3 ms·

"Just get everyone to be perfect, including random companies who require a phone number for validation, and if a single failure ever happens you're going to be

"Just get everyone to be perfect, including random companies who require a phone number for validation, and if a single failure ever happens you're going to be spammed forever in a way that is directly interruptive and intrusive instead of one in a list of messages in a queue." I don't know how to say this any more nicely than this: this is a permanently losing solution with no redeeming qualities to such a degree that it makes me wonder at how in-good-faith the suggestion actually is with regards to solving the stated problem.

rglullis 4y ago
The point is not to "be perfect", the point is to raise the standard of acceptable practices, to make it harder to abuse it. Just as an example: phone numbers should not be used for validation of anything as they are public. So companies who are requiring phones for any kind of authentication should be shamed into changing their practices, much like we learned to not trust companies that stored passwords in plain text, or use "recovery questions".
- eropple 4y ago
  The abuse is that without sufficient guardrails a ten-digit number can be used to bother me at all hours of the day or night unless I want to be less accessible to people who I may need to hear from, not that it's used as an authentication source (which, yeah, not great, but also not the end of the world). Out-of-band authentication aside, a company is going to retain my phone number to be able to contact me. So are my parents. Somebody is also going to inevitably leak it because security is difficult. Breaking the capabilities of bad actors, then, is a requirement. You have entirely ignored this in favor of blame-the-user rhetoric and I can't come up with a great reason why you'd blame every user for a systemic failure other than that the system cannot be repaired.
  - rglullis 4y ago
    > Somebody is also going to inevitably leak it because security is difficult. Phone numbers were and will always be assumed to be public. (Yellow pages are still a thing) > unless I want to be less accessible to people who I may need to hear from. You don't need to be less accessible to anyone. Your phone can and should be able to filter things for you. And is not just a matter of setting up number filtering, I am talking about implementing changes in the application layer. One could imagine, e.g, a phone app that only rings if the caller provides a secret code provided by you, effectively making you reachable by phone number (public) + caller-specific code (private). You could also make that if you have the code on your addressbook, it sends it via DTMF after the call being completed. > other than that the system cannot be repaired. It can be repaired, it is just that the cost of these changes might be too high if mandated for all network operators. But even if the system couldn't be repaired, the solution is not to encourage adoption of a proprietary solution. Apple already controls way too much stuff, we shouldn't give them yet another monopoly for them to exploit.

rglullis 4y ago

The point is not to "be perfect", the point is to raise the standard of acceptable practices, to make it harder to abuse it. Just as an example: phone numbers should not be used for validation of anything as they are public. So companies who are requiring phones for any kind of authentication should be shamed into changing their practices, much like we learned to not trust companies that stored passwords in plain text, or use "recovery questions".

eropple 4y ago
The abuse is that without sufficient guardrails a ten-digit number can be used to bother me at all hours of the day or night unless I want to be less accessible to people who I may need to hear from, not that it's used as an authentication source (which, yeah, not great, but also not the end of the world). Out-of-band authentication aside, a company is going to retain my phone number to be able to contact me. So are my parents. Somebody is also going to inevitably leak it because security is difficult. Breaking the capabilities of bad actors, then, is a requirement. You have entirely ignored this in favor of blame-the-user rhetoric and I can't come up with a great reason why you'd blame every user for a systemic failure other than that the system cannot be repaired.
- rglullis 4y ago
  > Somebody is also going to inevitably leak it because security is difficult. Phone numbers were and will always be assumed to be public. (Yellow pages are still a thing) > unless I want to be less accessible to people who I may need to hear from. You don't need to be less accessible to anyone. Your phone can and should be able to filter things for you. And is not just a matter of setting up number filtering, I am talking about implementing changes in the application layer. One could imagine, e.g, a phone app that only rings if the caller provides a secret code provided by you, effectively making you reachable by phone number (public) + caller-specific code (private). You could also make that if you have the code on your addressbook, it sends it via DTMF after the call being completed. > other than that the system cannot be repaired. It can be repaired, it is just that the cost of these changes might be too high if mandated for all network operators. But even if the system couldn't be repaired, the solution is not to encourage adoption of a proprietary solution. Apple already controls way too much stuff, we shouldn't give them yet another monopoly for them to exploit.