4 ms·

The amount of trust that providers put in phone numbers is absolutely insane.

by xvector 5y ago

cassepipe 5y ago
Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)
- yeetaccount4 5y ago
  I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world. E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that…
- notreallyserio 5y ago
  My phone number is probably the least valuable thing Amazon knows about me, I figure.
  - novok 5y ago
    Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales. Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.
- Semaphor 5y ago
  I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).
deleted 5y ago
[deleted]
Avamander 5y ago
That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.
- prirun 5y ago
  Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.
  - dvsfish 5y ago
    Is this a niche waiting to be exploited?
    - nextos 5y ago
      Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies... But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field. Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.
      - Silhouette 5y ago
        The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon. It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.
nextos 5y ago
I agree. I change my phone number often and this is annoying. It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP. I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable. Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.
- jounker 5y ago
  Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.
  - nextos 5y ago
    That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.
    - jounker 5y ago
      It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.
    - Semaphor 5y ago
      N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?
dheera 5y ago
Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.

The amount of trust that providers put in phone numbers is absolutely insane.

cassepipe 5y ago

Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)

yeetaccount4 5y ago
I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world. E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that…
notreallyserio 5y ago
My phone number is probably the least valuable thing Amazon knows about me, I figure.
- novok 5y ago
  Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales. Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.
Semaphor 5y ago
I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).

deleted 5y ago

[deleted]

Avamander 5y ago

That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.

prirun 5y ago
Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.
- dvsfish 5y ago
  Is this a niche waiting to be exploited?
  - nextos 5y ago
    Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies... But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field. Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.
    - Silhouette 5y ago
      The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon. It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.

nextos 5y ago

I agree. I change my phone number often and this is annoying. It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP. I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable. Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.

jounker 5y ago
Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.
- nextos 5y ago
  That's interesting. What 2FA system do they use exactly? AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.
  - jounker 5y ago
    It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.
  - Semaphor 5y ago
    N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?

dheera 5y ago

Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.