8 ms·

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to rea

I probably hate it for different reasons from others on HN, but I move countries (and change numbers) and travel a lot, and SMS just isn't a reliable way to reach me. On top of that, attempting to log in to a website from a foreign country is often itself a trigger for 2FA, and exactly the moment when I'm not reachable by SMS. This has bitten me a few times, sometimes in desperate situations. Like when I've needed to log in to Airbnb to message a host, transfer some cash from my bank account, access my frequent flyer account, etc. Far too many sites don't provide 2FA over email, or through an app like Google Authenticator - they can only do it over SMS. Yeah, I know I could set up roaming. But it's an easy thing to forget, since I change phone numbers every couple of years (for both personal and work phones). And it's not always cheap. It's also just a huge pain to have to go through and change every account I have, any time I change numbers. A lot of accounts that I only use occasionally are configured with one of my many old phone numbers, which don't work anymore. This usually involves a call to tech support to fix it.

RileyJames 6y ago
Absolutely this. I currently have a document from my bank, that they emailed me. Which I’m suppose to print, write all my personal info on, plus a copy of my passport and FAX to them!! All because I want to change my phone number, and I’m overseas. Which I only need to change (or even have associated with my account at all) because they refuse to offer any other 2FA option.
chrismorgan 6y ago
I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10. Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, it silently unlinked my Australian Tax Office account. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (not TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that. When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.
- dbetteridge 6y ago
  The app does work by the way. It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard. But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS (Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)
  - chrismorgan 6y ago
    When I hear many reports of things flat-out not working in this way, I’m suspicious that it won’t work for me with my Samsung Galaxy J1 (2016) on Android 5.1, which Google has progressively broken by means of Google Play Services updates. As some typical examples of things that have been broken by Google Play Store updates: Fastmail notifications now only come through on wifi or (I found out last week) if Maps (by Google) is running in the foreground; and Hangouts is completely nonfunctional off wifi (can’t send or receive). It’s network-related things that are the least reliable. I really wish I could root it or install a new OS on it, but the former has failed and even with an unlocked bootloader the latter takes much too much effort if a prebuilt image isn’t available for your specific device, which roughly means “if you don’t have a flagship phone”.
    - dbetteridge 6y ago
      Oof yeah, if you're running an Android version that old I would not expect much to work that relies on Google services. That said if you're out of the country a lot and going the SMS auth route, I'd personally be more comfortable with a postpaid plan in AUS for the SIM as the telcos tend to take ID requirements more seriously for those then pre-paids and you're less likely to be socially engineered out of your number.
      - chrismorgan 6y ago
        “That old”, and yet the phone’s not even three years old (my instance of the model, that is; the model was at that point two years old and is thus now five years old). Sigh. I said prepaid, but as I did it it’s actually postpaid but with an initial $10 prepayment required. Ah, good times back in 2014–2017, getting those bills for less than a dollar (commonly 12¢) every quarter. Then I moved to a tiny country town where an Optus tower a few hundred metres away became my best option for internet, 50/25Mbps and far more solid than any NBN anecdote I’ve heard.
pentae 6y ago
Unfortunately, the only remedy to this i've found is to travel like james bond with two cell phones. I keep a second android phone with my 'back home' sim on the cheapest monthly plan possible and only turn it on to read sms codes. It really comes in handy when needing to sign up to a new service in your home country while abroad. Just don't forget to keep data roaming turned off
- jiggawatts 6y ago
  Newer phones have a second virtual e-SIM slot. Very handy when you're travelling. You set up your normal number on the e-SIM, and then you buy a data-only phyiscal SIM at the airport.
GhostVII 6y ago
This is why I switched over to a VOIP number instead. SMS works everywhere I have internet, and if I have to I just pick up a data-only sim card for wherever I am. Can even check my messages online. Probably not as secure, and wouldn't work well if I was regularly calling people, but for the most part it works fine and costs $1 a month.
- sodality2 6y ago
  $1/mo? Which provider is that? Twilio?
  - GhostVII 6y ago
    Voip.ms
- wryroybatty 6y ago
  Unfortunately voip, in my case voip.ms, does not work with all sms send methods.
the_duke 6y ago
Why don't you just get a dedicated "virtual" phone number for this purpose? It's not expensive. Skype is an obvious choice, but there are many other providers. Then you have a stable number and can read SMS via app web UI. I switched to the same method a few years ago. It's useful even if you don't travel much, just to not tie 2FA to your phone and for not giving all those services your real number.
- ydant 6y ago
  I have two virtual (US) numbers - one through Twilio (which I've enable short-code receive support for), and one on Google Voice. Both have failed to receive 2-factor messages from providers over the years. Very occasionally the Google Voice number is blocked explicitly by the provider as a VOIP number. It's just not a reliable 100% replacement for "real" SMS in my experience. Google Voice is close to acceptable as a replacement, and it's my primary 2-factor number when it works, but it's not 100% for reasons outside of my control.
  - inflorescer 6y ago
    >I have two virtual (US) numbers - one through Twilio I've heard good things, can you port a cell number in or is it strictly voip? (I haven't done anything phreaking adjacent in ages)
    - ydant 6y ago
      Seems porting is supported: https://support.twilio.com/hc/en-us/articles/223179348-Porting-a-Phone-Number-to-Twilio https://support.twilio.com/hc/en-us/articles/223179348-Porti... I used one of their existing pool of numbers. For inbound short-code support, you have to contact support directly and agree to a legal T&C for them to enable it.
dageshi 6y ago
I have also travelled a lot in the past... You presumably do have a "home" country in the sense of where your bank accounts are, get a cheap permanent sim/phone no with roaming, buy the tiniest phone you can off amazon and stick it in as your 2factor permanent number. Yes, you have to keep that phone charged, but your problem is now permanently solved, it's how I did it.

