4 ms·

Surprisingly it’s usually banking and investment company’s that require SMS based MFA. Including my main 401k brokerage. In those cases I keep a google voice n

Surprisingly it’s usually banking and investment company’s that require SMS based MFA. Including my main 401k brokerage. In those cases I keep a google voice number. It’s also the same number I use to give to anyone/any company and it’s just on do not disturb 24/7. If I need to deal with a company on that number I just turn off DND. This practice of never giving out my actual number has drastically decreased the number of “car warranty” trash calls to my actual phone. They all go to that and generally a message is never left, and the phone doesn’t ring. Sometimes I get a voicemail of 3 seconds of dead air but that’s it. I know a lot of people de-google but my thought is this isn’t a normal PSTN endpoint, and it’s not nearly as easy to sim swap, if not impossible but still works as a second factor. And I’m not aware of another service that can do it better and like it or not, google is a big target so I trust their auth over some other fly by night competitor.

walrus01 5y ago
My strategy for people that need to reach me by voice involves a one step IVR on my own asterisk system. This IVR is linked to a DID that I give out for this purpose. It answers and has a voice greeting prompt that says something like "press five zero zero to be connected". If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID. This cuts down on 99% of your car's extended warranty and IRS scam calls.
- gruez 5y ago
  >If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID. Which provider allows this? Won't stir/shaken authentication requirements break it in a few years?
  - walrus01 5y ago
    I am my own provider: incoming DIDs reside with a wholesale SIP trunking service. Outgoing SIP with the same provider, usually, though I have multiple possible routes. The asterisk system, I run myself. My outgoing caller ID (and my carrier's links to its upstreams such as bandwidth.com) are SHAKEN/STIR compliant.
    - aeontech 5y ago
      This sounds fascinating and also completely over my head in terms of possibilities… is there a basic “getting started guide” you would recommend for someone who may not have the bandwidth to go all-in learning telephony from soup to bolts but would still like the benefits? :)
      - walrus01 5y ago
        Wouldn't recommend it unless you do network/telecom stuff for a living, it has a bit of an ongoing time cost in maintenance... some of the SIP trunking providers that have more focus on the consumer market such as voip.ms do let you define your own custom IVR and menus, to accomplish pretty much what I described, without having your own SIP-speaking system registered to it persistently. You should be able to define a voip.ms IVR destination as your cellphone.
      - jasonjayr 5y ago
        Thinking about this a smidge, you probably can just use voip.ms to (a) order a DID (aka a phone number), (b) setup an IVR for the message, and (c) instruct them to dial an [internal to your account] extension that forwards to your real number, all on the voip.ms platform. You wouldn't have to set anything up, just pay them for per-minute charge. You will have to pay 2x per minute, once for the inbound, and then outbound to your real number, ..... unless you go through the extra steps of setting up SIP phones. FWIW; I've used voip.ms for a long time, and just a very happy customer. The biggest trouble they've had was availability issues a month or so ago when they were the victim of a DDoS :-/. You probably could pull off this trick with any of the pay as you go SIP trunking providers ...
    - gruez 5y ago
      How do the calls actually get routed to your phone? Via SIP, or through your cell provider (ie. it dials your phone's phone number)? If everything is over SIP, then it makes sense that everything is SHAKEN/STIR compliant.
      - walrus01 5y ago
  - YokoZar 5y ago
    I called someone today and they appeared to be using a generic call screening service that offers exactly this feature - a computerized voice asks you to enter a random number to be connected.
    - walrus01 5y ago
      I didn't even randomize mine, it's literally the same greeting every time and a fixed extension number. Just the fact that it exists as a roadblock to listen to, comprehend and put in some DTMF tones seems to stop 99% of the scam calls.
      - jrootabega 5y ago
        I'm guessing most scammers don't even hear your prompt. I have a simple, short, "leave a message <beeep>" prompt and the vast majority of my scam voicemails go: 0:00 - 0:10: silence 0:10 - hangup: "Hello? Hello?"
  - knodi123 5y ago
    once stir/shaken is in place, won't the underlying problem go away?
dreamcompiler 5y ago
I'm surprised this works for you. Every time I've tried to use my GV number for MFA it's rejected. It's easy for companies to check if a number is assigned to a "legitimate" mobile provider and if not, they just don't accept it.
- croutonwagon 5y ago
  Is has come up occasionally. But not for anything that’s been a show stopper. I think discord was the most recent, which I use totp for MFA anyway but they want some type of verification or something.

