5 ms·
Yet another reason why requiring phone numbers for account creation/verification is an awful, user-hostile idea. I've always hated services that do this.
by Jordrok 4y ago
Yet another reason why requiring phone numbers for account creation/verification is an awful, user-hostile idea. I've always hated services that do this.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- richbell 4y agoFacebook pressured people into adding their phone number under the guise of account safety, however, their true motive was to harvest phone numbers. As far as I'm concerned it's not only user-hostile, but deliberately malicious. Moreover, there's no excuse for services to use phone numbers for 2FA.
- pid_0 4y agoIt’s actually to reduce trolls, bots, etc. the easier it is to make an account the lower quality most accounts will be.
- EddySchauHai 4y agoYep. “Suspicious activity detected, please add a mobile number to confirm you’re account” 24h after creating a new account like clockwork.
- smolder 4y agoMicrosoft did this when I signed up to play Halo Infinite. I had a few hours of play time doing nothing at all suspicious and deleted the game rather than give them my phone number.
- cronix 4y agoNot nearly as bad in my book as the despicable people who haphazardly give access to their contacts. I don't care if you dox yourself.
- deleted 4y ago[deleted]
- throwaway290 4y agoYes, though least it's a free product. Now imagine MS doing the same trick with paying customers who spent at least $30 thinking they'd get to own a copy of Minecraft.
- blooalien 4y agoNot only that, but their Android apps all do their very best to convince folks to allow access to their phone's contact list as well. Even more phone numbers for the "All Seeing Eye of Zuckerberg's Giant Database of Everyone™".
- busymom0 4y agoGenuinely curious - what's a better way to verify accounts aren't bots?
- hirako2000 4y agoSell a service rather than sell your users and suddenly the bots are far less of a problem. In essence make users pay, bots will become shy
- brigandish 4y agoAllow bots but also give users the tools to filter out bots that Twitter keeps to itself.
- qweqwerwerwerwr 4y agothere isn't one. but that's irrelevant because the services that require your phone number don't do it for the sake of security or to combat bots, they do it to gather data. when you give a megacorp your phone number, they get your real name, your relationships, and a myriad data points to sell. this is the reason why all megacorp mobile apps and every other free flashlight/calculator/alarm app require access to your contact list.
- nemothekid 4y ago>but that's irrelevant because the services that require your phone number don't do it for the sake of security or to combat bots Discord allows you to enable phone number verification at a per-admin level basis; and it is done to reduce spam and bots. You can't just pretend the problem doesn't exist.
- 55555 4y agoTwitter is at least partly asking for phone number in order to fight spam. I am aware a big motivator is also to link you to an advertising profile.
- qweqwerwerwerwr 4y ago
- password4321 4y agoI don't mean to suggest the burden is on you to provide one, but what alternative even comes close to requiring a phone number for account creation... perhaps a credit card authorization?
- xyzzy123 4y agoOne reason many well-meaning security teams want mobiles is that phone numbers "cost" money for (most) attackers to create but do not create much additional burden for (most) legitimate users. In a sense they are used as a kind of "hashcash" to raise the cost of fake accounts. You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range).
- solarkraft 4y agoIt's also something the service provider has to do and I can't verify as a user.
- oarsinsync 4y ago> You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range). So store two hashes, one being the whole number, another being the number excluding the last 2 digits. These aren’t difficult problems to solve. The bigger issue is that they’re not revenue generating solutions, but rather the opposite.