Hacker News Reader

Comment by devoply | Hacker News Reader

Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.

View on HN

Which i control even less... I dont doubt there are solutions, but the only one i've seen so far that is kind of optimal is Github which allows me to disable lost 2fa access through verifying with a git push like command based on public/private key.

I don't know what control means to you. You mean stuff that you don't have to pay for? Stuff that can't be taken away from you? I have had the same number with VOIP.ms for 5 years. Even used it from Mexico. It does not seem to me to be out of my control.

Control means i own it. You never own telephone numbers, maybe you do in some countries i dont know, but they usual contract is that you rent them and they can be taken away from you anytime. Sure they usually dont, but building a security system on something like that is obviously suboptimal.

Not sure I understand the difference between renting a telephone number and renting a domain, or email address, or even a home address. All can be taken away for various reasons, failure to pay rent/renewal/mortgage, legal confiscations, etc.

As far as I can tell, it's just a whine services don't let you use a preferred rented identity listing (that is arguably less tied to the real world).

There's not a lot of genuine security or legal analysis to be found here.

Some other guy went a bit more into genuine security if thats your thing: https://www.devever.net/~hl/e164

According to my telephone contract it can be taken at any time and i am not entitled to my telephone number. This is something you dont find with domains.

They can take your domain away, for example, if you fail to respond to an inquiry regarding invalid contact info. Anyone can initiate one of those inquiries. And, of course, there's the various domain name dispute policies at ICANN.

I just checked for details. So far as i can tell its a long, costly and usually failing process to get a domain taken. VS. Just a random thought by a single entity to get your phone number taken.

Man in the middle.

The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.

Reply on news.ycombinator.com