Codes sent by text message

[The Real Bev]

Some annoying websites insist on authentication by requiring me to enter
the number they send by text message. For some reason my google voice
number is never identified as a real phone number and I have to use my
old phone with the $10/year SIM to receive their code.

WTF? Why is the google voice number not a REAL phone number?

[Jörg Lorenz]

Post by The Real Bev
Some annoying websites insist on authentication by requiring me to enter
the number they send by text message. For some reason my google voice
number is never identified as a real phone number and I have to use my
old phone with the $10/year SIM to receive their code.
WTF? Why is the google voice number not a REAL phone number?

Google seems not to be a part of the regular telephony system in the USA
and probably elsewhere. Same as WhatsApp, Signal or other Messengers. I
guess you have no SIM card for this service.

https://support.google.com/voice/thread/10031187/how-to-change-the-google-voice-number-to-be-real-cell-phone-number-with-sim-card?hl=en

[The Real Bev]

Post by Jörg Lorenz

Post by The Real Bev
Some annoying websites insist on authentication by requiring me to enter
the number they send by text message. For some reason my google voice
number is never identified as a real phone number and I have to use my
old phone with the $10/year SIM to receive their code.
WTF? Why is the google voice number not a REAL phone number?

Google seems not to be a part of the regular telephony system in the USA
and probably elsewhere. Same as WhatsApp, Signal or other Messengers. I
guess you have no SIM card for this service.

No, I have a Keepgo data SIM which uses my google voice number to
piggyback onto 'movistar' and/or T-Mobile. When I use it to make phone
calls part of the data gets used as 'mobile' and generally more gets
used as 'roaming'. It makes my head hurt thinking about it, but I've
got 3GB of data and a year to use it, and I've only used 200 MB in 6
months. I don't need to use any of it when I'm near a free wifi hotspot.

$30 for 3GB for a year and I have to buy a few dollars worth at the end
of the year. If anybody is interested you can join through a link I
send you and we both get 3GB of free data. Just sayin'.

Post by Jörg Lorenz
https://support.google.com/voice/thread/10031187/how-to-change-the-google-voice-number-to-be-real-cell-phone-number-with-sim-card?hl=en

[Dave Royal]

Post by The Real Bev
Some annoying websites insist on authentication by requiring me to enter
the number they send by text message. For some reason my google voice
number is never identified as a real phone number and I have to use my
old phone with the $10/year SIM to receive their code.
WTF? Why is the google voice number not a REAL phone number?

According to this
<https://support.google.com/voice/thread/1592118>

"Google Voice phone numbers are classified as land lines, just
like other VoIP service providers' numbers.  The SMS/MMS function
is spliced on, via a third-party messaging gateway.  Since there
is a higher possibility that a criminal could compromise this
technology, the banks won't allow the use of VoIP
numbers.

This limitation is being implemented by Wells Fargo (and other
banks, like Bank of America), not by Google."

[Richmond]

Post by The Real Bev
Some annoying websites insist on authentication by requiring me to
enter the number they send by text message. For some reason my google
voice number is never identified as a real phone number and I have to
use my old phone with the $10/year SIM to receive their code.
WTF? Why is the google voice number not a REAL phone number?

I noticed some time ago that twitter would not accept numbers beginning
with 056 which are VOIP numbers.

[VanguardLH]

Post by The Real Bev
Some annoying websites insist on authentication by requiring me to enter
the number they send by text message. For some reason my google voice
number is never identified as a real phone number and I have to use my
old phone with the $10/year SIM to receive their code.
WTF? Why is the google voice number not a REAL phone number?

I use GV, too. It is considered, because it is, a VOIP service rather
than a telco or cellular carrier. The site wants to track to a device,
not to a VOIP service. The IMEI number of your phone is gold to
trackers.

"How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and
Vladimir Putin"
https://www.wired.com/story/how-pentagon-learned-targeted-ads-to-find-targets-and-vladimir-putin/

Physical phones are preferred for tracking. They want to track by
device, not by service. Even landlines are preferred over services. GV
operates much like a PBX or forwarding service using simultaneous ring
to call your phone(s). Sites won't know what are your devices to track
when you give them GV, OOMA, or other PBX/forwarding services. Some
sites won't let you use e-mail aliasing or forwarding services, either.
They want something more direct.

[Newyana2]

"The Real Bev" <***@gmail.com> wrote

| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.
Cellphones are so ubiquitous that they've become like
prison camp ID nubmber tattoos. It's assumed that you
have a number to give them. GMail is a good example. It's
a low security medium and people generally don't send
anything critical via email, yet Google wants to ID your
device and/or your cellphone in order to let you get email.
That allows them to greatly increase the volume and
accuracy of surveillance. Also, the more businesses require
that you register a phone #, the more likely that everyone
will be permanently IDed by their number.

Some services will send a computer spoken number to
a landline, but those sites are few. I'm surprised the evangelical
Christians are not calling this the mark of the beast. I guess
they're all busy texting.

Recently I was thinking of buying some stock and checked
out the options. Not only am I concerned about the privacy issue,
but I also don't want to be trusting people with my money when
getting it back requires that I have a cellphone and not lose
it. Stockbroker websites don't charge for purchases, but only
because they can automate the whole thing and collect personal
data. But what if I lose my Tracfone and can't get that number
again... then get faced with a computer telling me that I don't
seem to be me, with no human recourse? Do I need a fullscale,
$60/month phone in order to own my phone number?

I called up Schwabb to ask them about it. I got a very friendly,
competent man who said that I could just skip the cellphone
entry on the application webpage. Not true. He also said I could
sign up in person at their office. But then what if I try to make
a trade and it won't let me do it without a cellphone number?
The trouble is that no one's minding the store. If humans are
involved, it costs money... So I gave up on the investing idea. I
didn't really have much to spare, anyway. :)

[The Real Bev]

Post by Newyana2
I called up Schwabb to ask them about it. I got a very friendly,
competent man who said that I could just skip the cellphone
entry on the application webpage. Not true. He also said I could
sign up in person at their office. But then what if I try to make
a trade and it won't let me do it without a cellphone number?
The trouble is that no one's minding the store. If humans are
involved, it costs money... So I gave up on the investing idea. I
didn't really have much to spare, anyway. :)

We've been with Vanguard a long time; the bond lady was really useful
back when you could get 12% on municipals. Since then they've become
more annoying. For some transactions on our community property account
(before they set up that voice-recognition thing) they had to hear my
husband giving his SS # etc. in addition to what I told them. It never
seemed to occur to them that I could have killed my husband and was
telling my toyboy what to say while we cleared out the account. PLUS
they then needed to send a code to my cellphone. It takes forever to do
transactions that OUGHT to be possible on line, but which require a
phone call instead.

We've never been 'traders', but if someone wanted to make a fast trade
NOW within seconds as the price is changing rapidly (s)he'd be up shit
creek. Common stuff is easy with Schwab and E-Trade, but RMDs are
problematical and I end up phoning because you just can't get there from
here.

