4 ms·

This is a topic I think a lot about. I don't have a lot of time this morning so I will just say a few things ... First, the OP describes an eSIM for his mobil

by rsync 6y ago

This is a topic I think a lot about. I don't have a lot of time this morning so I will just say a few things ... First, the OP describes an eSIM for his mobile phone - in this case with a provider named "silent.link". In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers. This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code. So you are quite limited in what services you can sign up for and maintain with just an eSIM. Second, the term "threat model" does not appear in the article. This is important because if your threat model is "everyone except state level actors" or "everyone but state level actors AND my bank" the possibilities open up dramatically. I think there is a tremendous amount of benefit in remaining anonymous in relation to your carrier and the FAANGs and (various vendors) that is realistic to achieve - but anonymity in relation to state level actors is practically impossible. Third, there is a big, giant blind spot in the entire chain of identity and that is the following: VISA/MC do not validate name and address[3]. It seems like they do - and merchants believe that they do - but they do not. This means you can use your bank card with any name you like and the minimal address match (which, in the US, is zip code). I'm not going to diagram this out for you but if your threat model is (everyone except bank and state level actors) you now have the basis for a working pseudonym. Fourth, a second blind spot in the chain of identity is a business tax ID (which you can get for free at[4]). Many providers (like mobile carriers) ask for things like SSN, etc., but if you say "business" and give them a tax ID, it's like their brains turn off. They typically don't even ask for ID. You can initiate service over the phone. You may be forced to pay a higher rate for "business service". [1] gmail, your bank, even twilio (ironically). [2] https://en.wikipedia.org/wiki/Short_code https://en.wikipedia.org/wiki/Short_code [3] AMEX does. [4] https://sa.www4.irs.gov/modiein/individual/index.jsp https://sa.www4.irs.gov/modiein/individual/index.jsp

gruez 6y ago
> In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than "real" phone numbers, but several large mobile providers (eg t-mobile) use eSims. > This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code jmp.chat is a voip service and supports short codes just fine. https://jmp.chat/sp1a/faq/ https://jmp.chat/sp1a/faq/
- rsync 6y ago
  "Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than mobile numbers" I am thinking specifically of eSIM providers like truphone who do all kinds of nice and interesting things, but the numbers are voip numbers. Yes, you do get a physical SIM from truphone but the numbers terminate to (non-mobile) numbers. You can't get SMS from shortcodes with truphone. "jmp.chat is a voip service and supports short codes just fine." I'm not so sure ... the issue here is receiving SMS from shortcodes (which is how gmail, for instance, sends 2FA auth to you) and I don't see that jmp.chat can receive SMS from shortcodes ... see[1] which says: "Unfortunately it did not. I was not consistently able to receive short code SMS. I've since fallen back to using cellphone service from Telus which allows me to receive shortcodes." [1] https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_carrier_with_support_for_sms_short/ https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_ca...
  - singpolyma3 6y ago
    > I don't see that jmp.chat can receive SMS from shortcodes Hi there! One of the lead devs at JMP.chat here -- our service definitely supports receiving SMS from short codes. We cannot currently support Canada-only short codes (only north-america-wide short codes). I personally use my JMP number for receiving 2FA codes all of the time (and I have not had another phone number in 4 years).
    - rsync 6y ago
      Thank you - this is interesting (I had not heard of jmp.chat prior to this thread). Can you comment on this: https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_carrier_with_support_for_sms_short/ https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_ca... ... and why the author might have experienced that ?
      - singpolyma3 6y ago
        It's hard to say without more information. The context there looks Canadian so it's possible their providers were using Canada-only short codes. Sometimes providers change strategies on a retry also (I always have to click "retry" for Google 2FA but it always works on second try)
tacostakohashi 6y ago
I opened a mobile account with T-Mobile once, and they asked for my SSN (in fact, they even took a copy of the card). Then, somehow, they mistyped the SSN in their records. It was a special kind of hell getting them to fix that, because of course any discussion about it, or changing anything else on the account would take the form "what's your SSN to verify your identity?" / "Well, I can tell you my real SSN, but I don't know what wrong SSN you have there...", etc, etc. Eventually I sat down with some poor staff member at a retail location who spent an hour or two getting transferred around at the head office to fix it.
- mywittyname 6y ago
  Curious: did you try getting a new account as a completely new person?
  - tacostakohashi 6y ago
    No. I'm sure I could have, I didn't want a new phone number, and I guess I would have have run into much the same problem closing the old account anyway.
- InitialLastName 6y ago
  I had the same problem with a car insurance company and my birth date (was off by a year). I ended up navigating the call labyrinth ("It's mm/dd/yyyy but I think you have yyyy-1... ok, I'll hold") just enough to cancel the policy.
deleted 6y ago
[deleted]
herbst 6y ago
> First, the OP describes an eSIM for his mobile phone - in this case with a provider named "silent.link". In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers. This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code. So you are quite limited in what services you can sign up for and maintain with just an eSIM. You are right but this issue is even bigger as many smaller providers too use something that is more VOIP than anything else. My actual phone number gets redflagged ~80% of the time. Meaning i use shady SMS verification services most of the time.

