7 ms·

The phone number decision is stupid. I up and jump countries every few years. Each time, I'm switching to a new number. I'm the opposite of homeless, I'm that j

The phone number decision is stupid. I up and jump countries every few years. Each time, I'm switching to a new number. I'm the opposite of homeless, I'm that jet set elite. The idea that you want, need, should or will tie your identity to a phone number where people can always reach you is long outdated.

uup 4y ago
So use one of the other 2FA options.
- wavelen 4y ago
  afair you need to set up a phone number before you can choose to add another 2FA option (which is stupid imho)
  - UncleMeat 4y ago
    Even if this is the case, this isn't a problem for the poster. They have a phone number, it just changes frequently. They can sign up, enroll in a TOTP or U2F system, and then they are set.
    - yellowapple 4y ago
      Except if you're using e.g. Google Authenticator and you lose that phone, you've now lost your TOTPs. The most unhoused-friendly solution there would be to use something like Authy instead (which is another password to remember, but at least it makes it easy to recover your TOTP keys on a new device without needing the old one); next best would be to use something like andOTP which supports backups (but then you'd need someplace to store those backups, which introduces the same problems as safely keeping a phone on your person).
      - UncleMeat 4y ago
        The context for this post is a person who moves between countries frequently and therefore gets new phone numbers. This person has consistent access to the same phone.
        yellowapple 4y ago
        The context of the overall post is the posted Twitter thread, wherein the specific issue is the phone itself being lost/stolen.
  - borissk 4y ago
    It's not stupid - Google wants to track everyone everywhere and a phone number is a good way to link an account to a real world person.
- esperent 4y ago
  Not always a possibility. Many banks require phone number based 2FA, for example. And you're required to use it any time you want to make a transaction that exceeds some threshold.
  - netheril96 4y ago
    We are talking about Google here, right?
- jbay808 4y ago
  (FWIW, my bank does not provide any other 2FA options.)
RupertEisenhart 4y ago
Sticking my German sim card into my phone for fifteen minutes in all sorts of random countries and continents and waiting for a number to come through always feels absurd. I pray for the rise of esims! I feel like it's on the cards.
- lxgr 4y ago
  I've been using eSIMs for the past couple of years for this specific use case, and while they certainly help, it's really just a stop-gap measure: You still need your phone and cell signal to receive them (at least many European carriers don't support SMS over VoWIFI); the eSIM is "stuck" in your phone if it physically breaks (and on many carriers, you can't re-use an eSIM QR activation code in any case); in many countries, SIMs expire after a couple of months or even weeks of inactivity, losing your number permanently, to name just a few. I've found Google Voice to work quite well as a workaround for almost all of these problems, but unfortunately, many US companies insist on not allowing VoIP numbers for 2FA or even plain account creation purposes. I usually try to avoid these companies.
  - mwint 4y ago
    > the eSIM is "stuck" in your phone if it physically breaks Wait, does this happen?
    - heavenlyblue 4y ago
      That's overly dramatic, of course you can re-create it on the other phone. But what's true is that you can't physically transfer it.
      - lxgr 4y ago
        I wasn't trying to be dramatic here: Without deleting an eSIM profile from a device, all implementations I know indeed disallow reinstalling the profile on another device. (The eSIM standard effectively enforces the singleton nature of an instantiated eSIM profile.) But of course most providers can re-issue eSIMs if required, just like they can mail a physical SIM replacement. But in many cases, they either charge for it, require more or less involved bureaucratic acrobatics (including sending the QR code via physical mail as proof-of-address, because they've been burned badly by eSIM swapping), or both. So the assumption that an eSIM activation (QR) code is more or less like a bearer token that you can keep in your password safe and use whenever required often does not hold true, especially when needed most (traveling internationally etc). Fortunately, my provider is pretty good about it (I can instantly self-serve reissue an eSIM in their portal free of charge), but that seems to be the exception, and I also don't know how I feel about that, security-wise. (They don't offer 2FA, as far as I know.)
oceanplexian 4y ago
What’s painful is that I’ve ported my phone number out to a VoIP provider similar to Google Voice for exactly this purpose, but something like 25% of providers now block using SMS for 2FA unless it’s tied to an approved mobile phone operator. Turns out 2FA is also being used as a low-effort form of a captcha in addition to being a tool for data harvesting and “device identification”. I wouldn’t be surprised if legitimate users simply never receive a 2FA SMS because someone used a prepaid phone or something.
- judge2020 4y ago
  Using mobile phone numbers as a makeshift captcha is the #1 tool any security team has to prevent fraudulent signups. Because they're expensive to get, it puts any attack at a baseline cost $x, so many would-be attackers that only stand to gain $y just don't carry out the attack when $y < $x.
- throwawaysleep 4y ago
  It is more that generating thousands of phone numbers is extremely expensive. It is cheap for real users, but scammers and spammers have to pay a lot.
- tehwebguy 4y ago
  Was just reading about how Overwatch 2 won't let people register with a prepaid phone number. I'm sure there is some good reason to want to avoid people spinning up free or ultra low cost phone numbers to make extra accounts but some users were like, "I've been using TracPhone for a decade" or something like that. Also pretty surprised that it's this easy to detect the carrier. Guessing we'll see this more and more!
  - danuker 4y ago
    The problem will solve itself. People unwilling to sign up for a mobile plan for playing a game will automatically boycott the likes of Overwatch 2, which will result in revenue lost (perhaps to competing games that allow prepaid cards). I have only ever used prepaid cards. I would rather be cut off from communication (or buy a local prepaid card) than get a surprise bill of hundreds of euros for visiting a country outside the EU. I guess a lot of people have the same thought process as me around Europe, because there are lots of smartphones available with dual SIM cards.
benhurmarcel 4y ago
I've lived in different countries along the years, it's simple and best to just keep a permanent phone number in the country you consider the most like "home". Get a cheap phone-only plan, stick the SIM into a dumbphone or your second SIM slot. Done.
- jbay808 4y ago
  That phone number will not necessarily get reception when travelling in foreign countries.
xani_ 4y ago
> The idea that you want, need, should or will tie your identity to a phone number where people can always reach you is long outdated. Yeah I have no idea why phones still use numbers. It would be so easier if same address for e-mail worked for voice, just add some DNS records that point at my phone provider to domain and done. Then again, spam calls would probably be so much worse...
sowbug 4y ago
Fortunately Google doesn't require phone numbers for account access. See, for example: https://www.androidauthority.com/gmail-without-phone-number-3072889/ https://www.androidauthority.com/gmail-without-phone-number-... You do need to be able to receive a texted code at a phone number to create a brand-new account. This is to deter spammers from creating lots of accounts. But once that's done, you can remove the phone number from the account.
gerash 4y ago
you can also use a security key or a onetime password from an authenticator app (plenty of options for each) or a separate device logged into Google as your second factor. You have plenty of options
Beltalowda 4y ago
I'm in the same boat; it's always a pain for services you don't login to that often but do need every 1-2 years. Account recovery ranges from "a pain" to "damn near impossible". I wasn't able to recover my PayPal account for example. I also don't use my phone much, and the only reason I even have one of those things is because it's "needed" for so many things.
rex_gallorum2 4y ago
Absolutely true. I am a serial expat who has lost numerous numbers over the years by switching countries. I at least hope to keep the same basic online services running when crossing borders, but I swear, in the last couple of years, it has become an absolute nightmare. It is getting harder and harder.

