8 ms·

I can definitely understand not realizing that you could lose access to your account if you lose your phone number. But once it happens the first time, could yo

• tomxor 4y ago
  > because a very, very niche audience is in dire straits Not very niche.
• IIAOPSW 4y ago
  The phone number decision is stupid. I up and jump countries every few years. Each time, I'm switching to a new number. I'm the opposite of homeless, I'm that jet set elite. The idea that you want, need, should or will tie your identity to a phone number where people can always reach you is long outdated.
  • uup 4y ago
    So use one of the other 2FA options.
    • wavelen 4y ago
      afair you need to set up a phone number before you can choose to add another 2FA option (which is stupid imho)
      • UncleMeat 4y ago
        Even if this is the case, this isn't a problem for the poster. They have a phone number, it just changes frequently. They can sign up, enroll in a TOTP or U2F system, and then they are set.
        • yellowapple 4y ago
          Except if you're using e.g. Google Authenticator and you lose that phone, you've now lost your TOTPs. The most unhoused-friendly solution there would be to use something like Authy instead (which is another password to remember, but at least it makes it easy to recover your TOTP keys on a new device without needing the old one); next best would be to use something like andOTP which supports backups (but then you'd need someplace to store those backups, which introduces the same problems as safely keeping a phone on your person).
          • UncleMeat 4y ago
            The context for this post is a person who moves between countries frequently and therefore gets new phone numbers. This person has consistent access to the same phone.
            • yellowapple 4y ago
              The context of the overall post is the posted Twitter thread, wherein the specific issue is the phone itself being lost/stolen.
      • borissk 4y ago
        It's not stupid - Google wants to track everyone everywhere and a phone number is a good way to link an account to a real world person.
    • esperent 4y ago
      Not always a possibility. Many banks require phone number based 2FA, for example. And you're required to use it any time you want to make a transaction that exceeds some threshold.
      • netheril96 4y ago
        We are talking about Google here, right?
    • jbay808 4y ago
      (FWIW, my bank does not provide any other 2FA options.)
  • RupertEisenhart 4y ago
    Sticking my German sim card into my phone for fifteen minutes in all sorts of random countries and continents and waiting for a number to come through always feels absurd. I pray for the rise of esims! I feel like it's on the cards.
    • lxgr 4y ago
      I've been using eSIMs for the past couple of years for this specific use case, and while they certainly help, it's really just a stop-gap measure: You still need your phone and cell signal to receive them (at least many European carriers don't support SMS over VoWIFI); the eSIM is "stuck" in your phone if it physically breaks (and on many carriers, you can't re-use an eSIM QR activation code in any case); in many countries, SIMs expire after a couple of months or even weeks of inactivity, losing your number permanently, to name just a few. I've found Google Voice to work quite well as a workaround for almost all of these problems, but unfortunately, many US companies insist on not allowing VoIP numbers for 2FA or even plain account creation purposes. I usually try to avoid these companies.
      • mwint 4y ago
        > the eSIM is "stuck" in your phone if it physically breaks Wait, does this happen?
        • heavenlyblue 4y ago
          That's overly dramatic, of course you can re-create it on the other phone. But what's true is that you can't physically transfer it.
          • lxgr 4y ago
            I wasn't trying to be dramatic here: Without deleting an eSIM profile from a device, all implementations I know indeed disallow reinstalling the profile on another device. (The eSIM standard effectively enforces the singleton nature of an instantiated eSIM profile.) But of course most providers can re-issue eSIMs if required, just like they can mail a physical SIM replacement. But in many cases, they either charge for it, require more or less involved bureaucratic acrobatics (including sending the QR code via physical mail as proof-of-address, because they've been burned badly by eSIM swapping), or both. So the assumption that an eSIM activation (QR) code is more or less like a bearer token that you can keep in your password safe and use whenever required often does not hold true, especially when needed most (traveling internationally etc). Fortunately, my provider is pretty good about it (I can instantly self-serve reissue an eSIM in their portal free of charge), but that seems to be the exception, and I also don't know how I feel about that, security-wise. (They don't offer 2FA, as far as I know.)
