Hacker News Reader

Comment by vinay_ys | Hacker News Reader

I have seen too many services that ask phone number for account recovery purposes and then end up using it for other purposes for which the user didn't consent. Given how insecure SMS OTP is, I try not to enable that if I can avoid it. Then, on top of it, bugs like this make the service behave like a globally accessible open reverse-directory of mobile numbers to names.

How is twitter notifying users? Has anyone posted screenshots of this notification? I want to know where this notice will appear.

View on HN

Not defending them but I think a major reason why Twitter (and for example Gmail nowadays) is asking for phone numbers is to decrease spam accounts (which is of course a good thing in itself).

How did they arrive at phone numbers? What other options did they try. It’s too easy to give companies a pass “because spam”

As I said, not defending them. They are likely doing dozens of other things as well. But using phone numbers is a quite effective method of hindering spam/bot account creation - in most countries in Europe at least getting a prepaid SIM requires ID nowadays. Not that Twitter would go as far as to inquire ownership records of phone numbers... but/so you could still go and buy 100 SIM cards if you wanted to, but it'd be way more expensive than just spawning new email addresses.

No spammer ever buys sim cards in store with ID. 5sim.net apparently has direct SS7 access and nearly infinite numbers and offers bulk purchases for receiving SMS. Even for countries like Germany, where ID authentication is mandatory to get a phone number. They have thousands of +49 numbers.

Costs only a few rubles. If you convert it to euros it’s between 1-10 cents, depending on the service and country.

The bottom line is: IDs for sim cards are useless.

Oh, that's interesting. I wonder how they get past regulation in countries like Germany as you said. I'd assume they'd have to be registered as an official operator there?

PS. I wasn't aware of SS7, reading up on it now.

Reply on news.ycombinator.com