by rsync 6y ago

gruez 6y ago

> In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than "real" phone numbers, but several large mobile providers (eg t-mobile) use eSims. > This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code jmp.chat is a voip service and supports short codes just fine. https://jmp.chat/sp1a/faq/ https://jmp.chat/sp1a/faq/

rsync 6y ago
"Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than mobile numbers" I am thinking specifically of eSIM providers like truphone who do all kinds of nice and interesting things, but the numbers are voip numbers. Yes, you do get a physical SIM from truphone but the numbers terminate to (non-mobile) numbers. You can't get SMS from shortcodes with truphone. "jmp.chat is a voip service and supports short codes just fine." I'm not so sure ... the issue here is receiving SMS from shortcodes (which is how gmail, for instance, sends 2FA auth to you) and I don't see that jmp.chat can receive SMS from shortcodes ... see[1] which says: "Unfortunately it did not. I was not consistently able to receive short code SMS. I've since fallen back to using cellphone service from Telus which allows me to receive shortcodes." [1] https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_carrier_with_support_for_sms_short/ https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_ca...
- singpolyma3 6y ago
  > I don't see that jmp.chat can receive SMS from shortcodes Hi there! One of the lead devs at JMP.chat here -- our service definitely supports receiving SMS from short codes. We cannot currently support Canada-only short codes (only north-america-wide short codes). I personally use my JMP number for receiving 2FA codes all of the time (and I have not had another phone number in 4 years).
  - rsync 6y ago
    Thank you - this is interesting (I had not heard of jmp.chat prior to this thread). Can you comment on this: https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_carrier_with_support_for_sms_short/ https://www.reddit.com/r/VOIP/comments/8z44iu/mobile_voip_ca... ... and why the author might have experienced that ?
    - singpolyma3 6y ago
      It's hard to say without more information. The context there looks Canadian so it's possible their providers were using Canada-only short codes. Sometimes providers change strategies on a retry also (I always have to click "retry" for Google 2FA but it always works on second try)

tacostakohashi 6y ago

I opened a mobile account with T-Mobile once, and they asked for my SSN (in fact, they even took a copy of the card). Then, somehow, they mistyped the SSN in their records. It was a special kind of hell getting them to fix that, because of course any discussion about it, or changing anything else on the account would take the form "what's your SSN to verify your identity?" / "Well, I can tell you my real SSN, but I don't know what wrong SSN you have there...", etc, etc. Eventually I sat down with some poor staff member at a retail location who spent an hour or two getting transferred around at the head office to fix it.

mywittyname 6y ago
Curious: did you try getting a new account as a completely new person?
- tacostakohashi 6y ago
  No. I'm sure I could have, I didn't want a new phone number, and I guess I would have have run into much the same problem closing the old account anyway.
InitialLastName 6y ago
I had the same problem with a car insurance company and my birth date (was off by a year). I ended up navigating the call labyrinth ("It's mm/dd/yyyy but I think you have yyyy-1... ok, I'll hold") just enough to cancel the policy.

deleted 6y ago

[deleted]

herbst 6y ago

> First, the OP describes an eSIM for his mobile phone - in this case with a provider named "silent.link". In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers. This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code. So you are quite limited in what services you can sign up for and maintain with just an eSIM. You are right but this issue is even bigger as many smaller providers too use something that is more VOIP than anything else. My actual phone number gets redflagged ~80% of the time. Meaning i use shady SMS verification services most of the time.