Service and/or clickwrap terms that tilted in our favor. E.g., enter a binding covenant to never perform telemetry of any kind, with clearly defined penalties. And the user also releases us from any obligations we have to them via previous agreements, such as the right to forced arbitration, or their pick of legal jurisdiction for lawsuits, or us covering their legal costs. 3. Once there's sufficient evidence that someone at one of these companies has accepted these terms, and violated them, drag them through the courts. Crowdsource our legal fees to prevent them from avoiding discovery, or settling out of court, or converting to class action and buying off the class's attorneys with an ineffective remedy. I see several acceptable outcomes of this: (a) A competent court establishes legal precedent that shrink-wrap licenses, and/or onerous EULAs / ToSs are unenforceable. And/or (b) We get some measure of justice by causing major financial damage to the companies and individuals who abused our trust in the first place, and perhaps some court-ordered consent degrees that will hobble those companies for decades. Or, worst case: (c) Those companies' lawyers wise up to the risk of their employees accepting such license terms. As a result, those companies become very risk-averse to letting their employees install software or visit unvetted websites. Which makes those companies less productive, and less capable of retaining technical talent that doesn't want to live under such restrictions. Thus planting the seeds of their death by a more agile competitor. EDIT: `s/two/several` because I can't count.
- ghastmaster 6y agoAccording to the arstechnica article covering this, they have been fined in the past and this current infraction is a violation of their original settlement, which is why they are facing a fine of close to $250m.
- rvz 6y ago> This is serious abuse of privacy. Websites that use 2FA Phone verification: Abuse of privacy? What's that? This is for your 'security' /s Honestly, I avoid services or websites that do this kind of nonsense.
- irishgeoff5 6y agoYou can always use a disposable phone numberfrom Textita to verify any account online. https://textita.com https://textita.com
- djrogers 6y agoThought I’d read about this before, and yes - this is old (2019) news.
- searchableguy 6y agoRelevant now due to the FTC drafting a fine for twitter: https://news.ycombinator.com/item?id=24051665 https://news.ycombinator.com/item?id=24051665 Can we change this submission to that?
- umeshunni 6y agoI thought so too, but couldn't find the previous discussion. Best I could find was https://news.ycombinator.com/item?id=19487304 https://news.ycombinator.com/item?id=19487304
- jsnell 6y agohttps://news.ycombinator.com/item?id=21196833 https://news.ycombinator.com/item?id=21196833
- nkrisc 6y agoFacebook did this to me as well. I provided a number long ago after they requested it under the premise of security (and it was used for that, as I recall), but then they started texting me about all the people I know posting stuff after I hadn't logged on for many months. I promptly blocked the number.
- frandroid 6y agoYou blocked your own number?
- Kalium 6y agoI believe they mean they blocked the number Facebook was using to text them from, after giving Facebook their phone number. Ergo, they did not block their own number.
- ghastmaster 6y agoIt looks like they were fined for that. https://arstechnica.com/tech-policy/2019/07/ftc-fines-facebook-5-billion-imposes-new-privacy-oversight/ https://arstechnica.com/tech-policy/2019/07/ftc-fines-facebo... > Additionally, the FTC said Facebook violated the earlier order by "misrepresenting" consumers' ability to opt out of facial recognition by using phone numbers provided for two-factor authentication for advertising purposes without notifying users and by storing user passwords without encryption.
- mgbmtl 6y agoInteresting bits: "No personal data was ever shared externally with our partners or any other third parties." Advertisers uploaded lists with email/phone, and Twitter matched them to users. In any case, it does not help paranoid people like me, who are always reluctant to share a phone number as a recovery method (I use self-hosted email, it's the most reliable recovery method, but I understand it's not an option for most people).
- probably_wrong 6y agoIncidentally, this is why I don't use 2FA on my Google account: because they won't let me enable it without giving a phone number first.
- ghastmaster 6y agoLast time I tried to make a new google account, I could not without a phone number. My original account created many years ago does not have 2FA because of the phone number requirement.
- ozim 6y agoJust got flashback from the time when I was downvoted to hell on HN when I wrote comment that Google is forcing sms 2FA just to get phone numbers.
- bergstromm466 6y agoYeah I’ve had this with certain things too. Is it groupthink? Naïveté?
