6 ms·

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone cover

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. ChatGPT that everyone is spamming on every discussion? I can't even sign up for it (I'm not really bothered about that; it seems like a dangerous crutch than a useful technology). The problem is the developers have smartphones, their friends have smartphones, their bosses have smartphones and their clients have smartphones. Everyone they know have smartphones and live in places with reception. So they don't or can't imagine something different.

ethanbond 3y ago
If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).
- rationalist 3y ago
  Lots of services do not offer that ability, especially when signing up.
  - sdoering 3y ago
    I have never had a problem with Authy in that regard. Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
    - ValleZ 3y ago
      You are not if you use 2FA.
  - ethanbond 3y ago
    Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.
  - LilBytes 3y ago
    Yep, banks are notorious for this. E.g., ING in Australia.
yunohn 3y ago
> it seems like a dangerous crutch than a useful technology Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”. I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.
- onetokeoverthe 3y ago
  [dead]
- MrVandemar 3y ago
  To quote Hofstadter: I frankly am baffled by the allure ... of letting opaque computational systems perform intellectual tasks for them. ...when it comes to using language in a sensitive manner and talking about real-life situations where the distinction between truth and falsity and between genuineness and fakeness is absolutely crucial, to me it makes no sense whatsoever to let the artificial voice of a chatbot, chatting randomly away at dazzling speed, replace the far slower but authentic and reflective voice of a thinking, living human being. https://www.theatlantic.com/ideas/archive/2023/07/godel-escher-bach-geb-ai/674589/ https://www.theatlantic.com/ideas/archive/2023/07/godel-esch...
- archargelod 3y ago
  > Hallucination is a separate problem, which is solved by using fine-tuned models. They won't solve the main cause of hallucination: prompt has zero connection to generated text other than probability. ChatGPT do not generate answers, it comes up with something that looks like an answer. There is a good chance it is the answer, but you can't guarantee it. I believe this particular problem won't be solved, unless researchers teach machines how to reason. But then we would have greater concerns than hallucinations.
  - yunohn 3y ago
    Yes, but pattern matching and probability will solve for the vast majority of usecases. Heck, it already works quite well and offers value. I don’t need 100% truth, because reading multiple docs myself and piecing things together has tons of potential pitfalls too.
luma 3y ago
If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.
- Traubenfuchs 3y ago
  I assume he is talking about SMS. Maybe a virtual SMS inbox is the solution.
  - deleted 3y ago
    [deleted]
- cesarb 3y ago
  > If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network It might seem surprising these days, but the parent poster might have network access through means other than a phone.
  - MrVandemar 3y ago
    I do :-)
  - denton-scratch 3y ago
    The only reason I have a smartphone is because many services (especially government services, like tax and the NHS) require a mobile phone so you can receive SMS. It's like how the government used to produce documents as MS Office files; they were forcing the public to go along with their choice of software company. Most government docs are now PDFs, happily. But forcing people to choose between Android and iPhone (or forgoing service) is pretty nasty - these devices are expensive.
  - luma 3y ago
    Then use that other device for the auth flow? I'm not surprised by that, but am surprised by your implication that it would still involve your phone.
throwkjsdhfkjds 3y ago
I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services actually decrease the security of my account.
- isykt 3y ago
  You’re absolutely right on that last part. Making phone numbers required for signing up was only nominally to improve security. Overall, it’s a net negative for privacy and security, and only benefits the service provider by allowing them to track you (they can buy data on that phone number and create a profile on you) + reducing the number of people calling/emailing them because the user is locked out of their account.
- gruez 3y ago
  >I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
  - ajsnigrutin 3y ago
    Don't sim cards have PIN authentication enabled by default?
    - gruez 3y ago
      Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.
      - 3y ago
gruez 3y ago
>I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. Have you tried enabling Wi-Fi calling or switching to a carrier that supports it? At least for my carrier and iOS, you can send/receive SMS messages (yes, the green bubbles) through Wi-Fi.
- khalladay 3y ago
  For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc. I do still get them from android phones. Its weird, i have no idea why.
  - gruez 3y ago
    >I do still get them from android phones. Its weird, i have no idea why. If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]? [1] https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services
    - cesarb 3y ago
      > If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]? And, in my experience, Android pushes you heavily to enable RCS; every time you open its messages app, there's a chance that it will randomly ask you to enable it, with a large button to enable and a small link to dismiss the dialog without enabling. I never tried, but I expect that once enabled, it'll never ask again, so it might have been enabled by accident sometime in the past.
  - JimDabell 3y ago
    SMS 2FA often blacklist VOIP and similar systems to avoid abuse. Try receiving SMS 2FA at a Twilio number, for instance – it’s super unreliable. There are virtually no providers where you can reliable receive 2FA via SMS programmatically, with the exception of a handful of companies who use large banks of real SIM cards.
Freeboots 3y ago
I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time. Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locked out of my bank, will have to fork out $50+ just to call them, then hope I can convince them I am who I say I am. Then do the dance again next year when they do it again. Can we all just do authenticator apps?
- screamingninja 3y ago
  > outrageous fees for Google FI Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous? As an alternative, Google Voice will host your phone number for free. It works with every WiFi connection and even while traveling internationally. Have you considered that?
  - gruez 3y ago
    >Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous? It's pretty outrageous if you already have a local sim, so you're basically paying google $20/month to only receive SMS messages.
  - Freeboots 3y ago
    That's interesting, will have to check that out. People have mentioned online sms, which sounds pretty much like what I need. But yeah re:Google Fi, $240/y to recieve maybe 3 sms is pretty bad imo. And unlimited is only within US.
  - HumanOstrich 3y ago
    If you use Google Voice, don't get too attached to the number. They'll reclaim it in a heartbeat for various reasons.
- gruez 3y ago
madeofpalk 3y ago
Unfortunately this point is a bit of FUD about Passkeys (or just off topic). Passkeys themselves don't require internet access. Syncing them across devices might require internet access in the same way that password managers might require internet access to sync across devices.
kj800x 3y ago
FWIW, ChatGPT asks for your number just as an "are you a human" method. It never uses it for 2FA (at least never for me), so as long as you have service the one time your signing up, you'll never get another OTP challenge.
johnwalkr 3y ago
I have a common name, so a ton of people think they have my email address when logging into things. I suspect this triggers 2FA much more than normal as I am constantly logged out of things and have to use 2FA to log back in. Lately I had a pretty funny series of events. I kept the number from the last country I lived in solely for 2FA of accounts from that country and after almost a year I've managed to change over most things but not all. A week ago I decided to change that physical sim to an esim as I only need to enable it occasionally. I did the process for this, and at the end I got a link to last country's app store. The only way to install the esim is to use this app and it is only in last country's app store. I haven't logged into that for a while so it needed email confirmation. I haven't logged into the associated gmail address for a while so that needed 2FA confirmation by SMS. So I'm now locked out of an email address, apple id, and phone number.
threatofrain 3y ago
Every company's customer base is going to look different. This requires research, and developer empathy and life experience cannot substitute for research.
marssaxman 3y ago
Living on a boat last year, I had a similar problem: we had internet access, but no phone service. Getting into my bank account, or any financial account, became a righteous nuisance; I had to drive inland until I found cell service, use my phone as a hotspot, attempt to log in, then wait for the SMS. Realize after getting home that there was another bill to pay? Oops, guess you're driving back into town again!