  • oceanplexian 4y ago
    What’s painful is that I’ve ported my phone number out to a VoIP provider similar to Google Voice for exactly this purpose, but something like 25% of providers now block using SMS for 2FA unless it’s tied to an approved mobile phone operator. Turns out 2FA is also being used as a low-effort form of a captcha in addition to being a tool for data harvesting and “device identification”. I wouldn’t be surprised if legitimate users simply never receive a 2FA SMS because someone used a prepaid phone or something.
    • judge2020 4y ago
      Using mobile phone numbers as a makeshift captcha is the #1 tool any security team has to prevent fraudulent signups. Because they're expensive to get, it puts any attack at a baseline cost $x, so many would-be attackers that only stand to gain $y just don't carry out the attack when $y < $x.
    • throwawaysleep 4y ago
      It is more that generating thousands of phone numbers is extremely expensive. It is cheap for real users, but scammers and spammers have to pay a lot.
    • tehwebguy 4y ago
      Was just reading about how Overwatch 2 won't let people register with a prepaid phone number. I'm sure there is some good reason to want to avoid people spinning up free or ultra low cost phone numbers to make extra accounts but some users were like, "I've been using TracPhone for a decade" or something like that. Also pretty surprised that it's this easy to detect the carrier. Guessing we'll see this more and more!
      • danuker 4y ago
        The problem will solve itself. People unwilling to sign up for a mobile plan for playing a game will automatically boycott the likes of Overwatch 2, which will result in revenue lost (perhaps to competing games that allow prepaid cards). I have only ever used prepaid cards. I would rather be cut off from communication (or buy a local prepaid card) than get a surprise bill of hundreds of euros for visiting a country outside the EU. I guess a lot of people have the same thought process as me around Europe, because there are lots of smartphones available with dual SIM cards.
  • benhurmarcel 4y ago
    I've lived in different countries along the years, it's simple and best to just keep a permanent phone number in the country you consider the most like "home". Get a cheap phone-only plan, stick the SIM into a dumbphone or your second SIM slot. Done.
    • jbay808 4y ago
      That phone number will not necessarily get reception when travelling in foreign countries.
  • xani_ 4y ago
    > The idea that you want, need, should or will tie your identity to a phone number where people can always reach you is long outdated. Yeah I have no idea why phones still use numbers. It would be so easier if same address for e-mail worked for voice, just add some DNS records that point at my phone provider to domain and done. Then again, spam calls would probably be so much worse...
  • sowbug 4y ago
    Fortunately Google doesn't require phone numbers for account access. See, for example: https://www.androidauthority.com/gmail-without-phone-number-3072889/ https://www.androidauthority.com/gmail-without-phone-number-... You do need to be able to receive a texted code at a phone number to create a brand-new account. This is to deter spammers from creating lots of accounts. But once that's done, you can remove the phone number from the account.
  • gerash 4y ago
    you can also use a security key or a onetime password from an authenticator app (plenty of options for each) or a separate device logged into Google as your second factor. You have plenty of options
  • Beltalowda 4y ago
    I'm in the same boat; it's always a pain for services you don't login to that often but do need every 1-2 years. Account recovery ranges from "a pain" to "damn near impossible". I wasn't able to recover my PayPal account for example. I also don't use my phone much, and the only reason I even have one of those things is because it's "needed" for so many things.
  • rex_gallorum2 4y ago
    Absolutely true. I am a serial expat who has lost numerous numbers over the years by switching countries. I at least hope to keep the same basic online services running when crossing borders, but I swear, in the last couple of years, it has become an absolute nightmare. It is getting harder and harder.
• kthejoker2 4y ago
  Wtf Calling homelessness a "niche" .. peak apres moi le deluge
  • esperent 4y ago
    Exactly. The word people should be looking for is "vulnerable". They are not a niche category, they are a vulnerable category, and need protection, not dismissal.