[Newyana2]

"The Real Bev" <***@gmail.com> wrote


| We've been with Vanguard a long time;

Mutual fund? I was thinking of playing stocks. My idea was
to invest in a trash removal company. Cities are all subcontacting
to them now. Then there's construction demo. Rubbish is the
future! But even that seems risky. I can't afford to lose my modest
savings, not knowing how long I'll be able to keep working. Even
mutual funds were losing until recently. And the people who deal
in those take 1/2 to 1% commission, per year, whether you win
or lose.

| (before they set up that voice-recognition thing) they had to hear my
| husband giving his SS # etc. in addition to what I told them. It never
| seemed to occur to them that I could have killed my husband and was
| telling my toyboy what to say while we cleared out the account.

They probably figure that your boyfriend wouldn't be able to
remember 9 numbers.

The Treasury is actually a good bet for now. As long
as interest rates stay up it's virtually no risk at about
5% for t-bills. They're very efficient and there's no funny
business. You log in, enter your password, and they send a
code via email. That seems like plenty of security to me.
Anyone trying to hack it would not only have to get past all
that. They'd also need to get access to the connected bank
account, or add a new one. That latter process requires a
special stamp, in person, from a bank officer.

[AJL]

Post by Newyana2
| We've been with Vanguard a long time;
Mutual fund? I was thinking of playing stocks. My idea was
to invest in a trash removal company. Cities are all subcontacting
to them now. Then there's construction demo. Rubbish is the
future! But even that seems risky. I can't afford to lose my modest
savings, not knowing how long I'll be able to keep working. Even
mutual funds were losing until recently. And the people who deal
in those take 1/2 to 1% commission, per year, whether you win
or lose.
| (before they set up that voice-recognition thing) they had to hear my
| husband giving his SS # etc. in addition to what I told them. It never
| seemed to occur to them that I could have killed my husband and was
| telling my toyboy what to say while we cleared out the account.
They probably figure that your boyfriend wouldn't be able to
remember 9 numbers.
The Treasury is actually a good bet for now. As long
as interest rates stay up it's virtually no risk at about
5% for t-bills. They're very efficient and there's no funny
business.
You log in, enter your password, and they send a
code via email. That seems like plenty of security to me.

Another advantage of this system is that if you receive a code that you
didn't request you know someone has your password and has tried to enter
your account...

Post by Newyana2
Anyone trying to hack it would not only have to get past all
that. They'd also need to get access to the connected bank
account, or add a new one. That latter process requires a
special stamp, in person, from a bank officer.

[Carlos E.R.]

Post by Newyana2
| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.

No, that's not it. Not for a bank.

They want to know that you are an actual person with a phone and
contract. They have to trust the company giving those numbers.

[Newyana2]

"Carlos E.R." <***@es.invalid> wrote

| > As V said, the simple answer is that they want to spy.
|
| No, that's not it. Not for a bank.
|

Of course that's it.

| They want to know that you are an actual person with a phone and
| contract. They have to trust the company giving those numbers.
|

An actual person with a phone contract? So you're saying that
having a cellphone is more proof of ID than my drivers license? You've
been drinking the kool-aid.

At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

Investing with the US Treasury does not require a cellphone.
They send a code via email.

My Tracfone was bought at BestBuy. At no point did I have to
enter an ID or open an account. Tracfone officially has no idea
who I am. I buy minutes at a drugstore every 3 months. There's
no inherent security or proof of ID with cellphones. If I were going
to do anything online requiring a cellphone, I'd be using that Tracfone.
The problem, as I noted, is that if I lost the cellphone I don't feel
confident that I'd be able to get into my account. There's no one
minding the store.

I ran into a similar issue with my brotyher who had a stroke. I
tried to get his email. Google wouldn't let me. They wanted 2FA.
He'd never set up 2FA! Apparently they saw that I was logging in
from a different location, on a different device. There was no way
around it. One doesn't just call a tech support person at Google.

So it's pure bullshit for them to talk about security and even more
BS to talk about confirming who you are. The only credible reason to
require 2FA via cellphone is to track you.

[AJL]

Post by Newyana2
| > As V said, the simple answer is that they want to spy.
|
| No, that's not it. Not for a bank.
|
Of course that's it.
| They want to know that you are an actual person with a phone and
| contract. They have to trust the company giving those numbers.
|
An actual person with a phone contract? So you're saying that
having a cellphone is more proof of ID than my drivers license? You've
been drinking the kool-aid.
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

Wow. That's a lot of info to give an online company for a paranoid guy like
you... 8-O

Post by Newyana2
Investing with the US Treasury does not require a cellphone.
They send a code via email.
My Tracfone was bought at BestBuy. At no point did I have to
enter an ID or open an account. Tracfone officially has no idea
who I am. I buy minutes at a drugstore every 3 months. There's
no inherent security or proof of ID with cellphones. If I were going
to do anything online requiring a cellphone, I'd be using that Tracfone.
The problem, as I noted, is that if I lost the cellphone I don't feel
confident that I'd be able to get into my account. There's no one
minding the store.
I ran into a similar issue with my brotyher who had a stroke. I
tried to get his email. Google wouldn't let me. They wanted 2FA.
He'd never set up 2FA! Apparently they saw that I was logging in
from a different location, on a different device. There was no way
around it. One doesn't just call a tech support person at Google.
So it's pure bullshit for them to talk about security and even more
BS to talk about confirming who you are. The only credible reason to
require 2FA via cellphone is to track you.

I prefer text 2FA because it's immediate. If I didn't request it and
somebody's using my password I want to know right away...

[VanguardLH]

Post by AJL

Post by Newyana2
| > As V said, the simple answer is that they want to spy.
|
| No, that's not it. Not for a bank.
|
Of course that's it.
| They want to know that you are an actual person with a phone and
| contract. They have to trust the company giving those numbers.
|
An actual person with a phone contract? So you're saying that
having a cellphone is more proof of ID than my drivers license? You've
been drinking the kool-aid.
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

Wow. That's a lot of info to give an online company for a paranoid guy like
you... 8-O

Post by Newyana2
Investing with the US Treasury does not require a cellphone.
They send a code via email.
My Tracfone was bought at BestBuy. At no point did I have to
enter an ID or open an account. Tracfone officially has no idea
who I am. I buy minutes at a drugstore every 3 months. There's
no inherent security or proof of ID with cellphones. If I were going
to do anything online requiring a cellphone, I'd be using that Tracfone.
The problem, as I noted, is that if I lost the cellphone I don't feel
confident that I'd be able to get into my account. There's no one
minding the store.
I ran into a similar issue with my brotyher who had a stroke. I
tried to get his email. Google wouldn't let me. They wanted 2FA.
He'd never set up 2FA! Apparently they saw that I was logging in
from a different location, on a different device. There was no way
around it. One doesn't just call a tech support person at Google.
So it's pure bullshit for them to talk about security and even more
BS to talk about confirming who you are. The only credible reason to
require 2FA via cellphone is to track you.

