6 ms·

Phone Numbers Must Die (2019)

• fungiblecog 5y ago
  Poor title. Should be "Don't make me provide a phone number"
  • adamrezich 5y ago
    is it? a good portion of the post is spent explaining why E.164 isn't that great and why the author thinks it should be phased out.
• tenaciousDaniel 5y ago
  I've been wondering when we will collectively move past the notion of "phones" in general.
  • deleted 5y ago
    [deleted]
  • handrous 5y ago
    Nothing else is as close to being so widely-available and easy to obtain for almost anyone, almost anywhere, and usable by as many people. I don't see anything poised to replace it as the LCD of near-instant communication.
    • deleted 5y ago
      [deleted]
• Causality1 5y ago
  the chronological billing model borne of the economics of circuit-switched telecoms is kept alive as a facade Frankly I prefer it that way. I don't want to have to feel guilty every time I use my phone. The cost of my typical monthly usage could drop to five dollars and it would still force me to constantly think about whether what I'm doing is "worth it". Maybe I'm just a weirdo but I don't need that stress in my life.
  • tenebrisalietum 5y ago
    When you make a phone call, on a circuit-switched network, you are tying up a circuit for the duration of that call. No one else can use that circuit, or slots on the T1/T3 etc. until you hang up. Resources need to exist in case you ever make a call that no one else can use. With packet-switched, your call isn't typing a circuit, just a small portion of speed, and once your call ends, someone else can use it. You need more lines to support circuit-switched networks than packet-switched networks. So you should feel more guilty using circuit-switched technology than packet-switched technology. Fortunately I think a lot of providers once you are out of the "last mile" to your house or business are using SIP even if internally. Where I work I'm seeing things like SIP over T1 instead of PRI.
    • toast0 5y ago
      You can only make more calls over packet switched than circuit switches if the packet switched network is cheating: silence elimination is common, compression is also common. If you're comparing PRI to SIP over T1 without silence elimination and using uLaw, results are going to be pretty similar. Maybe you get a benefit with SIP because you eliminated the control channel of PRI, but you also increased latency and jitter and lost clear overload behavior (all circuits busy) in favor of degraded calls on overload. Of course, it's a lot easier to multiplex SIP with other IP traffic, I don't think you can split a T1 as a couple PRIs and the rest IP, and even if you could, you probably couldn't do it dynamically. Having a system where data can use the bandwidth when you're not making calls, and calls can use it when you are is pretty valuable.
    • Causality1 5y ago
      That's all true but it's completely unrelated to what I was saying. My point was that I would rather pay a flat rate for unlimited data than pay per unit of data used. I like the freedom of using it however I want. I like not having to think about whether, for example, watching a video in 1080p is worth the extra ten cents over watching it in 360p. I just don't want to feel bad for treating myself to the best experience.
• pbreit 5y ago
  The phone number is probably the best worldwide ~1 to ~1 identifier. I say keep it, for now at least.
  • Symbiote 5y ago
    I don't know about most, but a lot of people have more than one phone number. I have a personal mobile number, a personal mobile number from the country I used to live in, and two work numbers. If I take a longer trip somewhere, I might have another mobile number for a few weeks. I don't have one now, but landline numbers are generally shared between a whole household.
• remram 5y ago
  I have a phone number. I never pick up the phone, it doesn't even ring, but I will happily provide it if I have to. I can get SMS verification messages. I don't think I understand why one would feel so strongly about it. What's the advantage of not having a number, over having a number that doesn't make your phone ring?
  • kome 5y ago
    I am basically forced by my bank to own a mobile phone, and to me it's completely useless. I would gladly avoid to carry it with me in my travels. It lies somewhere at home: I don't go out with my phone, as I don't need to use internet banking that often, but it's annoying enough. But when I forget it to carry it with me when i travel, I am kinda screwed. And it's not like SMS verification improved the safety of anything... Also: getting those stupid SMS codes when you are in another continent, it's basically impossible. So what's the point of all of this?
    • quambene 5y ago
      A lot of banks are offering photoTan. You get a special device just for generating your photo tan. It's more secure than sms tan and you wouldn't need a mobile phone anymore.
    • hlandau 5y ago
      Author here. I also had this issue and switched banks to fix this, as I also wrote about: https://www.devever.net/~hl/phonebank https://www.devever.net/~hl/phonebank
    • AnotherGoodName 5y ago
      I know you said travels metaphorically but I'll point out that you pretty much can't travel without a phone number right now. It's absolutely required even for the vaccinated for contact tracing purposes on most modes of long distant transport (boat, plane, train) and for hotel stays and at border crossings. It's not at all optional. I'm currently travelling (I figure since I'm vaccinated I'm not being unreasonable by taking a holiday right now). Every flight and hotel has required a number. The author may as well live in the woods in a faraday cage with a tinfoil hat at this point.
