3 ms·

Then we require a phone number for everything (it's not easy to make unlimited new phone numbers) and use OIDC to authenticate to one of a couple providers. You

Then we require a phone number for everything (it's not easy to make unlimited new phone numbers) and use OIDC to authenticate to one of a couple providers. You won't be able to do anything on the internet without logging in first, but the login is safe at the identity provider. If you think about it this is no different than showing your ID to get into a bar.

aio2 3y ago
The problem is that this time, it's not a bar, it's just any store (or really, anywhere) you go.
- datadrivenangel 3y ago
  and they're recording your ID number and sharing that with other stores to track your purchases.
1337biz 3y ago
I trust any bar more about privacy than anyone on the internet. Their incentive to maximize consent to stalk me and my behavior is close to non-existing.
remram 3y ago
Phone numbers are a cheap and reusable resource. Pushing the problem on another site with OIDC doesn't help either, if their CAPTCHAs have the same limitation.
- flangola7 3y ago
  "Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database.
  - KomoD 3y ago
    Some places might require all that but a lot don't need in-person, id card. And there's also sms verification services that charge you a few cents per verification, and they use "real" numbers.
    - remram 3y ago
      In the US, you can walk in a T-Mobile store and get a SIM card for cash, no questions asked. Also once you are sitting on a few dozens phone numbers, you can use them again and again to spam or abuse different services (possibly for sale). It's not like CAPTCHA solutions that you have to do every time.
  - reaperducer 3y ago
    "Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database. You'd think so, but no. I signed up for T-Mobile service early this year with no ID, and paid cash. The store is so eager to complete the transaction that it keeps a government ID document in a drawer and the sales people whip it out whenever anyone looks queasy about providing information. I didn't resist giving my information. All I did was pause because I wasn't sure if I brought my ID with me. Even that little hesitation was enough for the clerk to say, "Don't worry about it. I got you covered" and he pulled out the ID. So I have a T-Mobile account that I can pay for with cash and no ID on file, and someone else's address. Now, if a government was really interested in me, it could probably pull the security camera video or follow the signal around or whatever. But it turns out that KYC is easily bypassed when the incentives are right.
KomoD 3y ago
> Then we require a phone number for everything (it's not easy to make unlimited new phone numbers) There are services that allow you to verify for as low as $0.03/activation and their stock is massive and diverse so that's not a solution
- throwawaaarrgh 3y ago
  It is though. It's how every major company validates new customers without captcha.

aio2 3y ago

The problem is that this time, it's not a bar, it's just any store (or really, anywhere) you go.

datadrivenangel 3y ago
and they're recording your ID number and sharing that with other stores to track your purchases.

1337biz 3y ago

I trust any bar more about privacy than anyone on the internet. Their incentive to maximize consent to stalk me and my behavior is close to non-existing.

remram 3y ago

Phone numbers are a cheap and reusable resource. Pushing the problem on another site with OIDC doesn't help either, if their CAPTCHAs have the same limitation.

flangola7 3y ago
"Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database.
- KomoD 3y ago
  Some places might require all that but a lot don't need in-person, id card. And there's also sms verification services that charge you a few cents per verification, and they use "real" numbers.
  - remram 3y ago
    In the US, you can walk in a T-Mobile store and get a SIM card for cash, no questions asked. Also once you are sitting on a few dozens phone numbers, you can use them again and again to spam or abuse different services (possibly for sale). It's not like CAPTCHA solutions that you have to do every time.
- reaperducer 3y ago
  "Real" cellular phone numbers are a very finite pool and require nontrivial amounts of money, a physical phone (with a burned-in hardware identifier), an in-person interaction, and government ID that validated against a state database. You'd think so, but no. I signed up for T-Mobile service early this year with no ID, and paid cash. The store is so eager to complete the transaction that it keeps a government ID document in a drawer and the sales people whip it out whenever anyone looks queasy about providing information. I didn't resist giving my information. All I did was pause because I wasn't sure if I brought my ID with me. Even that little hesitation was enough for the clerk to say, "Don't worry about it. I got you covered" and he pulled out the ID. So I have a T-Mobile account that I can pay for with cash and no ID on file, and someone else's address. Now, if a government was really interested in me, it could probably pull the security camera video or follow the signal around or whatever. But it turns out that KYC is easily bypassed when the incentives are right.

KomoD 3y ago

> Then we require a phone number for everything (it's not easy to make unlimited new phone numbers) There are services that allow you to verify for as low as $0.03/activation and their stock is massive and diverse so that's not a solution

throwawaaarrgh 3y ago
It is though. It's how every major company validates new customers without captcha.