I prefer text 2FA because it's immediate. If I didn't request it and
somebody's using my password I want to know right away...

Lots of sites track you by device. Some offer you a history to view of
what devices connected to your account. If a device not previously
recorded logs in, they sent you an e-mail alert saying "Was this you?"

If a hacker can easily guess your password to then have 2FA code sent to
your phone, that bodes ill for you using a weak password. Make the
password longer, don't use words, and each password should be unique to
the domain where you login (i.e., never reuse passwords). Make 'em
strong. Make them unique.

[AJL]

Post by VanguardLH

Post by AJL
I prefer text 2FA because it's immediate. If I didn't request it and
somebody's using my password I want to know right away...

Lots of sites track you by device. Some offer you a history to view of
what devices connected to your account. If a device not previously
recorded logs in, they sent you an e-mail alert saying "Was this you?"

Yup. I get those when I'm firing up a new toy.

Post by VanguardLH
If a hacker can easily guess your password to then have 2FA code sent to
your phone, that bodes ill for you using a weak password.

Agreed. But it's still IMO nice insurance to know immediately if my PW
(or a site hack?) is used.

Post by VanguardLH
Make the
password longer, don't use words, and each password should be unique to
the domain where you login (i.e., never reuse passwords). Make 'em
strong. Make them unique.

I use a formula. That way I can remember most of them without a cheat
sheet. Something like: $$ + Z + first 3 letters of site + my 1st
employee number + last 3 letters of site + my 2nd employee number.

BTW I got this email to my fake Gmail account a few months back:
-------------------------------
Verification Code
To verify your account, enter this code in TikTok:

684267

Verification codes expire after 48 hours.

If you didn't request this code, you can ignore this message.

TikTok Support Team

TikTok Help Center: https://support.tiktok.com/

Have a question?
Check out our help center or contact us in the app using Settings >
Report a Problem.
This is an automatically generated email. Replies to this email address
aren't monitored.
---------------------------

Interesting part is that I've never had a TikTok account. But I changed
the fake email account password anyway. Can't be too careful...

[Carlos E.R.]

Post by Newyana2
| > As V said, the simple answer is that they want to spy.
|
| No, that's not it. Not for a bank.
|
Of course that's it.
| They want to know that you are an actual person with a phone and
| contract. They have to trust the company giving those numbers.
|
An actual person with a phone contract? So you're saying that
having a cellphone is more proof of ID than my drivers license? You've
been drinking the kool-aid.

You can not send the drivers license online.

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.
Investing with the US Treasury does not require a cellphone.
They send a code via email.
My Tracfone was bought at BestBuy. At no point did I have to
enter an ID or open an account. Tracfone officially has no idea
who I am. I buy minutes at a drugstore every 3 months. There's
no inherent security or proof of ID with cellphones. If I were going
to do anything online requiring a cellphone, I'd be using that Tracfone.
The problem, as I noted, is that if I lost the cellphone I don't feel
confident that I'd be able to get into my account. There's no one
minding the store.
I ran into a similar issue with my brotyher who had a stroke. I
tried to get his email. Google wouldn't let me. They wanted 2FA.
He'd never set up 2FA! Apparently they saw that I was logging in
from a different location, on a different device. There was no way
around it. One doesn't just call a tech support person at Google.
So it's pure bullshit for them to talk about security and even more
BS to talk about confirming who you are. The only credible reason to
require 2FA via cellphone is to track you.

What on earth are they going to track?

It's a bank, not google. Ask them, why they do it. It is documented
somewhere. A mobile phone is a device that you have, that "everybody"
has already, so they don't make you buy a gadget to identify you like
some banks use. Ask them: I do not want to use the phone, give me the
device. If you have enough money they give you an electronic thing like
a key with a display.

So, if you do not pay for the device, they allow you to use a mobile
phone. A real actual mobile phone with a "real" number. Not a modern
fangled googlesomethingnumber.

Banks. Tradition! Stability! Not modernity.

[Newyana2]

"Carlos E.R." <***@es.invalid> wrote

| > An actual person with a phone contract? So you're saying that
| > having a cellphone is more proof of ID than my drivers license? You've
| > been drinking the kool-aid.
|
| You can not send the drivers license online.
|

You said the reason for a cellphone code is to confirm
that you're "an actual person with a phone contract". When
I signed up for crypto I had to scan and upload both sides
of my driver's license.

We seem to be talking about two different things here.
If your identity needs to be checked then a cellphone
number is meaningless. If you want secure login, a cellphone
number is not necessary.

| >
| > So it's pure bullshit for them to talk about security and even more
| > BS to talk about confirming who you are. The only credible reason to
| > require 2FA via cellphone is to track you.
|
| What on earth are they going to track?
|

Where have you been, Carlos? The Internet runs on spying and
ads. Google's whole business is giving away convenient services
in exchange for spying. Did you think they were a non-profit? Banks
are no different. Not all online businesses spy, but if the product
is free it would be naive to think they're not spying.

Most online brokers are offering trades for free. So how do they
make money? They may just hope that you'll get rich and use their
paid services later. But it's likely that they're also collecting personal
data as a source of income. Datamining. Did you somehow not
know that's an industry now? Ostrich logic never ceases to astonish
me. So many people get angry about even being exposed to the truth.
Instead they shoot the messenger, screaming about paranoia and
tinfoil hats. That's exactly what makes the datamining industry
feasible.

In just the past week I've come across this:

'Meet the guy who taught US intelligence agencies how to make the most of
the ad tech ecosystem, "the largest information-gathering enterprise ever
conceived by man."'
https://www.wired.com/story/how-pentagon-learned-targeted-ads-to-find-targets-and-vladimir-putin/

For a more in depth survy there's this app spying report by the
Norwegian Cconssumer Council:

https://storage02.forbrukerradet.no/media/2020/01/mnemonic-security-test-report-v1.0.pdf

How about Avast selling your browser history? We've got that, too:

https://www.bleepingcomputer.com/news/security/ftc-to-ban-avast-from-selling-browsing-data-for-advertising-purposes/

I come across these articles almost daily. I come across websites
that block me reading their articles unless I enable javascript. Why?
Because it's hard to spy without javascript.

| A real actual mobile phone with a "real" number. Not a modern
| fangled googlesomethingnumber.

I have nothing against you using your "real" number, on your
"real" cellphone, for online 2FA. I only want to not have to use
and keep a cellphone in order to do business online. The US
Treasury has no problem with that. Nor does either of my email
servers *require* 2FA, much less a cellphone. Why? Those entities
are not providing a free service.

| Banks. Tradition! Stability! Not modernity.

No one was talking about banks. But I agree with you there.
I don't doubt that all banks are run by Jimmy Stewart. Like...
oh... Silicon Valley Bank, for example:

https://www.npr.org/2023/03/10/1162599556/silicon-valley-bank-collapse-failure-fdic-regulators-run-on-bank

Then of course there were the bank failures of 2008. Banks
in the US survive as an institution only because the US gov't
insures deposits.

There was an interesting talk given in Canada by a 12 year
old girl about banks.

