7 ms·
You can't even sign up without a phone number. Never got an account or went on just for this reason alone.
by jmcan 6y ago
You can't even sign up without a phone number. Never got an account or went on just for this reason alone.
- rvz 6y agoMy point exactly why I don't use services that do this. Signal, Twitter, Facebook, Instagram, Telegram and all the like. It is plain silly to require phone number verification as a 'security mechanism'
- ampdepolymerase 6y agoThe engineering of Gab (politics aside) is probably worthy of a front page HN post. They run on Mastodon and their entire codebase is open source.
- eternalban 6y ago"We have diverged from Mastodon in several ways in pursuit of our own goals. [...]" https://code.gab.com/gab/social/gab-social/-/blob/develop/README.md https://code.gab.com/gab/social/gab-social/-/blob/develop/RE...
- cobraetor 6y agoThey started out as a Mastodon node, and then got blocked by the wider Fediverse. https://blog.alexgleason.me/gab-block/ https://blog.alexgleason.me/gab-block/
- eternalban 6y agoI laughed when his link to his article turned up a 404 at medium with account suspended. Not entirely sure yet if it was a morbid or cynical laugh. At a more technical level, do we need a 4xx code for "memory holed"? Was this an oversight of the IETF, or should Medium and other discerning and socially responsible content providers use the other available 4xx codes? Here, 404 "not found" is a pretty lie. We could start off with the basic 400 "bad request". This is closer to the truth. In fact, it is too close to the truth because it means "client error". (Is it a crime yet to click on "not found" articles?) So, ok, let's try 401 "unauthorized". This is still better than "not found" but, again, just a bit too honest. But, really, Medium.com should be responding with 403 "Forbidden". This is the unvarnished truth from the mouth of the server. 403 - Forbidden: "The request contained valid data and was understood by the server, but the server is refusing action. This may be due to the user not having the necessary permissions for a resource or needing an account of some sort, or attempting a prohibited action e.g. creating a duplicate record where only one is allowed)."
- Shish2k 6y ago"HTTP 451 - Unavailable For Legal Reasons” seems to be getting close?
- onlyfortoday2 6y agoIt is plain silly to require phone number verification as a 'security mechanism why?
- camdenlock 6y agoThere’s nothing secure about phone numbers, receiving secret codes via SMS, etc
- vbezhenar 6y agoIt is secure enough and it is the only reliable second factor to authorize that almost everyone possess.
- da_big_ghey 6y agoIt is less universal than e-mail (and potentially less-secure), and certainly less secure than TOTP. It also costs money, whereas the former two can be had for free.
- colejohnson66 6y agoIsn’t email hard to set up though? As in, Gmail silently dropping your emails even with DKIM set up properly? There’s services you can pay to have more luck, but then you’re at the same downside as texting
- da_big_ghey 6y agoYes, it absolutely is (though I do still run my own). I do know that it's easier than setting up a phone provider, however, which is more equivalent to setting up one's own ISP.
- bradford 6y agoA phone isn't being used alone though. It's just one part of a 2FA system, right?
- elipsey 6y agoi have simply assumed that the purpose of this requirement generally is for the platform owner to establish your real identity for monetization and/or indemnification, and that any benefit to the user is incidental. who ever said that "security" meant yours? ¯\_(ツ)_/¯
- ratsmack 6y agoIt's more of a bot prevention mechanism than identification, however, I believe it encourages people to be more responsible for what they post also.
- ufmace 6y agoI think those who think this misunderstand the type of security it is meant to provide. It's not about blocking account takeover attempts. Services mostly don't really care about that, because it doesn't affect the service as a whole. It's about reducing spam, bots, and other organized hostile activity towards the service as a whole. It's tough to create a bunch of accounts in a way that the site can't easily track if you have to provide a real phone number. Yes, everybody knows about buying phone services on the internet, and they do seem to have ways to block using those numbers. Pretty much every service does this. Try signing up for a Google, Facebook, or Twitter account without providing a real phone number. Usually if it works at all, the account created will be rapidly blocked until you do provide one.
- rvz 6y agoThen I will get spam through my phone number then each time I register it for 'SMS authentication'. Then you'll later ask how did these services not only get my phone number, but also upload my entire address book for 'security reasons'. A captcha is more than enough.
- ufmace 6y agoYou're right that you may get a lot of noisy authentication spam texts. Alas, none of the companies involved seem to care. Judging by their popularity, most of their users don't seem to care much either. Is a captcha enough? I've never worked in bot/spam mitigation for a large public platform before, so I don't really know. Based on how universal phone number requirements are for these services, and how much trouble they seem to have gone to in order to block using easily purchased numbers, I'm going to guess that captchas aren't enough.
- Can_Not 6y agoIt's hard to say captchas are or aren't enough because you know most companies just want your phone number for ulterior motives.
- api 6y agoParler asks for an absurd amount of PII. I always figured it was a way for the Mercer crowd to assemble a dossier on the extreme right for use in future highly targeted mobilization efforts.
- _-david-_ 6y agoWhich PII? I never created an account but my understanding was name, email and phone number which is no different than most social media.
- caseysoftware 6y agoExactly, this is misinformation. The only time they request additional PII is for verification. (As a security & privacy advocate with a job in the space, I dug into this last summer and again just before the January shutdown. It was never true just for signing up.)
- ConceptJunkie 6y agoMy experience was the same. I did pause at the phone number requirement, but frankly, it's not that uncommon, and is useful for 2FA.
- jmcan 6y agoI don't want to be all conspiratorial or anything but wasn't Parler hacked during the Capitol Hill protest and a bunch of protesters where caught? To me this seems like a successful honeypot.