ethanbond 3y ago

If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).

rationalist 3y ago
Lots of services do not offer that ability, especially when signing up.
- sdoering 3y ago
  I have never had a problem with Authy in that regard. Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
  - ValleZ 3y ago
    You are not if you use 2FA.
- ethanbond 3y ago
  Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.
- LilBytes 3y ago
  Yep, banks are notorious for this. E.g., ING in Australia.

yunohn 3y ago

> it seems like a dangerous crutch than a useful technology Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”. I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.

onetokeoverthe 3y ago
[dead]
MrVandemar 3y ago
To quote Hofstadter: I frankly am baffled by the allure ... of letting opaque computational systems perform intellectual tasks for them. ...when it comes to using language in a sensitive manner and talking about real-life situations where the distinction between truth and falsity and between genuineness and fakeness is absolutely crucial, to me it makes no sense whatsoever to let the artificial voice of a chatbot, chatting randomly away at dazzling speed, replace the far slower but authentic and reflective voice of a thinking, living human being. https://www.theatlantic.com/ideas/archive/2023/07/godel-escher-bach-geb-ai/674589/ https://www.theatlantic.com/ideas/archive/2023/07/godel-esch...
archargelod 3y ago
> Hallucination is a separate problem, which is solved by using fine-tuned models. They won't solve the main cause of hallucination: prompt has zero connection to generated text other than probability. ChatGPT do not generate answers, it comes up with something that looks like an answer. There is a good chance it is the answer, but you can't guarantee it. I believe this particular problem won't be solved, unless researchers teach machines how to reason. But then we would have greater concerns than hallucinations.
- yunohn 3y ago
  Yes, but pattern matching and probability will solve for the vast majority of usecases. Heck, it already works quite well and offers value. I don’t need 100% truth, because reading multiple docs myself and piecing things together has tons of potential pitfalls too.

