4 ms·
Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in
by ramraj07 6y ago
Are you from a first world country? It sounds like you're from a first world country! There's a legitimate reason to use phone numbers - email hasn't worked in many third world countries such as India. But everyone understands and has a mobile phone already, and thus it becomes perfectly manageable. This is why whatsapp succeeded, they zeroed in on the phone number (and the OTP instead of an account) as a way to authenticate and identify users. If someone's in your contact list, you instantly can connect with them! The level of integration of whatsapp into every aspect of the average indians life is insane and incomparable to what you might see with email or any tech software idea in a place like the US.
Furthermore, almost no service in India uses passwords, everyone uses OTPs. And initially people were not aware and there were lots of social engineering fraud, but now everyone knows not to share OTPs with others, and frankly this looks like a far more secure method than the password based auth systems prevalent in the western world.
Further there's an even bigger incentive in places like India - easy control of spam. I am not aware of any easy method to procure phone numbers here without linking it to your identity, so it becomes much harder for spam account creation. You could call this draconian but I don't see any problem with this behavior from the company's perspective.
- gowld 6y agoSpam is a behavior, not a person. But kf you want to demand ID, just demand ID! There's no reason to require phone or email; let the user choose their preference.
- j0ba 6y agoOTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number. This is not speculative. I've literally had to help relatives with this exact security breach. Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your only authentication factor is much less secure than a password + 2FA. An authenticator app, such as Authy, faces none of those security issues.
- ramraj07 6y agoI'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?
- jwandborg 6y ago"here" is relative. Here's one data, this one from Canada: https://youtu.be/LlcAHkjbARs https://youtu.be/LlcAHkjbARs at 3:48
- ramraj07 6y agoSeems like it's a problem in countries where companies bend over backwards to appease customers, also including when they shouldn't. In other places the agent will just go you're SOL if you called asking to change ownership.
- httpsterio 6y agoVery untrue, it's a pretty common way of stealing social media accounts like Twitter and YouTube accounts. Happens all over the place, definitely in places like USA.
- justinclift 6y ago> But everyone understands and has a mobile phone already ... This is NOT true. I used to live in part of Cornwall (South East UK) which has no mobile tower coverage. So, no mobile phone #. That became an extraordinary PITA once some idiotic major companies decided the "everyone has a mobile" meme was true. Mandatory 2FA using mobile number only text messages -> worst idea ever. :( :( :(
- ramraj07 6y agoMobile coverage is outrageously good in places like India. Except if you go to actual villages. But then if a place doesn't have running water or electricity and you're worried about logging into your bank account, I suppose reorienting priorities might be expected.
- Spooky23 6y agoIt’s even dumber where in the name of security they disable things like Google Voice that allow you to get SMS messages without cellular. Chase bank in the US decided to break this recently. Like you, geography means I don’t have a mobile in many scenarios.
- ntnlabs 6y agoI believe if in 3rd world country I would be able to sniff on GMS traffic and get OTPs easier than a regular password.