- fermienrico 6y agoThis is the problem with downvoting. We need to ask for explanation about why something is being downvoted, especially for the first few downvotes because that's what that leads to a cascade. Positives of downvoting - I get it, it filters out the non-sense. Negatives of downvoting - Leads to herd and mob mentality - "Oh this is downvoted, I must also think this is bad since others thought so as well. Plunk, another downvote! Take that!" Especially right now when we have intense polarization and people are pulled away from centrist, ideological and sound perspectives into narratives, biases and prejudices. I've raised this before, but IMO - Downvoting does more harm than good in the long term. Short term benefits are that we get rid of trolls, rude people and actually false information.
- grazhero99 6y agoI think it should be fairly obvious to most here, but it bears repeating that any service which requires a phone number for 2FA is to be avoided like the plague.
- kanox 6y agoAs far as I can tell most new apps require a phone merely for registration. It's not even close to optional. Twitter pretends it doesn't but it locks you out in ~5 minutes if you don't verify your phone number.
- zimpenfish 6y agoBut on the plus side, if you then create another account and use the same phone number, I assume that phone number is now linked to the new account (because they tell you that it's owned by another user and it'll be claimed) and not the one you actually want to use.
- ffpip 6y agoI hate the fact that Google requires a phone number to set up 2FA. Only then does it show the Hardware/App options. A phone number, or an Android phone logged into the account
- three_seagrass 6y agoWhich companies allow 2FA without a phone number?
- coffeemaniac 6y agoIt's not a perfect "solution" but I've had so many instances of services requiring phone numbers for 2FA that I've dedicated a voip number for it.
- bzb3 6y agoMost websites have blocked VoIP numbers so you won't be able to use them for 2fa.
- dvtrn 6y agoI’ve come across this as well, and having worked in VoIP the common rationale is fraud prevention, which is a real problem that does exist-but I think it’s a rationale that has been quite misapplied or perhaps better to say, inappropriately applied as a blocker for using VoIP numbers for 2FA.
- coffeemaniac 6y agoIn my experiences the vast majority of websites allow it -- a select few disallow. Although that group will expand. One trick I've found is to register the 2FA with a "real" number, and then port that number to a voip service. I never use a real cell phone number for anything.
- hinkley 6y agoI've eyeballed family plans a couple times, in some cases it's just a minimum of 2 phones sharing a larger data pool. I've toyed with the idea of putting the 2nd SIM in my old phone and just having it around for... whatever, as long as it's not consuming data.
- marssaxman 6y agoI am completely unsurprised. This is why I will not provide my phone number for 2FA.
- wlesieutre 6y agoIt's also one of the least secure 2FA methods since you have to trust all your phone company's call center employees to not transfer your phone number to a new SIM controlled by someone impersonating you. Lots of reasons to not use SMS for 2FA.
- three_seagrass 6y agoPixel phones are now preventing sim swapping, IIRC, and maybe a few others.
- wlesieutre 6y agoPixel phones do? Or using Google Fi as your phone provider does? I would understand Fi having better protection because you have to manage it online through your Google account (and same for Google Voice users). Not sure what a phone would be able to do about it. Anyway, Google as your phone provider opens up a different can of worms. Instead of having an overly helpful support staff who can be tricked into doing things they shouldn't, now you have Google's algorithmic account bans and tie-in with Google Payments and no recourse for problems because the customer service is a robot that says "no". https://news.ycombinator.com/item?id=18886804 https://news.ycombinator.com/item?id=18886804 Nonexistent support is great in terms of resistance to social engineering, but sometimes you need support.
- gsich 6y agoThis is done by the mobile operator. Independent of the phone used.
- markdown 6y agoIn my country, every phone number is registered to a real human being, so a number can't be transferred to an anon.
- Topgamer7 6y agoLinkedin did this and I started getting cold calls from recruiters. Never uploaded my number, but I had the app on my phone.
- Ecstatify 6y agoTwitter seriously need a new C.E.O, really must be desperate to stoop this low.
- gsich 6y ago"surprise"
- techlaw 6y ago"will likely owe a fine of up to $250 million" https://arstechnica.com/tech-policy/2020/08/twitter-faces-ftc-probe-likely-fine-over-use-of-phone-numbers-for-ads/ https://arstechnica.com/tech-policy/2020/08/twitter-faces-ft...
- dang 6y agoCurrently discussed at https://news.ycombinator.com/item?id=24051665 https://news.ycombinator.com/item?id=24051665
- jb775 6y agoIt's so frustrating being forced to use your cell # to register. Obviously they're using it to tie together data. For the developers out there reading this: please be the change you want to see, or at least try. If your company wants to add a user requirement like this, be the person who speaks up against it.
- angel_j 6y agoPlease enter your birth date so that we can wish you happy birthday! Emoji emoji emoji.
- deleted 6y ago[deleted]