She explains how banks are generally only required to actually
hold a tiny fraction of the money they lend. In other words, a
bank charter is a license to print money. What could go wrong,
right?

Personally I don't and would never use online banking. I had
to call my bank's office to specifically block it. My bank's local branch
is a few blocks away. A pleasant walk. An easy drive. I mostly go
there only to get cash from the ATM.

[Carlos E.R.]

Post by Newyana2
| > An actual person with a phone contract? So you're saying that
| > having a cellphone is more proof of ID than my drivers license? You've
| > been drinking the kool-aid.
|
| You can not send the drivers license online.
|
You said the reason for a cellphone code is to confirm
that you're "an actual person with a phone contract". When
I signed up for crypto I had to scan and upload both sides
of my driver's license.

To get a bank account?

We are in that context.

You get a bank account and in the same act you register with them your
real actual physical phone number.

Post by Newyana2
We seem to be talking about two different things here.
If your identity needs to be checked then a cellphone
number is meaningless. If you want secure login, a cellphone
number is not necessary.
| >
| > So it's pure bullshit for them to talk about security and even more
| > BS to talk about confirming who you are. The only credible reason to
| > require 2FA via cellphone is to track you.
|
| What on earth are they going to track?
|
Where have you been, Carlos? The Internet runs on spying and
ads. Google's whole business is giving away convenient services
in exchange for spying. Did you think they were a non-profit? Banks
are no different. Not all online businesses spy, but if the product
is free it would be naive to think they're not spying.

We are talking banks sending a code to your phone. Context, please.

Post by Newyana2
Most online brokers are offering trades for free. So how do they
make money? They may just hope that you'll get rich and use their
paid services later. But it's likely that they're also collecting personal
data as a source of income. Datamining. Did you somehow not
know that's an industry now? Ostrich logic never ceases to astonish
me. So many people get angry about even being exposed to the truth.
Instead they shoot the messenger, screaming about paranoia and
tinfoil hats. That's exactly what makes the datamining industry
feasible.

Ridiculous. Context, please.

...

[Newyana2]

"Carlos E.R." <***@es.invalid> wrote

| > You said the reason for a cellphone code is to confirm
| > that you're "an actual person with a phone contract". When
| > I signed up for crypto I had to scan and upload both sides
| > of my driver's license.
|
| To get a bank account?
|
| We are in that context.
|
| You get a bank account and in the same act you register with them your
| real actual physical phone number.
|

This didn't start with bank accounts. YOU are talking about
bank accounts. Real Bev started by complaining about how many
websites require a cellphone number.

If I want a bank account I go to the bank. My bank does
not have a cellphone number for me.

[Carlos E.R.]

Post by Newyana2
| > You said the reason for a cellphone code is to confirm
| > that you're "an actual person with a phone contract". When
| > I signed up for crypto I had to scan and upload both sides
| > of my driver's license.
|
| To get a bank account?
|
| We are in that context.
|
| You get a bank account and in the same act you register with them your
| real actual physical phone number.
|
This didn't start with bank accounts. YOU are talking about
bank accounts. Real Bev started by complaining about how many
websites require a cellphone number.
If I want a bank account I go to the bank. My bank does
not have a cellphone number for me.

Ok, but in any case sending a text message to your mobile phone doesn't
track you. It simply is a reasonable expectation that you have access to
your mobile phone. It does add some security, that has been proven. And
as "everybody has a mobile phone™", it is easy and cheap to implement.

If you do not have a mobile phone, tough luck. You do not matter :-P

[Allodoxaphobia]

Post by Newyana2
If I want a bank account I go to the bank.
My bank does not have a cellphone number for me.

However, a worrisome trend is in play:

https://lagradaonline.com/en/two-largest-banks-will-close-united-states/

Jonesy

[Newyana2]

"Allodoxaphobia" <***@example.net> wrote

| However, a worrisome trend is in play:
|
| https://lagradaonline.com/en/two-largest-banks-will-close-united-states/
|
That doesn't surprise me. The article is misleading, implying
that BofA and WF are leaving the US. They're just closing
branches. It doesn't surprise me because so many people now
avoid cash, bank by phone, have auto-deposit and use 3rd-party
services to exchange money. Bank tellers and managers are
just not needed as much as they used to be.

[AJL]

Post by Newyana2
|
| https://lagradaonline.com/en/two-largest-banks-will-close-united-states/
|
That doesn't surprise me. The article is misleading, implying
that BofA and WF are leaving the US. They're just closing
branches. It doesn't surprise me because so many people now
avoid cash, bank by phone, have auto-deposit and use 3rd-party
services to exchange money. Bank tellers and managers are
just not needed as much as they used to be.

That would be me. I visit my branch maybe twice a year to get cash for
emergencies (like if the checkout system is down) and tips. Everything else
is done with the credit card. Love that Cashback card. Also love that folks
who pay with cash help support it...

[Newyana2]

"AJL" <***@none.org> wrote

| That would be me. I visit my branch maybe twice a year to get cash for
| emergencies (like if the checkout system is down) and tips. Everything
else
| is done with the credit card. Love that Cashback card. Also love that
folks
| who pay with cash help support it...
|
Yes, I remember that about you. The man who would
buy an expired lottery ticket if he could get cash back. The
man who wants to purchase a gravestone that says, "Here
lies a man who never failed to get cash back."

The trend seems to be much bigger than cash-back-mania,
though. People in this thread are actually getting angry at
merely the suggestion of having options besides cellphones
for taking care of business. Cellphones have become a lifestyle.
Many of those people are not even using charge cards. They're
using debit, Square, Venmo... They've actually become
accustomed to paying someone else to handle their cash, so
that all transactions -- even lending $20 to a friend -- go
through a payment service.

Some people are just afraid of cash, fearing that they'll
be mugged if they have money. Others feel Jetson-esque,
waving their iPhone at Starbucks. Many young people
probably know payment services as where money comes from.
But I suspect the main motivator is just habit: Once people
are constantly using their cellphone, it becomes convenient
to do everything through it.

As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

I'm not so sure about automated checkouts, though. Some
stores in the US are deciding to remove or reduce them due
to theft.

https://www.cnn.com/2023/12/08/business/self-checkout-dollar-general-retail/index.html

At the same time, you run the risk of being accused of
theft when using self-checkout:

https://www.coreycohen.com/blog/2022/12/have-you-been-accused-of-self-checkout-theft/

There's also a controversy around restaurants with QR
code menus. Most people are happy to use their cellphone
to read the menu, but then they're questioning why they
should tip for barebones service...

So we run into an entirely
different issue: How does human society work without
personal interactions? Maybe you'll be able to use your
famous cash-back charge card to buy conversations...
Perhaps Monty Python's argument service wasn't so
farfetched. :)

I used a self checkout for the first time recently. There
were 8 women with full carts at the only Target register,
and the self checkout took cash. I don't really mind it
there. They have the best prices, by far, on household
items. And Target seems to be the only place left to buy
such a simple thing as a pack or sponges -- just a plain old
4-pack of kitchen sponges, without a "patented
scrubber surface" or any other overpriced gimmick. So
I accept that they need to cut corners. Though I have to
find another source for underwear and socks now. Target
has locked them in display cases! Apparently people were
stealing them and sneaking through the self-checkout.

