5 ms·

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SM

I’m an Australian that was in India for the last year (just arrived back, up to day 2 of my 14 day quarantine). Anything that has needed to verify me through SMS (e.g. filing my Australian tax return via myGov, paying for things with my credit card if they used the fancy security thing, like most airlines do and Amazon apparently does, and logging into one or two things) has required me to contact my parents to turn on and check the old phone I left with them, because roaming for a year is expensive and otherwise pointless (I barely use a phone), but transferring my number to a prepaid Amaysim SIM let me keep it alive and mine for the year for $10. Actually, the myGov thing was a real piece of work. They offer secret questions as a second factor that you can opt to use instead of SMS codes (and yes, secret questions are stupid), but when I did that, it silently unlinked my Australian Tax Office account. I tried to link it up again (a bit of a pain in its own right), and it told me that ATO has decided that it won’t let you link it up if you use secret questions as the second factor technique. Seriously. So I had to switch back. Oh yeah, they do also have a third option, an app of their own that can generate codes (not TOTP), but that app had something like 2 stars on Google Play Store, with many reviews saying it didn’t work at all, so I didn’t even bother trying that. When I’m in Australia with my phone handy, SMS verification seems not too bad, but when out of the country and not roaming, it may vary between very inconvenient and completely debilitating.

dbetteridge 6y ago
The app does work by the way. It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard. But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS (Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)
- chrismorgan 6y ago
  When I hear many reports of things flat-out not working in this way, I’m suspicious that it won’t work for me with my Samsung Galaxy J1 (2016) on Android 5.1, which Google has progressively broken by means of Google Play Services updates. As some typical examples of things that have been broken by Google Play Store updates: Fastmail notifications now only come through on wifi or (I found out last week) if Maps (by Google) is running in the foreground; and Hangouts is completely nonfunctional off wifi (can’t send or receive). It’s network-related things that are the least reliable. I really wish I could root it or install a new OS on it, but the former has failed and even with an unlocked bootloader the latter takes much too much effort if a prebuilt image isn’t available for your specific device, which roughly means “if you don’t have a flagship phone”.
  - dbetteridge 6y ago
    Oof yeah, if you're running an Android version that old I would not expect much to work that relies on Google services. That said if you're out of the country a lot and going the SMS auth route, I'd personally be more comfortable with a postpaid plan in AUS for the SIM as the telcos tend to take ID requirements more seriously for those then pre-paids and you're less likely to be socially engineered out of your number.
    - chrismorgan 6y ago
      “That old”, and yet the phone’s not even three years old (my instance of the model, that is; the model was at that point two years old and is thus now five years old). Sigh. I said prepaid, but as I did it it’s actually postpaid but with an initial $10 prepayment required. Ah, good times back in 2014–2017, getting those bills for less than a dollar (commonly 12¢) every quarter. Then I moved to a tiny country town where an Optus tower a few hundred metres away became my best option for internet, 50/25Mbps and far more solid than any NBN anecdote I’ve heard.
      - wasmitnetzen 6y ago
        > the phone’s not even three years old Well, Android 5.1 was EOL in 2015, so you willingly bought an unsupported model. I'm not saying Android has any sensible long-term support (in fact, I spent the last weekend installing LineageOS because my 2018 phone doesn't have support anymore), but this instance is hardly Google's fault.
        gibspaulding 6y ago
        > you willingly bought an unsupported model I think most people on HN are comfortable doing a bit of research to see when a device will stop receiving support, but I don't think that's reasonable to expect from everyone. If I walk into a shop and buy a phone, new in the box, it seems pretty reasonable to assume that it's operating system will work with whatever apps I install from it's built in store, and that it will receive security patches for at least a few years. That seems to me like a pretty low bar, but it's absolutely not the case in the Android ecosystem.
superasn 6y ago
> has required me to contact my parents to turn on and check the old phone I left with them Why didn't you use a sms to email forwarding app on a phone connected to a charger? They are free on play store and work really well.
- chrismorgan 6y ago
  It never occurred to me to seek such a thing. As I wrote my earlier comment here, I wondered to myself whether there might be an app or service to help with this, but it’s too late now. But even then, I’m not sure I’d want to leave a phone plugged in all year, even with its battery removed.
- glitchc 6y ago
  That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot. That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.
  - mindslight 6y ago
    I'm surprised to see people here treating SMS "2FA" as anything but some snake oil annoyance to be worked around. I setup mine to go to a VOIP number where texts show up in email. I have plans to write something that looks for these messages and spits the code to a terminal or XMPP. My goal is to get that code into my paste buffer as quickly as possible. If you're using a password manager and have a security model that includes trusting your own computer, you really don't want the snake oil. In fact with US bank accounts, "2FA" steps make your account less secure, because the security of your bank account ultimately relies on checking your transactions every 30 days - anything that gets in the way of easily logging in undermines that.
    - glitchc 6y ago
      Sounds like we're in agreement.
    - 6y ago
BiteCode_dev 6y ago
I'd advice for the excellent pulsesms app, which will let you sync you sms from your phone to your desktop. You can read and write messages from the comfy keyboard of your Windows/MacOS/Linux laptop, even if your phone is at the other side of the world, as long as both are connected to internet. As someone who forgets his phone regularly at home, it's great.

