4 ms·
I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive
by Maxburn 4y ago
I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive 2FA SMS wouldn't it be more secure to have that tied to a VoIP number that can't be SIM swapped and potentially is secured with 2FA itself?
- nightpool 4y agoIt's because most companies that use SMS "2FA" don't use it for your security, they use it for their security—phone numbers are a costly resource, and every phone number an attacker spends to launch a spam attack is a phone number they'll never be able to use again. VoIP numbers flip that logic on its head by making it much cheaper to provision and allocate phone numbers. This also slightly protects user accounts because it makes it harder for attackers to "overwrite" a hijacked user account with their own bogus phone number during takeover, but that's a secondary goal—the main goal is spam reduction
- Maxburn 4y agoI get it, but it's still sad. Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key. But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.
- ForHackernews 4y agoYou can port other numbers to Google voice, which helps I think.
- rekoil 4y agoVoIP is banned?
- kyle-rb 4y agoMany social media sites don't allow you to register using e.g. Google Voice or Twilio phone numbers, since you can get those for free and/or in bulk, so they assume they're used for spam or ban evasion. I've seen this on Twitter, which doesn't require a phone number to set up, but it's possible for your account to be flagged as suspicious, and get locked down until you add a phone number.
- Maxburn 4y agoEbay and Uber are more. Lots of banks reject VoIP too.
- mildmotive 4y agoTwitter does lock you out and force you to give them your phone number, even if you technically can register without one. I’ve seen them do so almost instantly after registration.
- monksy 4y agoThat's very concerning. Many phone companies require you to back your hard number to a national id. Say something bad about insert monarchy... They'll trace you down with that.(Turkcell does that just for wifi at IST)
- dathinab 4y agoIn many countries they are required to do so by law for acquiring any phone number. Including per-paid. It's not uncommon that it's true for _any_ phone number including VoIP. But a single person as a "company" can get a huge number of VoIP numbers and then "accidentally" get hacked by a illegal phishing call center then using that numbers. Or maybe that persons passport got stolen and used by a similar locking person. Or the passport verifying personal got bribed. Etc.
- WirelessGigabit 4y agoSlight correction: They don’t block VoIP. They block numbers that were issued to VoIP providers. I have an AT&T number ProRes to Google Voice which works perfectly. But another native Google Voice number does not.
- Maxburn 4y agoLol, again I'm hearing numbers carry the VoIP tag permanently vs not. It doesn't seem to be consistent to say the least. I bought my number from GV (changed) and it carries the stigma. Read peoples experiences in porting from services like number barn and total mixed bag. For your experience did you sign up for those services before or after transferring to VoIP?
- herbst 4y agoBest is this system is broken. There is always a VoIP provider that works with the selected service. And there are always also many services where you can rent non VoIP numbers for a single SMS for pennies. If paying $0.05 is a form of security we could just charge for registrations as well.
- Maxburn 4y agoIt is. I'm guessing the thinking is that ANY 2FA is better than none.