At one point, I was working at a company where attackers were spamming our service with ToS-violating content (moslty porn but many grotesque, violent stuff). T

At one point, I was working at a company where attackers were spamming our service with ToS-violating content (moslty porn but many grotesque, violent stuff). The decision was made to require a phone number on the account to disable the attack. I argued that phone numbers were stupid easy to get and bypass this measure, but we did it anyway. To my complete surprise, the attackers didn't bother the obviously surmountable hurdle of getting burner numbers. Yes, phone numbers aren't perfect, but in practice they're surprisingly effective. I fail to see how privacy can both be eroded while also saying phone numbers are stupidly easy to get and bypass. If you're concerned about the privacy of your phone number, feel free to avail yourself of the same methods the bad actors could use. Burner is a legal app. I think calling this a bad decision is arguable. We hand over phone numbers for MFA all the time. I think this is a perfectly fine decision walking well away from the border of invasiveness, which is why I put the burden on critics to define an alternative.