dbetteridge 6y ago

The app does work by the way. It is a steaming hot pile of garbage where the government has yet again decided to not use a widely accepted standard. But if you just need to login to myGov every few months to check something or do your tax return it works better then the SMS (Just don't lose the phone it is installed on, because you can't link it to a new one without ringing and wading through security checks)

chrismorgan 6y ago
When I hear many reports of things flat-out not working in this way, I’m suspicious that it won’t work for me with my Samsung Galaxy J1 (2016) on Android 5.1, which Google has progressively broken by means of Google Play Services updates. As some typical examples of things that have been broken by Google Play Store updates: Fastmail notifications now only come through on wifi or (I found out last week) if Maps (by Google) is running in the foreground; and Hangouts is completely nonfunctional off wifi (can’t send or receive). It’s network-related things that are the least reliable. I really wish I could root it or install a new OS on it, but the former has failed and even with an unlocked bootloader the latter takes much too much effort if a prebuilt image isn’t available for your specific device, which roughly means “if you don’t have a flagship phone”.
- dbetteridge 6y ago
  Oof yeah, if you're running an Android version that old I would not expect much to work that relies on Google services. That said if you're out of the country a lot and going the SMS auth route, I'd personally be more comfortable with a postpaid plan in AUS for the SIM as the telcos tend to take ID requirements more seriously for those then pre-paids and you're less likely to be socially engineered out of your number.
  - chrismorgan 6y ago
    “That old”, and yet the phone’s not even three years old (my instance of the model, that is; the model was at that point two years old and is thus now five years old). Sigh. I said prepaid, but as I did it it’s actually postpaid but with an initial $10 prepayment required. Ah, good times back in 2014–2017, getting those bills for less than a dollar (commonly 12¢) every quarter. Then I moved to a tiny country town where an Optus tower a few hundred metres away became my best option for internet, 50/25Mbps and far more solid than any NBN anecdote I’ve heard.
    - wasmitnetzen 6y ago
      > the phone’s not even three years old Well, Android 5.1 was EOL in 2015, so you willingly bought an unsupported model. I'm not saying Android has any sensible long-term support (in fact, I spent the last weekend installing LineageOS because my 2018 phone doesn't have support anymore), but this instance is hardly Google's fault.
      - gibspaulding 6y ago
        > you willingly bought an unsupported model I think most people on HN are comfortable doing a bit of research to see when a device will stop receiving support, but I don't think that's reasonable to expect from everyone. If I walk into a shop and buy a phone, new in the box, it seems pretty reasonable to assume that it's operating system will work with whatever apps I install from it's built in store, and that it will receive security patches for at least a few years. That seems to me like a pretty low bar, but it's absolutely not the case in the Android ecosystem.

superasn 6y ago

> has required me to contact my parents to turn on and check the old phone I left with them Why didn't you use a sms to email forwarding app on a phone connected to a charger? They are free on play store and work really well.

chrismorgan 6y ago
It never occurred to me to seek such a thing. As I wrote my earlier comment here, I wondered to myself whether there might be an app or service to help with this, but it’s too late now. But even then, I’m not sure I’d want to leave a phone plugged in all year, even with its battery removed.
glitchc 6y ago
That’s a horrendous hack. The security provisions of immediacy and liveness offered by SMS 2FA are rendered moot. That one needs to do this to work around the limitations solidifies in my mind that SMS is a poor 2FA solution and should be discontinued.
- mindslight 6y ago
  I'm surprised to see people here treating SMS "2FA" as anything but some snake oil annoyance to be worked around. I setup mine to go to a VOIP number where texts show up in email. I have plans to write something that looks for these messages and spits the code to a terminal or XMPP. My goal is to get that code into my paste buffer as quickly as possible. If you're using a password manager and have a security model that includes trusting your own computer, you really don't want the snake oil. In fact with US bank accounts, "2FA" steps make your account less secure, because the security of your bank account ultimately relies on checking your transactions every 30 days - anything that gets in the way of easily logging in undermines that.
  - glitchc 6y ago
    Sounds like we're in agreement.
  - 6y ago

BiteCode_dev 6y ago

I'd advice for the excellent pulsesms app, which will let you sync you sms from your phone to your desktop. You can read and write messages from the comfy keyboard of your Windows/MacOS/Linux laptop, even if your phone is at the other side of the world, as long as both are connected to internet. As someone who forgets his phone regularly at home, it's great.