RileyJames 6y ago

Absolutely this. I currently have a document from my bank, that they emailed me. Which I’m suppose to print, write all my personal info on, plus a copy of my passport and FAX to them!! All because I want to change my phone number, and I’m overseas. Which I only need to change (or even have associated with my account at all) because they refuse to offer any other 2FA option.

chrismorgan 6y ago

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10. Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, it silently unlinked my Australian Tax Office account. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (not TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that. When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.

dbetteridge 6y ago
The app does work by the way. It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard. But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS (Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)
- chrismorgan 6y ago
  When I hear many reports of things flat-out not working in this way, I’m suspicious that it won’t work for me with my Samsung Galaxy J1 (2016) on Android 5.1, which Google has progressively broken by means of Google Play Services updates. As some typical examples of things that have been broken by Google Play Store updates: Fastmail notifications now only come through on wifi or (I found out last week) if Maps (by Google) is running in the foreground; and Hangouts is completely nonfunctional off wifi (can’t send or receive). It’s network-related things that are the least reliable. I really wish I could root it or install a new OS on it, but the former has failed and even with an unlocked bootloader the latter takes much too much effort if a prebuilt image isn’t available for your specific device, which roughly means “if you don’t have a flagship phone”.
  - dbetteridge 6y ago
    Oof yeah, if you're running an Android version that old I would not expect much to work that relies on Google services. That said if you're out of the country a lot and going the SMS auth route, I'd personally be more comfortable with a postpaid plan in AUS for the SIM as the telcos tend to take ID requirements more seriously for those then pre-paids and you're less likely to be socially engineered out of your number.
    - chrismorgan 6y ago
      “That old”, and yet the phone’s not even three years old (my instance of the model, that is; the model was at that point two years old and is thus now five years old). Sigh. I said prepaid, but as I did it it’s actually postpaid but with an initial $10 prepayment required. Ah, good times back in 2014–2017, getting those bills for less than a dollar (commonly 12¢) every quarter. Then I moved to a tiny country town where an Optus tower a few hundred metres away became my best option for internet, 50/25Mbps and far more solid than any NBN anecdote I’ve heard.

pentae 6y ago

Unfortunately, the only remedy to this i've found is to travel like james bond with two cell phones. I keep a second android phone with my 'back home' sim on the cheapest monthly plan possible and only turn it on to read sms codes. It really comes in handy when needing to sign up to a new service in your home country while abroad. Just don't forget to keep data roaming turned off

jiggawatts 6y ago
Newer phones have a second virtual e-SIM slot. Very handy when you're travelling. You set up your normal number on the e-SIM, and then you buy a data-only phyiscal SIM at the airport.

GhostVII 6y ago

This is why I switched over to a VOIP number instead. SMS works everywhere I have internet, and if I have to I just pick up a data-only sim card for wherever I am. Can even check my messages online. Probably not as secure, and wouldn't work well if I was regularly calling people, but for the most part it works fine and costs $1 a month.

sodality2 6y ago
$1/mo? Which provider is that? Twilio?
- GhostVII 6y ago
  Voip.ms
wryroybatty 6y ago
Unfortunately voip, in my case voip.ms, does not work with all sms send methods.

the_duke 6y ago

Why don't you just get a dedicated "virtual" phone number for this purpose? It's not expensive. Skype is an obvious choice, but there are many other providers. Then you have a stable number and can read SMS via app web UI. I switched to the same method a few years ago. It's useful even if you don't travel much, just to not tie 2FA to your phone and for not giving all those services your real number.

ydant 6y ago
I have two virtual (US) numbers - one through Twilio (which I've enable short-code receive support for), and one on Google Voice. Both have failed to receive 2-factor messages from providers over the years. Very occasionally the Google Voice number is blocked explicitly by the provider as a VOIP number. It's just not a reliable 100% replacement for "real" SMS in my experience. Google Voice is close to acceptable as a replacement, and it's my primary 2-factor number when it works, but it's not 100% for reasons outside of my control.
- inflorescer 6y ago
  >I have two virtual (US) numbers - one through Twilio I've heard good things, can you port a cell number in or is it strictly voip? (I haven't done anything phreaking adjacent in ages)
  - ydant 6y ago
    Seems porting is supported: https://support.twilio.com/hc/en-us/articles/223179348-Porting-a-Phone-Number-to-Twilio https://support.twilio.com/hc/en-us/articles/223179348-Porti... I used one of their existing pool of numbers. For inbound short-code support, you have to contact support directly and agree to a legal T&C for them to enable it.

dageshi 6y ago

I have also travelled a lot in the past... You presumably do have a "home" country in the sense of where your bank accounts are, get a cheap permanent sim/phone no with roaming, buy the tiniest phone you can off amazon and stick it in as your 2factor permanent number. Yes, you have to keep that phone charged, but your problem is now permanently solved, it's how I did it.