[Carlos E.R.]

...

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not cheap,
for needed extra security. You do have other options if you insist.

[VanguardLH]

Post by Carlos E.R.
...

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not cheap,
for needed extra security. You do have other options if you insist.

Personally I would prefer if the trend were toward using USB security
sticks instead of SMS and e-mail. One problem there might be: having to
use a computer that has no USB ports, or they've been disabled. Another
problem is no one is going to attach the USB stick to a cord attached to
their body: when they leave the computer, the USB stick must go with
them. Instead the sticks are left plugged into a USB port, so anyone
with physical access to the computer can login using the stick just like
the owner can. The problem of physical access also applies to phones.

As for cost, if every computer could use a Yubi security key, the $25
would be worth the freedom of relying on a phone. Weren't some
Europeans charged and fined for pretending to be someone else's phone
through SIM card swap they foisted on the carrier?

What Is a SIM Swap Attack and How Can You Prevent It?
https://www.avast.com/c-sim-swap-scam

When getting an SMS text, there is no verification that the receiving
phone's IMEI is the one to where the text was intended to drop. If the
IMEI were involved, you'd have to re-register with whomever is sending
2FA codes via texts to give them yet another piece of valuable info: the
IMEI of your phone. When you change or add phones, you have to update
all your accounts to give them another IMEI. But SMS doesn't link to
IMEI, so there SMS is not secured either during transmission nor
guarantee which phone the SMS targets.

Maybe if all computers had biometric input (camera for eyes and sensor
for fingers and mic for voice) then the verification really would be to
a person, not the expectation of a device or service to which that
person -- or someone else -- has access. Phones and laptops have those
bio devices (well, maybe not all have finger sensors), but only a
fraction of desktops have even 2 of them. I don't have a camera on my
desktop. I don't do video chats. I have a mic only when I plug in my
headset. I'd have to buy a fingerprint sensor. Bio verification isn't
going to happen on desktops until those devices are built in by default
whether pre-builts or own builts, not appended on.

When sent a 2FA code, how long before you have to use it. Typically the
expiration is 5 to 15 minutes. Pretty long time, but they have to
account for delay in SMS transport, and time for users to enter the 2FA
code. Some phone users are handicapped, so they don't quickly enter
anything. Do the 2FA codes automatically and immediately expire upon
use, or are they still valid for the original time allowed for
expiration? I hope that the site enforces automatic expiration on use,
but I haven't verified this is the case. Anyway, the long expiration
time to wait for use of the 2FA code means a larger window of
opportunity for interception. SMS and e-mail are not secure
communication venues. That's why I'm thinking TOTP would be a better
choice; however, doesn't seem that every site wanting to use 2FA
supports TOTP, and it seems you must have the particular TOTP
authenticator that they expect you to use which, to me, hints the
communication protocol is not yet standardized to allow use of *any*
TOTP authenticator. One site uses Authy, another uses Symantec VIP, and
another requires something else.

Does everyone that gets a new phone, or just a new SIM card, always get
a new phone number, and keep that one? I use Google Voice which calls
all my phones, so it doesn't matter which phones I have at the time or
what are their phone numbers. All of them (that I've added to my GV
account) get called using simultaneous ring. I even have an Obitalk
added to my GV account, so I get calls on my home phones (VOIP converted
to POTS in my home wiring). However, if I had only 1 phone, I'd try to
port my old phone number to the new phone, if allowed (which costs money
to do the port). I wouldn't have to change my old phone number in every
account where it is recorded, and to where SMS texts would get sent.
With e-mail alerts (GV sends a copy of a text to my e-mail), it doesn't
matter which smartphone I use. If a site is going to use 2FA when you
try to update your account to reflect your new phone number, you're
screwed if you don't have the old phone to get the text. If you have to
talk to tech support, figure on wasting an hour and half on a call, and
the info you give them is the same info the hackers use in a SIM swap.

With the average ownership of smartphones only around 2 years, seems it
would be a repetitive nuisance to update phone numbers in all accounts
for all those consumers that just must update. With a security key,
wouldn't matter where you got the text, but who wants to keep plugging a
stick into the phone's USB port, or leave the stick dangling out the
port? Even if IMEI were linked to SMS (to the sender, not to the
carrier who doesn't give a fart about the content and is not involved in
securing a login), a change of phone means a different IMEI. You can go
to TOTP *if* the other party supports using it, but then you have to get
your tokens to the new phone. Authy does that with its cloud sync, but
not other authenticators. Transferring tokens with other authenticators
is a bitch, but then often the intent to make users think that more
effort means more security.

[Carlos E.R.]

Post by VanguardLH

Post by Carlos E.R.
...

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not cheap,
for needed extra security. You do have other options if you insist.

Personally I would prefer if the trend were toward using USB security
sticks instead of SMS and e-mail. One problem there might be: having to
use a computer that has no USB ports, or they've been disabled. Another
problem is no one is going to attach the USB stick to a cord attached to
their body: when they leave the computer, the USB stick must go with
them. Instead the sticks are left plugged into a USB port, so anyone
with physical access to the computer can login using the stick just like
the owner can. The problem of physical access also applies to phones.

There are safer methods than the mobile phone, but their rationale is
"you already have a phone, so implementing this is very cheap".

Of course, a percent doesn't have a phone, but those are not their
objective client, and probably they will provide some other means.

Post by VanguardLH
As for cost, if every computer could use a Yubi security key, the $25
would be worth the freedom of relying on a phone. Weren't some
Europeans charged and fined for pretending to be someone else's phone
through SIM card swap they foisted on the carrier?

SIM swap attack is a thing, yes. They can thus receive verification
SMSs, but probably not banking app messages.

Post by VanguardLH
What Is a SIM Swap Attack and How Can You Prevent It?
https://www.avast.com/c-sim-swap-scam
When getting an SMS text, there is no verification that the receiving
phone's IMEI is the one to where the text was intended to drop. If the
IMEI were involved, you'd have to re-register with whomever is sending
2FA codes via texts to give them yet another piece of valuable info: the
IMEI of your phone. When you change or add phones, you have to update
all your accounts to give them another IMEI. But SMS doesn't link to
IMEI, so there SMS is not secured either during transmission nor
guarantee which phone the SMS targets.
Maybe if all computers had biometric input (camera for eyes and sensor
for fingers and mic for voice) then the verification really would be to
a person, not the expectation of a device or service to which that
person -- or someone else -- has access. Phones and laptops have those
bio devices (well, maybe not all have finger sensors), but only a
fraction of desktops have even 2 of them. I don't have a camera on my
desktop. I don't do video chats. I have a mic only when I plug in my
headset. I'd have to buy a fingerprint sensor. Bio verification isn't
going to happen on desktops until those devices are built in by default
whether pre-builts or own builts, not appended on.

