3 ms·

The services require a phone number not because it adds security, but because it is a monetary challenge for scammers. If a service allows for multiple 2FA ty

The services require a phone number not because it adds security, but because it is a monetary challenge for scammers. If a service allows for multiple 2FA types it usually demands SMS for the initial setup, but once that is done you can remove your phone number to force it to switch to TOTP or a token. It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service.

filoleg 3y ago
That’s totally fine, i am not against services requiring phone numbers during registration. I am just against those services allowing sms to be used as an easy 2FA fallback when an app-based 2FA is enabled. Because doing so makes app-based 2FA kinda useless. I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).
- bsder 3y ago
  > That’s totally fine, i am not against services requiring phone numbers during registration. I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked. If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse. If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.
Wowfunhappy 3y ago
> It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service. Are you relatively confident that these sites actually delete removed phone numbers?
- jandrese 3y ago
  All I'm confident about is that they certainly won't delete them if you leave it as a 2FA option.

filoleg 3y ago

That’s totally fine, i am not against services requiring phone numbers during registration. I am just against those services allowing sms to be used as an easy 2FA fallback when an app-based 2FA is enabled. Because doing so makes app-based 2FA kinda useless. I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).

bsder 3y ago
> That’s totally fine, i am not against services requiring phone numbers during registration. I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked. If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse. If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.

Wowfunhappy 3y ago

> It's generally a good idea to not have your phone number stored in a zillion websites anyway, every copy is just another vulnerability for hackers to exploit when they knock over that service. Are you relatively confident that these sites actually delete removed phone numbers?

jandrese 3y ago
All I'm confident about is that they certainly won't delete them if you leave it as a 2FA option.