walrus01 5y ago

My strategy for people that need to reach me by voice involves a one step IVR on my own asterisk system. This IVR is linked to a DID that I give out for this purpose. It answers and has a voice greeting prompt that says something like "press five zero zero to be connected". If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID. This cuts down on 99% of your car's extended warranty and IRS scam calls.

gruez 5y ago
>If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID. Which provider allows this? Won't stir/shaken authentication requirements break it in a few years?
- walrus01 5y ago
  I am my own provider: incoming DIDs reside with a wholesale SIP trunking service. Outgoing SIP with the same provider, usually, though I have multiple possible routes. The asterisk system, I run myself. My outgoing caller ID (and my carrier's links to its upstreams such as bandwidth.com) are SHAKEN/STIR compliant.
  - aeontech 5y ago
    This sounds fascinating and also completely over my head in terms of possibilities… is there a basic “getting started guide” you would recommend for someone who may not have the bandwidth to go all-in learning telephony from soup to bolts but would still like the benefits? :)
    - walrus01 5y ago
      Wouldn't recommend it unless you do network/telecom stuff for a living, it has a bit of an ongoing time cost in maintenance... some of the SIP trunking providers that have more focus on the consumer market such as voip.ms do let you define your own custom IVR and menus, to accomplish pretty much what I described, without having your own SIP-speaking system registered to it persistently. You should be able to define a voip.ms IVR destination as your cellphone.
    - jasonjayr 5y ago
      Thinking about this a smidge, you probably can just use voip.ms to (a) order a DID (aka a phone number), (b) setup an IVR for the message, and (c) instruct them to dial an [internal to your account] extension that forwards to your real number, all on the voip.ms platform. You wouldn't have to set anything up, just pay them for per-minute charge. You will have to pay 2x per minute, once for the inbound, and then outbound to your real number, ..... unless you go through the extra steps of setting up SIP phones. FWIW; I've used voip.ms for a long time, and just a very happy customer. The biggest trouble they've had was availability issues a month or so ago when they were the victim of a DDoS :-/. You probably could pull off this trick with any of the pay as you go SIP trunking providers ...
  - gruez 5y ago
    How do the calls actually get routed to your phone? Via SIP, or through your cell provider (ie. it dials your phone's phone number)? If everything is over SIP, then it makes sense that everything is SHAKEN/STIR compliant.
    - walrus01 5y ago
- YokoZar 5y ago
  I called someone today and they appeared to be using a generic call screening service that offers exactly this feature - a computerized voice asks you to enter a random number to be connected.
  - walrus01 5y ago
    I didn't even randomize mine, it's literally the same greeting every time and a fixed extension number. Just the fact that it exists as a roadblock to listen to, comprehend and put in some DTMF tones seems to stop 99% of the scam calls.
    - jrootabega 5y ago
      I'm guessing most scammers don't even hear your prompt. I have a simple, short, "leave a message <beeep>" prompt and the vast majority of my scam voicemails go: 0:00 - 0:10: silence 0:10 - hangup: "Hello? Hello?"
- knodi123 5y ago
  once stir/shaken is in place, won't the underlying problem go away?

dreamcompiler 5y ago

I'm surprised this works for you. Every time I've tried to use my GV number for MFA it's rejected. It's easy for companies to check if a number is assigned to a "legitimate" mobile provider and if not, they just don't accept it.

croutonwagon 5y ago
Is has come up occasionally. But not for anything that’s been a show stopper. I think discord was the most recent, which I use totp for MFA anyway but they want some type of verification or something.