Most recent laptops have finger print sensors and cameras. But I don't
have software that uses the former (nor the later, for purposes of ID).

Post by VanguardLH
When sent a 2FA code, how long before you have to use it. Typically the
expiration is 5 to 15 minutes. Pretty long time, but they have to
account for delay in SMS transport, and time for users to enter the 2FA
code. Some phone users are handicapped, so they don't quickly enter
anything. Do the 2FA codes automatically and immediately expire upon
use, or are they still valid for the original time allowed for
expiration?

They expire on use. Ie, they are single use.

Post by VanguardLH
I hope that the site enforces automatic expiration on use,
but I haven't verified this is the case. Anyway, the long expiration
time to wait for use of the 2FA code means a larger window of
opportunity for interception. SMS and e-mail are not secure
communication venues. That's why I'm thinking TOTP would be a better
choice; however, doesn't seem that every site wanting to use 2FA
supports TOTP, and it seems you must have the particular TOTP
authenticator that they expect you to use which, to me, hints the
communication protocol is not yet standardized to allow use of *any*
TOTP authenticator. One site uses Authy, another uses Symantec VIP, and
another requires something else.

Yeah, but for many purposes SMS is good enough. It doesn't have to be
failsafe, but only to block a high enough percent of the "attacks".

Post by VanguardLH
Does everyone that gets a new phone, or just a new SIM card, always get
a new phone number, and keep that one?

Depends.

I have the same mobile phone number since around 1999. Other people
change(d) it frequently, because they use offerings by various providers.

Mine was first a pay as you go prepaid card, at some point upgraded to
contract, and at some point migrated to another company (for free).

Then, when I travel to Canada I get a local number that is valid only
for a month.

Post by VanguardLH
I use Google Voice which calls
all my phones, so it doesn't matter which phones I have at the time or
what are their phone numbers. All of them (that I've added to my GV
account) get called using simultaneous ring. I even have an Obitalk
added to my GV account, so I get calls on my home phones (VOIP converted
to POTS in my home wiring). However, if I had only 1 phone, I'd try to
port my old phone number to the new phone, if allowed (which costs money
to do the port). I wouldn't have to change my old phone number in every
account where it is recorded, and to where SMS texts would get sent.
With e-mail alerts (GV sends a copy of a text to my e-mail), it doesn't
matter which smartphone I use. If a site is going to use 2FA when you
try to update your account to reflect your new phone number, you're
screwed if you don't have the old phone to get the text. If you have to
talk to tech support, figure on wasting an hour and half on a call, and
the info you give them is the same info the hackers use in a SIM swap.
With the average ownership of smartphones only around 2 years, seems it
would be a repetitive nuisance to update phone numbers in all accounts
for all those consumers that just must update. With a security key,
wouldn't matter where you got the text, but who wants to keep plugging a
stick into the phone's USB port, or leave the stick dangling out the
port? Even if IMEI were linked to SMS (to the sender, not to the
carrier who doesn't give a fart about the content and is not involved in
securing a login), a change of phone means a different IMEI. You can go
to TOTP *if* the other party supports using it, but then you have to get
your tokens to the new phone. Authy does that with its cloud sync, but
not other authenticators. Transferring tokens with other authenticators
is a bitch, but then often the intent to make users think that more
effort means more security.

[VanguardLH]

Post by Carlos E.R.

Weren't some Europeans charged and fined for pretending to be someone
else's phone through SIM card swap they foisted on the carrier?

SIM swap attack is a thing, yes. They can thus receive verification
SMSs, but probably not banking app messages.

My bank has apps for Android and iOS, but not for Windows where they
expect me to login via web browser. They have apps for Android and iOS,
but I'll have to ask them if those use TOTP. I doubt they will know nor
know who to pass my inquiry.

I resist putting a bank app on my smartphone. Anyone that has physical
access could get into my account using the . My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters. Or to use both a PIN *and* biometrics
(fingerprint sensor).

Post by Carlos E.R.

Maybe if all computers had biometric input (camera for eyes and
sensor for fingers and mic for voice) then the verification really
would be to a person, not the expectation of a device or service to
which that person -- or someone else -- has access. Phones and
laptops have those bio devices (well, maybe not all have finger
sensors), but only a fraction of desktops have even 2 of them.

Most recent laptops have finger print sensors and cameras. But I don't
have software that uses the former (nor the later, for purposes of ID).

My desktop is not a laptop. No camera, no mic (until I plug in the USB
headset), and no fingerprint sensor. I'd have to buy those, but then my
bank could care less as they want me using their phone app (not usable
on my desktop) or the Symantec VIP authenticator (since Authy is soon
dropping their desktop app).

[Carlos E.R.]

Post by VanguardLH

Post by Carlos E.R.

Weren't some Europeans charged and fined for pretending to be someone
else's phone through SIM card swap they foisted on the carrier?

SIM swap attack is a thing, yes. They can thus receive verification
SMSs, but probably not banking app messages.

My bank has apps for Android and iOS, but not for Windows where they
expect me to login via web browser. They have apps for Android and iOS,
but I'll have to ask them if those use TOTP. I doubt they will know nor
know who to pass my inquiry.
I resist putting a bank app on my smartphone. Anyone that has physical
access could get into my account using the . My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters. Or to use both a PIN *and* biometrics
(fingerprint sensor).

Normally the pin only allows "read" access, for operations there is some
other authorization.

Post by VanguardLH

Post by Carlos E.R.

Maybe if all computers had biometric input (camera for eyes and
sensor for fingers and mic for voice) then the verification really
would be to a person, not the expectation of a device or service to
which that person -- or someone else -- has access. Phones and
laptops have those bio devices (well, maybe not all have finger
sensors), but only a fraction of desktops have even 2 of them.

Most recent laptops have finger print sensors and cameras. But I don't
have software that uses the former (nor the later, for purposes of ID).

My desktop is not a laptop. No camera, no mic (until I plug in the USB
headset), and no fingerprint sensor. I'd have to buy those, but then my
bank could care less as they want me using their phone app (not usable
on my desktop) or the Symantec VIP authenticator (since Authy is soon
dropping their desktop app).

Certainly, for 2FA they want a mobile phone, not a computer. And a non
rooted phone as that.

[Frank Slootweg]

VanguardLH <***@nguard.lh> wrote:
[...]

Post by VanguardLH
I resist putting a bank app on my smartphone. Anyone that has physical
access could get into my account using the . My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters. Or to use both a PIN *and* biometrics
(fingerprint sensor).

I don't use a bank app on my smartphone either. No need, on-line
banking on my laptop works just fine (with the bank's hardware TOTP
device).

*If* you use a bank app, of course you don't only have to protect the
bank app with PIN/password/biometrics, but first of all have to protect
the whole phone with PIN/password/biometrics. So your scenario of
"Anyone that has physical access could get into my [bank] account" is a
non-existing one, because physical access does not mean they can get
'in' your phone.

