5 ms·

These days most sites do it by requiring a phone number. Since most countries require ID for a phone number and functional burner numbers are really hard to get

These days most sites do it by requiring a phone number. Since most countries require ID for a phone number and functional burner numbers are really hard to get, the system works well.

kuroguro 5y ago
> functional burner numbers are really hard to get For SMS verification at least there are quite a few sites dedicated to verify you for a few cents. AFAIK they buy real prepaid sim cards and allow reuse by different customers on different sites.
- jannes 5y ago
  But then anyone can reset your account’s password by using the same service?
  - kuroguro 5y ago
    Technically yes, practically there should be no way to know which account has which phone number. The bigger problem is if the site requires you to re-verify your phone for whatever reason (for ex. paypal does when you access it from a strange IP or sth) and the number you used may not be available anymore.
    - 123jay7 5y ago
      If you are using a shady sms service as 2WA for your bank account, then you have bigger fish to fry.
Siira 5y ago
> works well For everyone except the user who now has no privacy, is trivially hacked by SMS interception, can’t create multiple accounts (e.g., to segregate their activities on a chat platform), ... .
- anfilt 5y ago
  ^This when I run into a site that whats my phone number I simple don't bother anymore.
- foobar33333 5y ago
  >can’t create multiple accounts This is usually the intent of sms verification. I hate it just as much as you but I admit that there is no better method for preventing ban evasion. When accounts are trivial to create, moderators have no power.
  - luffapi 5y ago
    > When accounts are trivial to create, moderators have no power. Sounds ideal! Moderators are just power tripping gatekeepers. Community ranking of content is sufficient to get rid of trolls, spam… Taking away people’s right to privacy just to empower moderators is quite dystopian.
  - rdtwo 5y ago
    Sms validation costs the spammer about 30c per validation. Maybe less in bulk. So it depends on how valuable the account is. A Nike snkrs account is worth 1-2$ so it’s still quite profitable
ajsnigrutin 5y ago
Do countries really require ID to get a phone number? I can buy a prepaid sim card in our Hofer (=Aldi) for 2eur, no verification, no nothing,... they even have the same barcode on, so even Aldi does not know which is mine, and I can pay in cash. I can buy a refill there with cash too, but just to receive an sms, I don't need one, because receiving messages is free.
- leppr 5y ago
  2€/account is still decent spam protection, and fair/affordable for a lot of the world population. It's one thing the whole web can take out of the cryptocurrency transaction model. Costs can also be explicitly monetary and not just time-based through captchas.
- dvdkon 5y ago
  Lots of countries do: https://blog.telegeography.com/liberty-vs-security-the-battle-over-sim-registration https://blog.telegeography.com/liberty-vs-security-the-battl... You also have to remember carriers will track the approximate position of a phone with an anonymously-purchased SIM-card, so better not take it home.
- vageli 5y ago
  I know in Greece and many European countries you must show ID to get a SIM, nationals and foreigners alike.
  - aj3 5y ago
    Does the ID get recorded though?
- Cu3PO42 5y ago
  If you went to a German Aldi on the other hand, they would let you buy a SIM, but before you can activate it you need to provide your personal information including a verification check that involves your Personalausweis in one way or another.
  - 5y ago
Telemakhos 5y ago
I tried to set up a web account with the IRS (the American tax bureau) the other day. My perfectly legitimate mobile number, which works with every other two-factor authentication, was not sufficient for the IRS. Apparently you have to have a number with a certain set of major cell phone service providers like ATT and Verizon, not a minor service provider. They also require half of a credit card number or some other financial identifier like a mortgage. I rather wonder if the cell phone service provider requirement has to do with adding more surveillance capabilities to the IRS' already impressive financial surveillance ability.
- rsync 5y ago
  A few things ... I had to set up a web account with the IRS in the recent past and I just skipped the entire mobile validation by having them send the auth code to my mailing address. It arrived in two days and worked perfectly. YMMV. I am, however, interested in what mobile carrier you use that had a "real" (not VOIP) mobile number and can receive SMS from "short codes", but did not work with the IRS ? That's unexpected - basically every mobile number in the US is one of the big three or an MVNO operating with one of the big three networks ... can you share just a bit more about your setup ?
  - toast0 5y ago
    Republic Wireless mobile numbers often look like voip because it's a MVNO run by Bandwidth.com (a large wholesale voip carrier). It's apparently in the process of being sold to Dish Wireless though, so that may change. I think the IRS may have access to customer names associated with mobile phone accounts to confirm identity, but not all carriers have identity information for their customers, and I'd guess smaller carriers (or privacy focused carriers, if any exist) may not provide that access.
  - Telemakhos 5y ago
    It's Xfinity mobile and can send and receive SMS from short codes including my banks, Amazon, etc. Also, I cannot use my mailing address for precisely the reason that I wanted to set up a web account: my accountant put the wrong city and zip code on all my tax returns (several EIN/TINs), and the IRS uses the address on the most recent filing for verification purposes.
aledalgrande 5y ago
How do we get all these spam calls in North America then?
- aj3 5y ago
  VoIP
- MiddleEndian 5y ago
  The phone company lets them put whatever number they want in their caller ID when they call you. It's a zero-security string. Receiving calls and texts doesn't work the same way.
techrat 5y ago
The sites requiring a phone number are also now excluding VoIP known numbers such as Google Voice. Problem. I don't have any other type of number. So while I added my older GV number to my Steam account, I can't update my number to my newer GV number because Valve won't accept non-LL or Cellular numbers for 2FA. So I have to keep a number I've changed from everywhere else... or not have a number on my account anymore.