• yupper32 5y ago
  This reads like someone who turns off Javascript in their browser and then complains when every website doesn't bend to their niche use case. There are other oddities: The author complains about the security of SMS verification, but then goes on to complain that even more incredibly insecure workarounds don't work. And then the author attempts to be in some sort of position of authority about the reliability and other aspects of the network and carriers, while fully admitting that they don't even have a phone number or smart phone. There are certainly valid complaints around SMS verification, networks, and carriers, but this article seems out of touch.
• kome 5y ago
  I avoided to setup Two-Factor Authentication (2FA) with mobile phones anywhere because i had the distinct impression I was making the surface of attack bigger instead of smaller.
  • BugsJustFindMe 5y ago
    SMS 2FA always makes an attack harder than no 2FA at all because an attacker needs to also intercept your SMS messages in addition to getting your password instead of just getting your password. Given that getting your password is required for both attacks, the addition of needing to intercept your SMS messages is an additional hurdle. It's just potentially not as good as physical token 2FA where the additional requirement is physically finding you and beating you up. I think you must be confusing SMS 2FA with an SMS 1FA override, which is not the same.
    • hlandau 5y ago
      The trouble is there appear to be many services purporting to provide SMS "2FA" which make the bizarre assumption that SMS is more secure than email and allow you to recover access to your account purely via access to that phone number. For these services adding a phone number may indeed actually reduce account security. There have been real incidents, including in the last few years, of high-value accounts of people being successfully hijacked via the hijacking of their phone numbers.
      • BugsJustFindMe 5y ago
        Maybe but that's a problem with those services, not a problem with SMS. If they cared about security they also wouldn't allow password recovery by email, because history has proven that email is also not inherently secure. Peoples' email accounts get hacked literally all the time. Every single practical problem that your post ascribes to SMS also applies to email. Approaching 100% of all email addresses in the world are not permanently attached to individual people and are entirely subject to the whims of entities like Google.
• theonlybutlet 5y ago
  And what unique identifier do we replace it with? Specifically, we'd need one that offers universal interoperability between platforms, countries, devices, platforms, digital/analog and human memory. A different ASCII code perhaps? One shorter but serves no other purpose and creates a whole bunch of interoperability problems. This is like trying to replace the metric system.
  • hlandau 5y ago
    Author here. Email addresses work fine.
    • BugsJustFindMe 5y ago
      How so? Literally everything you wrote applies exactly the same if you s/E.164 number/email address/g and s/SMS/email/g
      • hlandau 5y ago
        No it doesn't. E.164 is a closed system in which I cannot own my own identifier, in which interconnection is based on an outmoded billing system based on the now false presumption of a circuit switched architecture, and any ability to contact other entities relies on the prior negotiation of some kind of contractual agreement with a carrier, whereas email permits agreement-free federation.
        • bcrl 5y ago
          Yes it is. The same thing applies to both domain names and IP connectivity. You have to pay one of the small number of domain name providers / transit providers to register / transport your domain / BGP announcements for a regular fee. Sure there are multiple registrars / transit providers that you can deal with, but each TLD / region is overseen by a monopoly entity that can increase prices pretty easily. If you don't pay your registration fees for use of that unique identifier, you lose it. I can get E.164 numbers for $0.85/month from a VoIP provider, which is comparable to the cost of a domain name. There are plenty of VoIP providers that can port phone numbers from landlines or cell phones to VoIP. There are more similarities to domain registrars than differences.
• throwthere 5y ago
  My problem with a post like this is it’s actually very easy to agree with the points made because no system is perfect. On the other hand I don’t think the author is ever proposed a better solution which means it kind of just makes you feel bad. Maybe that’s the first step of progress?
• lsiebert 5y ago
  I think you can sign up for a google account with any android device with google apps on it. Presumably that can be without a phone number if it's just a tablet.
  • hlandau 5y ago
    Author here. Amusingly I tried that once with an Android VM; it accepted the input and tried to proceed, then failed with an unexpected error, implying the developer of the application hadn't anticipated this. The account entered some half-created state in which attempts to login with it on the web demanded a phone number. Interestingly I am also now locked out of an old Gmail account I have had since 2005 in the same way; any attempt to merely login to it yields a demand for a phone number. There is no phone number filed for that account, so this cannot possibly be for "security". It is literally an attempt to extort a phone number out of me if I want access to my own data. One suspects this is probably against GDPR, of course...
• jokethrowaway 5y ago
  I wholeheartedly agree. For security purpose, email or any 2 factor authentication system is better. For providing uniqueness, as already proven by the current market, it's easy to get a new number for free and bad actors can automate that for a price. I would say if you're doing a service where uniqueness matters, you should rely to government documents verification (eg. https://identity.stripedemos.com/ https://identity.stripedemos.com/, 1.5$ per user), which, unfortunately, we're all required to have. That said, no big tech exec will listen to this. It's not all bad, I don't really need one more reason not to use Twitter or Google.