uup 4y ago

So use one of the other 2FA options.

wavelen 4y ago
afair you need to set up a phone number before you can choose to add another 2FA option (which is stupid imho)
- UncleMeat 4y ago
  Even if this is the case, this isn't a problem for the poster. They have a phone number, it just changes frequently. They can sign up, enroll in a TOTP or U2F system, and then they are set.
  - yellowapple 4y ago
    Except if you're using e.g. Google Authenticator and you lose that phone, you've now lost your TOTPs. The most unhoused-friendly solution there would be to use something like Authy instead (which is another password to remember, but at least it makes it easy to recover your TOTP keys on a new device without needing the old one); next best would be to use something like andOTP which supports backups (but then you'd need someplace to store those backups, which introduces the same problems as safely keeping a phone on your person).
    - UncleMeat 4y ago
      The context for this post is a person who moves between countries frequently and therefore gets new phone numbers. This person has consistent access to the same phone.
      - yellowapple 4y ago
        The context of the overall post is the posted Twitter thread, wherein the specific issue is the phone itself being lost/stolen.
- borissk 4y ago
  It's not stupid - Google wants to track everyone everywhere and a phone number is a good way to link an account to a real world person.
esperent 4y ago
Not always a possibility. Many banks require phone number based 2FA, for example. And you're required to use it any time you want to make a transaction that exceeds some threshold.
- netheril96 4y ago
  We are talking about Google here, right?
jbay808 4y ago
(FWIW, my bank does not provide any other 2FA options.)