Of course there is the theoretical scenario of someone getting hold of
your phone while it is still unlocked - for example they grab it from
your hands and run away -, but even in that scenario, any sensitive apps
- such as your bank app - are still protected by their own PIN/password/
biometrics.

OTOH, if your name is 'Newyana2', *anything* goes! :-)

[...]

[VanguardLH]

Post by Frank Slootweg
[...]

Post by VanguardLH
I resist putting a bank app on my smartphone. Anyone that has physical
access could get into my account using the . My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters. Or to use both a PIN *and* biometrics
(fingerprint sensor).

I don't use a bank app on my smartphone either. No need, on-line
banking on my laptop works just fine (with the bank's hardware TOTP
device).

My bank does not offer a hardware-based TOTP device, like a Yubi key.
Mine is a community bank (no fees of any kind). They're a bit behind on
technology.

Post by Frank Slootweg
*If* you use a bank app, of course you don't only have to protect the
bank app with PIN/password/biometrics, but first of all have to protect
the whole phone with PIN/password/biometrics. So your scenario of
"Anyone that has physical access could get into my [bank] account" is a
non-existing one, because physical access does not mean they can get
'in' your phone.
Of course there is the theoretical scenario of someone getting hold of
your phone while it is still unlocked - for example they grab it from
your hands and run away -, but even in that scenario, any sensitive apps
- such as your bank app - are still protected by their own PIN/password/
biometrics.

Unfortunately my old LG V20 (c.2016) doesn't have an app lock feature.
I have it configured to lock after 1 minute of idle. I am averse to
installing yet another app to put a lock on other apps, but I might have
to go that route. Yet another nail in the coffin of my old phone to get
a new one. However, I read that App Locker isn't available in every
smartphone. For example, some Samsungs have it, but not all Samsungs.

Considering theft can incur violence, I could get knocked out, forced at
gun/knife point or by multiple assailants, dead, or the phone swiped
while I'm using it, and someone can still press my finger to the
fingerprint sensor. A finger on a sensor is handy to unlock the phone,
but doesn't require the user is voluntarily using it. Although I have
the fingerprint sensor configured to unlock the phone, it sometimes
still asks for my PIN to regain access probably to account for possible
theft of the phone, but the revert from fingerprint unlock to PIN unlock
is infrequent.

Never had to hand your phone to someone else to use it? That's done all
the time when I get a grocery delivery, tell them I'll sign for it
(instead of them leaving it at the door for me to discover sometime
later), and the driver gives me their phone to sign for the delivery.
I've not yet been in the situation where I'm assualted for my phone, but
then security isn't about what has happened but what might happen. It's
like anti-virus software: if you've been infected then too late, it's to
prevent infection later.

Post by Frank Slootweg
OTOH, if your name is 'Newyana2', *anything* goes! :-)

Isn't Newyana2 a later nym that Mayayana started using about Sep 2023?

[VanguardLH]

I decided to test my bank's Android app. It requires both a fingerprint
unlock and PIN to get into the app, so that helps secure it better.

[Frank Slootweg]

Post by VanguardLH

Post by Frank Slootweg
[...]

Post by VanguardLH
I resist putting a bank app on my smartphone. Anyone that has physical
access could get into my account using the . My banks app says "Secure
your account with a 4-digit passcode or biometric on supported devices."
Sure wish the PIN were longer, like at least 8 digits, and more like a
password where I can use alphanumeric characters, capitalization, and
non-alphanumeric characters. Or to use both a PIN *and* biometrics
(fingerprint sensor).

I don't use a bank app on my smartphone either. No need, on-line
banking on my laptop works just fine (with the bank's hardware TOTP
device).

My bank does not offer a hardware-based TOTP device, like a Yubi key.
Mine is a community bank (no fees of any kind). They're a bit behind on
technology.

Post by Frank Slootweg
*If* you use a bank app, of course you don't only have to protect the
bank app with PIN/password/biometrics, but first of all have to protect
the whole phone with PIN/password/biometrics. So your scenario of
"Anyone that has physical access could get into my [bank] account" is a
non-existing one, because physical access does not mean they can get
'in' your phone.
Of course there is the theoretical scenario of someone getting hold of
your phone while it is still unlocked - for example they grab it from
your hands and run away -, but even in that scenario, any sensitive apps
- such as your bank app - are still protected by their own PIN/password/
biometrics.

Unfortunately my old LG V20 (c.2016) doesn't have an app lock feature.

The app locking isn't a feature of the phone, but a - required -
feature of the app. In another response you've indicated that you bank's
app indeed does that.

So (privacy/security) sensitive apps have a lock feature *in* the app.

[...]

Post by VanguardLH
Considering theft can incur violence, I could get knocked out, forced at
gun/knife point or by multiple assailants, dead, or the phone swiped
while I'm using it, and someone can still press my finger to the
fingerprint sensor. A finger on a sensor is handy to unlock the phone,
but doesn't require the user is voluntarily using it. Although I have
the fingerprint sensor configured to unlock the phone, it sometimes
still asks for my PIN to regain access probably to account for possible
theft of the phone, but the revert from fingerprint unlock to PIN unlock
is infrequent.

It's more likely that the thief/assailant just takes the phone and
runs, instead of forcing you through *all* the steps needed to get some
money/information out of you, but indeed nothing is impossible and this
has very little to do with smartphone security/privacy.

Post by VanguardLH
Never had to hand your phone to someone else to use it?

No, not without me supervising its use. And again, they might be able
to perform some actions, but they can't get into any sensitive apps.

[Irrelevant reverse scenario deleted.]

Post by VanguardLH
I've not yet been in the situation where I'm assualted for my phone, but
then security isn't about what has happened but what might happen. It's
like anti-virus software: if you've been infected then too late, it's to
prevent infection later.

See above. You lose your *phone*, so you buy a new one and start over.

Post by VanguardLH

Post by Frank Slootweg
OTOH, if your name is 'Newyana2', *anything* goes! :-)

Isn't Newyana2 a later nym that Mayayana started using about Sep 2023?

Yes, but not everybody knows that, so I'm referring to him by his
new/current nym.

[Carlos E.R.]

...

Post by Frank Slootweg

Post by VanguardLH
Never had to hand your phone to someone else to use it?

No, not without me supervising its use. And again, they might be able
to perform some actions, but they can't get into any sensitive apps.
[Irrelevant reverse scenario deleted.]

It is normal with delivery people that I have to sign a form on their
phone or rather tablet. I hope it is not their personal phone.

I don't normally hand over my phone, except on some places they showing
or helping me how to do something. And the phone is placed so that I can
see everything.


For instance, yesterday I went to see Dune 2. I showed the ticket on my
phone at the entrance for scanning (the dot code was equivalent to a 7
character word), went to one of the nearly twenty "rooms", and then I
realized I could not see what row and seat I was on. I had to double
back to ask the lady at the entrance. She smiled. The email had a line
she had to find in my phone that said:

Entradas: 1 x -Miércoles al cine VIP (6,70 € - 710)

Well, the seat is "710", ie, row 7, 10th chair. Someone goofed the email
design, and the staff knows. The lady moved the email with her finger to
find the line, then pointed it at me and decoded it for me. We both had
a laugh.