    • Kalium 4y ago
      You're absolutely right. Now let's talk about how much effort and what level of resources it's reasonable to expect a commercial entity to invest in extending protections to vulnerable people in need who happen to not be customers. Perhaps we're asking the wrong entity to address this problem? This seems more like a public service infrastructure problem.
      • alexiaa 4y ago
        Google is a multi-billion dollar company, they barely have to lift a finger. They simply have to provide an option to opt out of 2FA. Add a bunch of warnings if you must. Even if Google was a small startup it would be trivial for them to do this.
        • Kalium 4y ago
          To be clear, your answer to vulnerable people needing protections is to lower the minimum level of security for everyone using Gmail. Do I understand correctly?
          • WithinReason 4y ago
            No, please reread.
            • Kalium 4y ago
• sp332 4y ago
  There are over half a million homeless people in the USA right now. And only a quarter are "chronically homeless", meaning for ober a year or more than once. There are many, many people who will be homeless for a few months at some point during their lives.
  • Bakary 4y ago
    There are 1.5+ billion gmail users. I don't have stats, but that intuitively means millions of vulnerable people who could be scammed or phished or whatnot because they would never think of using 2FA at all. Among those half a million homeless, how many use gmail and are unable to change for whatever reason? Among those, how many have issues with 2FA? Thus we advocate for increasing the vulnerability of millions to do something that would not even help the homeless that much. The whole problem of having to replace their phones every 12 weeks sounds like a far more pressing issue to investigate and find solutions for.
    • Handytinge 4y ago
      What a viewpoint. The number of gmail users in the USA is obviously significantly lower, and the number of homeless or people in similar situations globally is obviously significantly higher.
• ridgered4 4y ago
  > I can definitely understand not realizing that you could lose access to your account if you lose your phone number. But once it happens the first time, could you not pick any free email that does not require 2FA, and warn fellow homeless to avoid gmail? Almost every free email service I've tried now requires a phone number to setup. Even protonmail required it for a brief while, although they now are back to captcha and a stern warning. I actually can't think of another free service besides protonmail that this isn't now true for. An annoying trick some of them use is to allow you to setup the account and then lock it some time later. I've seen on immediate login (irritating waste of time) or after you've used it for awhile (what you used the account for is now held hostage unless you cough up a phone number).
  • stavros 4y ago
    Fastmail doesn't require a phone number for 2FA.
    • ridgered4 4y ago
      It doesn't seem like fastmail is free, just a free trial.
• lazyasciiart 4y ago
  And what, find every system that has your existing email address and change it?
• anigbrowl 4y ago
  > and warn fellow homeless to avoid gmail Besides the fact that this doesn't scale at all, not using gmail is arguably a bad decision. If you have an email address at shiftydomain.com, some services won't accept it because its low barriers to entry may have been exploited by spammers or similar.
• austinjp 4y ago
  > very, very niche audience The homeless are certainly not a niche audience. There might be between 13 and 26 million people in the US alone who have experienced homelessness at some point in their lives [0]. Besides, issues around permanent access to security devices are not exclusive to the homeless. The problem described in TFA impacts a far larger segment of society. Critical services are increasingly only available online -- and online services are increasingly critical. The people governing access to critical services are willfully ignorant to the difficulties that vulnerable people face, and often make those difficulties worse. [0] https://www.ncbi.nlm.nih.gov/books/NBK519593/ https://www.ncbi.nlm.nih.gov/books/NBK519593/
  • parkingrift 4y ago
    That headline number is garbage. It’s 550,000 people at any given time.
    • austinjp 4y ago
      It's certainly not garbage, read it again: people who have "experienced homelessness at some point in their lives".
      • parkingrift 4y ago
        Yes and that “experienced homelessness” figure includes people who moved in with friends, family, or relatives. The headline number is garbage.
        • austinjp 4y ago
          If I was homeless I'd certainly try to move in with friends or relatives. Not garbage :)