RupertEisenhart 4y ago

Sticking my German sim card into my phone for fifteen minutes in all sorts of random countries and continents and waiting for a number to come through always feels absurd. I pray for the rise of esims! I feel like it's on the cards.

lxgr 4y ago
I've been using eSIMs for the past couple of years for this specific use case, and while they certainly help, it's really just a stop-gap measure: You still need your phone and cell signal to receive them (at least many European carriers don't support SMS over VoWIFI); the eSIM is "stuck" in your phone if it physically breaks (and on many carriers, you can't re-use an eSIM QR activation code in any case); in many countries, SIMs expire after a couple of months or even weeks of inactivity, losing your number permanently, to name just a few. I've found Google Voice to work quite well as a workaround for almost all of these problems, but unfortunately, many US companies insist on not allowing VoIP numbers for 2FA or even plain account creation purposes. I usually try to avoid these companies.
- mwint 4y ago
  > the eSIM is "stuck" in your phone if it physically breaks Wait, does this happen?
  - heavenlyblue 4y ago
    That's overly dramatic, of course you can re-create it on the other phone. But what's true is that you can't physically transfer it.
    - lxgr 4y ago
      I wasn't trying to be dramatic here: Without deleting an eSIM profile from a device, all implementations I know indeed disallow reinstalling the profile on another device. (The eSIM standard effectively enforces the singleton nature of an instantiated eSIM profile.) But of course most providers can re-issue eSIMs if required, just like they can mail a physical SIM replacement. But in many cases, they either charge for it, require more or less involved bureaucratic acrobatics (including sending the QR code via physical mail as proof-of-address, because they've been burned badly by eSIM swapping), or both. So the assumption that an eSIM activation (QR) code is more or less like a bearer token that you can keep in your password safe and use whenever required often does not hold true, especially when needed most (traveling internationally etc). Fortunately, my provider is pretty good about it (I can instantly self-serve reissue an eSIM in their portal free of charge), but that seems to be the exception, and I also don't know how I feel about that, security-wise. (They don't offer 2FA, as far as I know.)

oceanplexian 4y ago

What’s painful is that I’ve ported my phone number out to a VoIP provider similar to Google Voice for exactly this purpose, but something like 25% of providers now block using SMS for 2FA unless it’s tied to an approved mobile phone operator. Turns out 2FA is also being used as a low-effort form of a captcha in addition to being a tool for data harvesting and “device identification”. I wouldn’t be surprised if legitimate users simply never receive a 2FA SMS because someone used a prepaid phone or something.

judge2020 4y ago
Using mobile phone numbers as a makeshift captcha is the #1 tool any security team has to prevent fraudulent signups. Because they're expensive to get, it puts any attack at a baseline cost $x, so many would-be attackers that only stand to gain $y just don't carry out the attack when $y < $x.
throwawaysleep 4y ago
It is more that generating thousands of phone numbers is extremely expensive. It is cheap for real users, but scammers and spammers have to pay a lot.
tehwebguy 4y ago
Was just reading about how Overwatch 2 won't let people register with a prepaid phone number. I'm sure there is some good reason to want to avoid people spinning up free or ultra low cost phone numbers to make extra accounts but some users were like, "I've been using TracPhone for a decade" or something like that. Also pretty surprised that it's this easy to detect the carrier. Guessing we'll see this more and more!
- danuker 4y ago
  The problem will solve itself. People unwilling to sign up for a mobile plan for playing a game will automatically boycott the likes of Overwatch 2, which will result in revenue lost (perhaps to competing games that allow prepaid cards). I have only ever used prepaid cards. I would rather be cut off from communication (or buy a local prepaid card) than get a surprise bill of hundreds of euros for visiting a country outside the EU. I guess a lot of people have the same thought process as me around Europe, because there are lots of smartphones available with dual SIM cards.

benhurmarcel 4y ago

I've lived in different countries along the years, it's simple and best to just keep a permanent phone number in the country you consider the most like "home". Get a cheap phone-only plan, stick the SIM into a dumbphone or your second SIM slot. Done.

jbay808 4y ago
That phone number will not necessarily get reception when travelling in foreign countries.

xani_ 4y ago

> The idea that you want, need, should or will tie your identity to a phone number where people can always reach you is long outdated. Yeah I have no idea why phones still use numbers. It would be so easier if same address for e-mail worked for voice, just add some DNS records that point at my phone provider to domain and done. Then again, spam calls would probably be so much worse...

sowbug 4y ago

Fortunately Google doesn't require phone numbers for account access. See, for example: https://www.androidauthority.com/gmail-without-phone-number-3072889/ https://www.androidauthority.com/gmail-without-phone-number-... You do need to be able to receive a texted code at a phone number to create a brand-new account. This is to deter spammers from creating lots of accounts. But once that's done, you can remove the phone number from the account.

gerash 4y ago

you can also use a security key or a onetime password from an authenticator app (plenty of options for each) or a separate device logged into Google as your second factor. You have plenty of options

Beltalowda 4y ago

I'm in the same boat; it's always a pain for services you don't login to that often but do need every 1-2 years. Account recovery ranges from "a pain" to "damn near impossible". I wasn't able to recover my PayPal account for example. I also don't use my phone much, and the only reason I even have one of those things is because it's "needed" for so many things.

rex_gallorum2 4y ago

Absolutely true. I am a serial expat who has lost numerous numbers over the years by switching countries. I at least hope to keep the same basic online services running when crossing borders, but I swear, in the last couple of years, it has become an absolute nightmare. It is getting harder and harder.