Re:Against risk-based authentication (or, why I wouldn't tru...
by alexiaa on Friday February 03, 2023 @12:52PM
(#34644995)
I suppose it does raise the bar somewhat, but there are many websites that sell access to phone numbers that specifically work on major services like Google for as low as 10 cents per text.
Re:Against risk-based authentication (or, why I wouldn't tru...
by ridgered4 on Friday February 03, 2023 @03:35PM
(#34647364)
Judging by the Twitter and Facebook cases I've learned the purpose of asking for this phone number for security purposes is actually for advertising.
https://www.ftc.gov/news-events/news/press-releases/2022/05/...
https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...
I doubt any company will tie their hands in perpetuity when it comes to security which is by its nature about ever evolving threats. The number of people who are asking for what you're asking for is simply far too small compared to the number of people who expect companies to fight attackers for them.
> it's simply a demand that I give it any phone number, so this can't possibly serve any account security purpose
The purpose of asking for phone numbers like that is to significantly raise the bar for using networks of compromised / spam accounts. Each number can only be used a small number of times to unlock accounts. After its used up, you need to use a different number. Thus this forms a challenge that is very easy for virtually all users to pass (they only need a phone number), but is very hard for abusers to pass because they operate at scale. It means they have to find ways to control large quantities of phone numbers which requires either corrupting phone company employees or large spend on SIM cards and special equipment. You can see what's involved in the photos here:
https://www.bleepingcomputer.com/news/security/ukraine-disma...