Hacker News Reader

Comment by paper-boat | Hacker News Reader

I've also tried going SIM-less for a few years. Wifi hotspots are frequently around you rarely find yourself in a situation needing a data plan.

But the main problem is 2FA many services force you to use now.

Going without a data plan is wonderful, but every now and then, having a couple minutes are SMS services is great.

View on HN

I lived SIM free basically all my adult life, but I had to buy a SIM last September, because a new European banking regulation that requires 2FA.

SMS 2FA is a joke tho.

> SMS 2FA is a joke tho. Yes, everyone knows. But it's better than nothing.

Not always. If the provider can be social engineered into granting you access to the account after proving access to that number then I’m not sure “better than nothing” is that solid.

It's potentially worse than nothing because you can steal someone's sim card and then use that to reset their account password. This is because (as in almost every company that uses text messages for 2fa) you use the sms to authenticate the reset.

Better than having a strong password bypassed using shoddy recovery procedures.

Of course, that means it's not 2FA, just 1FA.

Or these shitty fake 2fa photo tan things they have here in Germany.

Something you have (your phone, with saved passwords) and something you have (your wife's phone, or just a device to take a photo of your screen to show it back to your actual phone) isn't 2fa.

But it makes it so painfully difficult to do anything that a valid step for security, like quickly contacting the bank to say “my phone is untrustworthy” via another device, becomes unreasonable, difficult and unlikely.

(But in general, trying to do anything in Germany is a painful experience. The business culture here seems to be, “if it's beneficial to the customer, it's a cost centre to us so please remove it”.)

For the US and Canada, there is JMP.chat which can be used to 2FA over SMS without a SIM. Uses standard XMPP so can be used from a computer or phone while on WiFi.

There are other proprietary services which can do the same for no monetary cost (usually lots of advertising and tracking, though).

Of course, that means you're giving "Denver Gingerich and others" full access and control over the number and channel used to receive unencrypted authentication tokens.

Reply on news.ycombinator.com