3 ms·
I think those who think this misunderstand the type of security it is meant to provide. It's not about blocking account takeover attempts. Services mostly don't
by ufmace 6y ago
I think those who think this misunderstand the type of security it is meant to provide. It's not about blocking account takeover attempts. Services mostly don't really care about that, because it doesn't affect the service as a whole. It's about reducing spam, bots, and other organized hostile activity towards the service as a whole. It's tough to create a bunch of accounts in a way that the site can't easily track if you have to provide a real phone number. Yes, everybody knows about buying phone services on the internet, and they do seem to have ways to block using those numbers.
Pretty much every service does this. Try signing up for a Google, Facebook, or Twitter account without providing a real phone number. Usually if it works at all, the account created will be rapidly blocked until you do provide one.
- rvz 6y agoThen I will get spam through my phone number then each time I register it for 'SMS authentication'. Then you'll later ask how did these services not only get my phone number, but also upload my entire address book for 'security reasons'. A captcha is more than enough.
- ufmace 6y agoYou're right that you may get a lot of noisy authentication spam texts. Alas, none of the companies involved seem to care. Judging by their popularity, most of their users don't seem to care much either. Is a captcha enough? I've never worked in bot/spam mitigation for a large public platform before, so I don't really know. Based on how universal phone number requirements are for these services, and how much trouble they seem to have gone to in order to block using easily purchased numbers, I'm going to guess that captchas aren't enough.
- Can_Not 6y agoIt's hard to say captchas are or aren't enough because you know most companies just want your phone number for ulterior motives.