News for hackers. Stuff that matters.
Re:Incident report: Employee and customer account compromise by daniel-cussen on Monday August 08, 2022 @10:25AM (#32385780)
You mean you do not use your personal cell for those things.

Good for you. Your refusal and my refusal protect one another, refusing collectively is stronger than refusing alone.

Re:Incident report: Employee and customer account compromise by bbarnett on Monday August 08, 2022 @11:12AM (#32386386)
I refuse to give my mobile number, or use my mobile number for anything. SMS auth, main contact, anything.

My SMS spam is almost non-existent, compared to others.

But one thing, beyond my desire to not give out my number... it is pointless regardless.

When I worked in office, I had mobile access. At home, a bit rural, my access is nil via 4g/5g. I just have no access.

My mobile forwards after 6 rings to my voip, so that works well. But for SMS auth? Hello! I cannot do that!

I have been an ebay customer for 21, yes 21 years. I can no longer log in, as they now insist I enter a mobile number to continue.

Gee thanks ebay.

(No, SMS won't work via voip, they check numbers, even ported numbers)

21 years. Years of thousands, even >10k spent reliably per year.

Gone as a customer.

Calling paypal support, results in people literally unable to understand ... anything. They repeat a mantra off their screen without deviation. Many cuatomer support people I spoke to, were barely paying attention.

I really don't get it. SMS is barely secure to begin with.

They are willing to throw away accounts, just for pennies on tracking.

21 years.

Re:Incident report: Employee and customer account compromise by dylan604 on Monday August 08, 2022 @01:40PM (#32388592)
I've had an ebay account nearly that long, but I hardly use ebay after it became whatever it became. To the point, ebay recently sent me an email saying that they were going to close my account for lack of use. se la vie
Re:Incident report: Employee and customer account compromise by SOLAR_FIELDS on Monday August 08, 2022 @06:41PM (#32392034)
Just for future reference, the proper spelling is “C’est la vie” (French)
Re:Incident report: Employee and customer account compromise by dylan604 on Tuesday August 09, 2022 @01:07AM (#32394355)
i actually googled that, and it c'est was not returned and i got a bunch of se. whatchagonnado?
Re:Incident report: Employee and customer account compromise by aaaaaaaaata on Tuesday August 09, 2022 @08:24AM (#32396893)
...stop using search engines that tailor themselves to idiot queries more and more every year?
Re:Incident report: Employee and customer account compromise by skrtskrt on Monday August 08, 2022 @12:54PM (#32387984)
Just FYI you don't need a mobile phone to have a mobile number:

* Numbers are generally designated when they're created by regulatory agencies as "landline", "mobile", "VOIP", etc.

* You can provision yourself a mobile number in a provider like Twilio or a competitor if you don't like them, and it will have all the capabilities you want

* Thanks to technological advancements, you can do things like overlay mobile capabilities on non-mobile numbers, but only if you're running all of the traffic through a company that has that tech

* "VOIP" numbers are a vanishingly small corner case for these companies and are a pain in the ass to support. They are a tiny portion of the numbering space and lots of smaller Telco companies just won't complete calls or texts to/from VOIP numbers. Companies like Twilio rely on those smaller companies for last-mile completion or origination of calls.

TL;DR Provision yourself a "mobile" number using an API-enabled SaaS telco platform, which you can use exactly how you want, no actual mobile phone needed, with all the capabilities you want. The "VOIP" number will only continue to cause you more and more issues over time.

Re:Incident report: Employee and customer account compromise by mynameisvlad on Monday August 08, 2022 @12:18PM (#32387466)
voip.ms have SMS support: https://wiki.voip.ms/article/SMS

It does say that short number support is not guaranteed, though.

Re:Incident report: Employee and customer account compromise by ev1 on Monday August 08, 2022 @12:36PM (#32387748)
eBay and etc all ban these. It's not a "supported" issue.
Re:Incident report: Employee and customer account compromise by mynameisvlad on Monday August 08, 2022 @12:52PM (#32387961)
And you know this for a fact? Because you tried it out yourself? Right?

Somehow, even though you say they ban them, I was able to submit it and get a verification message. Funny how that works, when someone just parrots the same thing without actually trying it out.

Proof: https://imgur.com/a/75yKkFl

Re:Incident report: Employee and customer account compromise by ev1 on Monday August 08, 2022 @12:56PM (#32388012)
Yes. I had to close my eBay account last year. They would not take my Google Fi or non-voip.ms VOIP number. Using my VOIP number also immediately got my Twitter account banned before making a single post.

It's annoying as hell because I would very much like to sell a thing or two and don't have many platform choices.

> The process to close the account may take up to 30 days from this notice. eBay will send a message to the email address registered on file, confirming that the account has been closed and, unless on hold, restricted, or suspended, that data associated with the account has been deleted.

I am curious if it is because they care slightly less if it's a CA VOIP number, if it came from a decent pool of numbers, or something else. Or if they will lock you out later and force you to contact the "risk assessment" team and use this as a datapoint.

Re:Incident report: Employee and customer account compromise by mynameisvlad on Tuesday August 09, 2022 @07:19PM (#32405910)
> I am curious if it is because they care slightly less if it's a CA VOIP number, if it came from a decent pool of numbers, or something else. Or if they will lock you out later and force you to contact the "risk assessment" team and use this as a datapoint.

Interestingly it's an old landline number that got ported over to voip.ms, so you'd expect that if it were trusted due to reputation, it'd also only be accepted as a landline. Yet the validation experience has no problem with it.

Re:Incident report: Employee and customer account compromise by ev1 on Tuesday August 09, 2022 @09:33PM (#32406942)
I think this might be related if it was a port. My numbers from Twilio and other services are all either Bandwidth or Onvoy or Peerless and refused (all of these are basically pure VOIP and have no reputation of landline or mobile).
Re:Incident report: Employee and customer account compromise by skrtskrt on Monday August 08, 2022 @01:08PM (#32388192)
See my sibling comment about having a mobile number without a mobile phone
Re:Incident report: Employee and customer account compromise by pete5x5 on Monday August 08, 2022 @11:02AM (#32386277)
Good catch, edited in the *not*. I agree, if everyone refused then it would change. I asked them what would happen if I tried to use a Twilio number to verify, but they did not seem amused by the irony.