luma 3y ago

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

Traubenfuchs 3y ago
I assume he is talking about SMS. Maybe a virtual SMS inbox is the solution.
- deleted 3y ago
  [deleted]
cesarb 3y ago
> If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network It might seem surprising these days, but the parent poster might have network access through means other than a phone.
- MrVandemar 3y ago
  I do :-)
- denton-scratch 3y ago
  The only reason I have a smartphone is because many services (especially government services, like tax and the NHS) require a mobile phone so you can receive SMS. It's like how the government used to produce documents as MS Office files; they were forcing the public to go along with their choice of software company. Most government docs are now PDFs, happily. But forcing people to choose between Android and iPhone (or forgoing service) is pretty nasty - these devices are expensive.
- luma 3y ago
  Then use that other device for the auth flow? I'm not surprised by that, but am surprised by your implication that it would still involve your phone.

throwkjsdhfkjds 3y ago

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services actually decrease the security of my account.

isykt 3y ago
You’re absolutely right on that last part. Making phone numbers required for signing up was only nominally to improve security. Overall, it’s a net negative for privacy and security, and only benefits the service provider by allowing them to track you (they can buy data on that phone number and create a profile on you) + reducing the number of people calling/emailing them because the user is locked out of their account.
gruez 3y ago
>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
- ajsnigrutin 3y ago
  Don't sim cards have PIN authentication enabled by default?
  - gruez 3y ago
    Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.
    - 3y ago

gruez 3y ago

>I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. Have you tried enabling Wi-Fi calling or switching to a carrier that supports it? At least for my carrier and iOS, you can send/receive SMS messages (yes, the green bubbles) through Wi-Fi.

khalladay 3y ago
For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc. I do still get them from android phones. Its weird, i have no idea why.
- gruez 3y ago
  >I do still get them from android phones. Its weird, i have no idea why. If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]? [1] https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services
  - cesarb 3y ago
    > If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]? And, in my experience, Android pushes you heavily to enable RCS; every time you open its messages app, there's a chance that it will randomly ask you to enable it, with a large button to enable and a small link to dismiss the dialog without enabling. I never tried, but I expect that once enabled, it'll never ask again, so it might have been enabled by accident sometime in the past.
- JimDabell 3y ago
  SMS 2FA often blacklist VOIP and similar systems to avoid abuse. Try receiving SMS 2FA at a Twilio number, for instance – it’s super unreliable. There are virtually no providers where you can reliable receive 2FA via SMS programmatically, with the exception of a handful of companies who use large banks of real SIM cards.

Freeboots 3y ago

I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time. Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locked out of my bank, will have to fork out $50+ just to call them, then hope I can convince them I am who I say I am. Then do the dance again next year when they do it again. Can we all just do authenticator apps?

screamingninja 3y ago
> outrageous fees for Google FI Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous? As an alternative, Google Voice will host your phone number for free. It works with every WiFi connection and even while traveling internationally. Have you considered that?
- gruez 3y ago
  >Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous? It's pretty outrageous if you already have a local sim, so you're basically paying google $20/month to only receive SMS messages.
- Freeboots 3y ago
  That's interesting, will have to check that out. People have mentioned online sms, which sounds pretty much like what I need. But yeah re:Google Fi, $240/y to recieve maybe 3 sms is pretty bad imo. And unlimited is only within US.
- HumanOstrich 3y ago
  If you use Google Voice, don't get too attached to the number. They'll reclaim it in a heartbeat for various reasons.
gruez 3y ago

madeofpalk 3y ago

Unfortunately this point is a bit of FUD about Passkeys (or just off topic). Passkeys themselves don't require internet access. Syncing them across devices might require internet access in the same way that password managers might require internet access to sync across devices.

kj800x 3y ago

FWIW, ChatGPT asks for your number just as an "are you a human" method. It never uses it for 2FA (at least never for me), so as long as you have service the one time your signing up, you'll never get another OTP challenge.

johnwalkr 3y ago

I have a common name, so a ton of people think they have my email address when logging into things. I suspect this triggers 2FA much more than normal as I am constantly logged out of things and have to use 2FA to log back in. Lately I had a pretty funny series of events. I kept the number from the last country I lived in solely for 2FA of accounts from that country and after almost a year I've managed to change over most things but not all. A week ago I decided to change that physical sim to an esim as I only need to enable it occasionally. I did the process for this, and at the end I got a link to last country's app store. The only way to install the esim is to use this app and it is only in last country's app store. I haven't logged into that for a while so it needed email confirmation. I haven't logged into the associated gmail address for a while so that needed 2FA confirmation by SMS. So I'm now locked out of an email address, apple id, and phone number.

threatofrain 3y ago

Every company's customer base is going to look different. This requires research, and developer empathy and life experience cannot substitute for research.

marssaxman 3y ago

Living on a boat last year, I had a similar problem: we had internet access, but no phone service. Getting into my bank account, or any financial account, became a righteous nuisance; I had to drive inland until I found cell service, use my phone as a hotspot, attempt to log in, then wait for the SMS. Realize after getting home that there was another bill to pay? Oops, guess you're driving back into town again!