Hacker News Reader

Comment by Maxburn | Hacker News Reader

I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive 2FA SMS wouldn't it be more secure to have that tied to a VoIP number that can't be SIM swapped and potentially is secured with 2FA itself?

View on HN

It's because most companies that use SMS "2FA" don't use it for your security, they use it for their security—phone numbers are a costly resource, and every phone number an attacker spends to launch a spam attack is a phone number they'll never be able to use again. VoIP numbers flip that logic on its head by making it much cheaper to provision and allocate phone numbers. This also slightly protects user accounts because it makes it harder for attackers to "overwrite" a hijacked user account with their own bogus phone number during takeover, but that's a secondary goal—the main goal is spam reduction

I get it, but it's still sad.

Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key.

But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.

You can port other numbers to Google voice, which helps I think.

not really, they will be identified as voip then

I keep hearing back and forth on this, you would hope that this gets updated every once in a while but seems like mixed results. I don't even know what the process is called to research this.

Best is this system is broken. There is always a VoIP provider that works with the selected service.

And there are always also many services where you can rent non VoIP numbers for a single SMS for pennies.

If paying $0.05 is a form of security we could just charge for registrations as well.

It is. I'm guessing the thinking is that ANY 2FA is better than none.

Slight correction: They don’t block VoIP. They block numbers that were issued to VoIP providers.

I have an AT&T number ProRes to Google Voice which works perfectly. But another native Google Voice number does not.

Lol, again I'm hearing numbers carry the VoIP tag permanently vs not. It doesn't seem to be consistent to say the least. I bought my number from GV (changed) and it carries the stigma. Read peoples experiences in porting from services like number barn and total mixed bag.

For your experience did you sign up for those services before or after transferring to VoIP?

VoIP is banned?

Many social media sites don't allow you to register using e.g. Google Voice or Twilio phone numbers, since you can get those for free and/or in bulk, so they assume they're used for spam or ban evasion.

I've seen this on Twitter, which doesn't require a phone number to set up, but it's possible for your account to be flagged as suspicious, and get locked down until you add a phone number.

Ebay and Uber are more.

Lots of banks reject VoIP too.

Twitter does lock you out and force you to give them your phone number, even if you technically can register without one. I’ve seen them do so almost instantly after registration.

That's very concerning. Many phone companies require you to back your hard number to a national id.

Say something bad about insert monarchy... They'll trace you down with that.(Turkcell does that just for wifi at IST)

In many countries they are required to do so by law for acquiring any phone number. Including per-paid. It's not uncommon that it's true for _any_ phone number including VoIP. But a single person as a "company" can get a huge number of VoIP numbers and then "accidentally" get hacked by a illegal phishing call center then using that numbers. Or maybe that persons passport got stolen and used by a similar locking person. Or the passport verifying personal got bribed. Etc.

Reply on news.ycombinator.com