These days most sites do it by requiring a phone number. Since most countries require ID for a phone number and functional burner numbers are really hard to get, the system works well.

kuroguro 5y ago

> functional burner numbers are really hard to get For SMS verification at least there are quite a few sites dedicated to verify you for a few cents. AFAIK they buy real prepaid sim cards and allow reuse by different customers on different sites.

jannes 5y ago
But then anyone can reset your account’s password by using the same service?
- kuroguro 5y ago
  Technically yes, practically there should be no way to know which account has which phone number. The bigger problem is if the site requires you to re-verify your phone for whatever reason (for ex. paypal does when you access it from a strange IP or sth) and the number you used may not be available anymore.
  - 123jay7 5y ago
    If you are using a shady sms service as 2WA for your bank account, then you have bigger fish to fry.

Siira 5y ago

> works well For everyone except the user who now has no privacy, is trivially hacked by SMS interception, can’t create multiple accounts (e.g., to segregate their activities on a chat platform), ... .

anfilt 5y ago
^This when I run into a site that whats my phone number I simple don't bother anymore.
foobar33333 5y ago
>can’t create multiple accounts This is usually the intent of sms verification. I hate it just as much as you but I admit that there is no better method for preventing ban evasion. When accounts are trivial to create, moderators have no power.
- luffapi 5y ago
  > When accounts are trivial to create, moderators have no power. Sounds ideal! Moderators are just power tripping gatekeepers. Community ranking of content is sufficient to get rid of trolls, spam… Taking away people’s right to privacy just to empower moderators is quite dystopian.
- rdtwo 5y ago
  Sms validation costs the spammer about 30c per validation. Maybe less in bulk. So it depends on how valuable the account is. A Nike snkrs account is worth 1-2$ so it’s still quite profitable

ajsnigrutin 5y ago

Do countries really require ID to get a phone number? I can buy a prepaid sim card in our Hofer (=Aldi) for 2eur, no verification, no nothing,... they even have the same barcode on, so even Aldi does not know which is mine, and I can pay in cash. I can buy a refill there with cash too, but just to receive an sms, I don't need one, because receiving messages is free.

leppr 5y ago
2€/account is still decent spam protection, and fair/affordable for a lot of the world population. It's one thing the whole web can take out of the cryptocurrency transaction model. Costs can also be explicitly monetary and not just time-based through captchas.
dvdkon 5y ago
Lots of countries do: https://blog.telegeography.com/liberty-vs-security-the-battle-over-sim-registration https://blog.telegeography.com/liberty-vs-security-the-battl... You also have to remember carriers will track the approximate position of a phone with an anonymously-purchased SIM-card, so better not take it home.
vageli 5y ago
I know in Greece and many European countries you must show ID to get a SIM, nationals and foreigners alike.
- aj3 5y ago
  Does the ID get recorded though?
Cu3PO42 5y ago
If you went to a German Aldi on the other hand, they would let you buy a SIM, but before you can activate it you need to provide your personal information including a verification check that involves your Personalausweis in one way or another.
- 5y ago

Telemakhos 5y ago

I tried to set up a web account with the IRS (the American tax bureau) the other day. My perfectly legitimate mobile number, which works with every other two-factor authentication, was not sufficient for the IRS. Apparently you have to have a number with a certain set of major cell phone service providers like ATT and Verizon, not a minor service provider. They also require half of a credit card number or some other financial identifier like a mortgage. I rather wonder if the cell phone service provider requirement has to do with adding more surveillance capabilities to the IRS' already impressive financial surveillance ability.

rsync 5y ago
A few things ... I had to set up a web account with the IRS in the recent past and I just skipped the entire mobile validation by having them send the auth code to my mailing address. It arrived in two days and worked perfectly. YMMV. I am, however, interested in what mobile carrier you use that had a "real" (not VOIP) mobile number and can receive SMS from "short codes", but did not work with the IRS ? That's unexpected - basically every mobile number in the US is one of the big three or an MVNO operating with one of the big three networks ... can you share just a bit more about your setup ?
- toast0 5y ago
  Republic Wireless mobile numbers often look like voip because it's a MVNO run by Bandwidth.com (a large wholesale voip carrier). It's apparently in the process of being sold to Dish Wireless though, so that may change. I think the IRS may have access to customer names associated with mobile phone accounts to confirm identity, but not all carriers have identity information for their customers, and I'd guess smaller carriers (or privacy focused carriers, if any exist) may not provide that access.
- Telemakhos 5y ago
  It's Xfinity mobile and can send and receive SMS from short codes including my banks, Amazon, etc. Also, I cannot use my mailing address for precisely the reason that I wanted to set up a web account: my accountant put the wrong city and zip code on all my tax returns (several EIN/TINs), and the IRS uses the address on the most recent filing for verification purposes.

aledalgrande 5y ago

How do we get all these spam calls in North America then?

aj3 5y ago
VoIP
MiddleEndian 5y ago
The phone company lets them put whatever number they want in their caller ID when they call you. It's a zero-security string. Receiving calls and texts doesn't work the same way.

techrat 5y ago

The sites requiring a phone number are also now excluding VoIP known numbers such as Google Voice. Problem. I don't have any other type of number. So while I added my older GV number to my Steam account, I can't update my number to my newer GV number because Valve won't accept non-LL or Cellular numbers for 2FA. So I have to keep a number I've changed from everywhere else... or not have a number on my account anymore.