• sly010 5y ago
  > When Google demands an E.164 number, they're not demanding it despite the fact that E.164 is a somewhat closed, opaque network, but because of it. Basically everything bad about the E.164 namespace and its constituent organizations is precisely what makes it attractive to organizations for use cases like these. That is kind of the point isn't it. Despite all its shortcomings it's a useful identifier because of its scarcity. Btw, the domain name system and x.509 would not work either without scarcity and trust delegation. In fact if I remember correctly some newly re-imagined digital 'networks' like Urbit also opted for scarce identifiers, because they work out better economically.
  • hlandau 5y ago
    I'm not sure I follow. Domain names are not meaningfully "scarce", unless you mean in the sense that you pay for them. But even then domain names are not "scarce" because one domain can support an effectively unlimited number of subdomains, and free providers of subdomains exist.
    • LeifCarrotson 5y ago
      Good, semantic, short, memorable domain names are scarce. You pay though the nose for them. Arbitrary subdomains on free subdomain providers are not the same as having "FirstnameLastname.com"
      • hlandau 5y ago
        But this has nothing to do with anything I complained about. I don't recall complaining about the scarcity of "designer" phone numbers (for example), just that it is a closed system relative to email. The complaint, amongst the others made, is that I can't own my own identifier, not that that identifier might be unfashionable.
        • theonlybutlet 5y ago
          Many countries have number portability meaning you can take your number with you to your new provider, it would be ownership in the same way as a domain address.
• toast0 5y ago
  Phone numbers suck, but they are the closest thing we've got to a universal address type that can reach any person. More people have telephones where they can be reached than email addresses. More people have telephones where than can be reached than mailing addresses. Yes, delivering SMS globally is a shit-show, voice calls is better but also filled with terribleness, but so is everything else.
  • mwint 5y ago
    > More people have telephones where than can be reached than mailing addresses. Wow, I’ve never really thought about this. Any idea where I’d go to get (I assume very rough) numbers on people with addresses vs. phone numbers?
    • toast0 5y ago
      Not sure if you can find stats, but many countries simply don't have a mail service infrastructure, but darn near everywhere has phones. Even North Korea has phones, although there are administrative barriers that prevent calling between most domestic NK numbers (+850) and the rest of the world. Rural postal service gets pretty iffy in the US, and in countries with less resources, you might only get mail service in big cities.
      • necovek 5y ago
        I would imagine NK postal service works well. I would imagine that postal services work decently well even in the poorest of countries and only war-thorn areas are less accessible by post. I am not talking of next-business-day services, of course, though they are picking up everywhere too.
  • necovek 5y ago
    That's probably true, but everybody partaking in "the internet" has an email address too. Author focuses on the fact that internet-only businesses are stsrting to ask for a non-internet identifier.
• tacostakohashi 5y ago
  For all their faults, phone numbers do provide some limited level of identity. If you provide me with a phone number +12121234567, and I send you a unique code via SMS / voice call, and you provide the code back, and I haven't had anyone else register with that phone number, I can conclude with some limited degree of confidence that: 1) You are a human. 2) You are in the United States present, or usually are. 3) You have money and an address and are capable of buying things (after all, you have apparently succeeded in buying a phone and maintaining an account). 4) There's some prospect you could become a customer, or a vendor, and we could do business. If you give me an email address john@example.org, I have none of those assurances, and it's entirely likely that you are not a human, or are a human overseas who is in the business of scamming people. Sure, someone can get access to phone numbers anonymously, from overseas, or to scam people, but it's enough of a minor hassle (for all the reasons listed in the post) that they tend not to. It's like if someone walks into your shop/restaurant in a disheveled state, unshaven, and with body odor, versus in a suit and tie and recently shaven and aftershave. The latter is rather more likely to be someone you'll want to do business with, even though there's always the feint possibility that the former is actually a billionaire playing an elaborate trick on you. It easy to imagine an improvement on phone numbers for providing this limited level of identity verification, but email addresses aren't it.
  • JohnFen 5y ago
    True, they do provide a level of identity, albeit imperfect. But it's good enough that I don't give my phone number to companies outside of very limited circumstances (to keep my number from being sold or used for marketing purposes).
  • necovek 5y ago
    > If you give me an email address john@example.org, I have none of those assurances, and it's entirely likely that you are not a human, or are a human overseas who is in the business of scamming people. Wow, "entirely likely" — what do you base that estimation on? Your analogy to a walk-in is completely on point too: surely only people in "disheveled state, unshaven, and with body odor" would sport an email address and think that's a good representation of their identity on the internet. I've conducted business with a bunch of US companies, sometimes shipping to mail forwarding companies based in US to forward stuff home (eg. that's how I got my last few $2-3k laptops). Businesses that build in some silly protections like the phone number in do not get my business. For us who've been using the internet long enough, phone number is a weird requirement: Google and eBay keep asking me to confirm my number upon login for 15 year old accounts (with eBay there's even no recourse on the page, but you do get logged in, so you can just reload the page you wanted and the screen is gone).
• fmajid 5y ago
  I’d go further and say telephony itself needs to die.