...

[Newyana2]

"Carlos E.R." <***@es.invalid> wrote

| For instance, yesterday I went to see Dune 2. I showed the ticket on my
| phone at the entrance for scanning (the dot code was equivalent to a 7
| character word), went to one of the nearly twenty "rooms", and then I
| realized I could not see what row and seat I was on. I had to double
| back to ask the lady at the entrance. She smiled. The email had a line
| she had to find in my phone that said:
|
| Entradas: 1 x -Miércoles al cine VIP (6,70 € - 710)
|
| Well, the seat is "710", ie, row 7, 10th chair. Someone goofed the email
| design, and the staff knows. The lady moved the email with her finger to
| find the line, then pointed it at me and decoded it for me. We both had
| a laugh.
|

So much trouble. I go to my local theater, hand them a $10 bill
(because I'm a senior) and sit where I like. :)

Though I'm waiting
on Dune2. I'm not sure I want to spend almost 3 hours to watch
a mediocre movie. I saw the first one. As a former Frank Herbert
fan I was disappointed that a book full of complicated psychological
details was reduced to a flashy shoot-'em-up. Sometimes it seems
like every movie now is just fight scenes.

[Carlos E.R.]

Post by Newyana2
| For instance, yesterday I went to see Dune 2. I showed the ticket on my
| phone at the entrance for scanning (the dot code was equivalent to a 7
| character word), went to one of the nearly twenty "rooms", and then I
| realized I could not see what row and seat I was on. I had to double
| back to ask the lady at the entrance. She smiled. The email had a line
|
| Entradas: 1 x -Miércoles al cine VIP (6,70 € - 710)
|
| Well, the seat is "710", ie, row 7, 10th chair. Someone goofed the email
| design, and the staff knows. The lady moved the email with her finger to
| find the line, then pointed it at me and decoded it for me. We both had
| a laugh.
|
So much trouble. I go to my local theater, hand them a $10 bill
(because I'm a senior) and sit where I like. :)

I sit where I like by choosing the seat in advance. Online I get a map
of the theatre and I click on the best seat, because two hours before
the showtime there are seats to choose from.

If I arrive at the venue to buy the ticket I have to wait a lineup, and
I'm given a random seat, more or less with my specs. Or I can go to a
machine seller.


Oh, that was 6.70€ for a seat on the VIP row - cheaper than your senior
price :-p

Wednesday is the cheap day here.

Post by Newyana2
Though I'm waiting
on Dune2. I'm not sure I want to spend almost 3 hours to watch
a mediocre movie. I saw the first one. As a former Frank Herbert
fan I was disappointed that a book full of complicated psychological
details was reduced to a flashy shoot-'em-up. Sometimes it seems
like every movie now is just fight scenes.

There was also a shoot them game for PCs in the 80's :-p

[The Real Bev]

Post by Newyana2
| For instance, yesterday I went to see Dune 2. I showed the ticket on my
| phone at the entrance for scanning (the dot code was equivalent to a 7
| character word), went to one of the nearly twenty "rooms", and then I
| realized I could not see what row and seat I was on. I had to double
| back to ask the lady at the entrance. She smiled. The email had a line
|
| Entradas: 1 x -Miércoles al cine VIP (6,70 € - 710)
|
| Well, the seat is "710", ie, row 7, 10th chair. Someone goofed the email
| design, and the staff knows. The lady moved the email with her finger to
| find the line, then pointed it at me and decoded it for me. We both had
| a laugh.
|
So much trouble. I go to my local theater, hand them a $10 bill
(because I'm a senior) and sit where I like. :)

I'm trying to remember the last movie I saw that was worth $10. Maybe
Terminator 2, but we have a blu-ray which cost less than that. It's
been a long time since I actually wanted to see a movie in a theater.

Post by Newyana2
Though I'm waiting
on Dune2. I'm not sure I want to spend almost 3 hours to watch
a mediocre movie. I saw the first one. As a former Frank Herbert
fan I was disappointed that a book full of complicated psychological
details was reduced to a flashy shoot-'em-up. Sometimes it seems
like every movie now is just fight scenes.

I read the books. Too many words :-) I was especially annoyed by his
introduction of a foreign word which was never used again. Sorry, a LOT
of snippage would have improved things immensely.

More and more movies are becoming interesting only because of the
special effects etc. D1 was one of them. Sometimes (latest John Wick)
they get carried way too far :-(

[Newyana2]

"The Real Bev" <***@gmail.com> wrote
I'm trying to remember the last movie I saw that was worth $10. Maybe
Terminator 2, but we have a blu-ray which cost less than that. It's
been a long time since I actually wanted to see a movie in a theater.
I'm spoiled. We have two "arthouse" theaters that are
pleasant on stormy days. Old fashioned places that probably
looked exactly the same in 1940.

I get a lot of movies at the
library and have some streaming. But recently I've
watched the Holdovers and Oppenheimer in theaters.
Last week we went to two movies, both of which were
extraordinary. "Driving Madelleine" and "Perfect Days".
There are rarely more than a dozen people at a showing.

I haven't been to a chain theater for probably at least
20 years. Last time I went I was appalled at the crowds,
the ads, the refusal to let me bring in food or drink... The
whole thing was sleazy and overpriced. And the movie
selection is generally "top 40".

John Wick... yes... I have to admit that I find it engaging,
which is really ridiculous because the whole thing is just
over-the-top, speeded up violence. And Keanu Reeves
can't act. But occasionally I get in the mood for that kind
of adrenaline rush.

[The Real Bev]

Post by Newyana2
John Wick... yes... I have to admit that I find it engaging,
which is really ridiculous because the whole thing is just
over-the-top, speeded up violence. And Keanu Reeves
can't act. But occasionally I get in the mood for that kind
of adrenaline rush.

I liked the first one, maybe the second. Downhill from then on. Like
most movie series, except that T2 was the best of the bunch.

Sometimes you can have too many explosions.

[Carlos E.R.]

Post by Newyana2
| For instance, yesterday I went to see Dune 2. I showed the ticket on my
| phone at the entrance for scanning (the dot code was equivalent to a 7
| character word), went to one of the nearly twenty "rooms", and then I
| realized I could not see what row and seat I was on. I had to double
| back to ask the lady at the entrance. She smiled. The email had a line
|
| Entradas: 1 x -Miércoles al cine VIP (6,70 € - 710)
|
| Well, the seat is "710", ie, row 7, 10th chair. Someone goofed the email
| design, and the staff knows. The lady moved the email with her finger to
| find the line, then pointed it at me and decoded it for me. We both had
| a laugh.
|
   So much trouble. I go to my local theater, hand them a $10 bill
(because I'm a senior) and sit where I like. :)

I'm trying to remember the last movie I saw that was worth $10.  Maybe
Terminator 2, but we have a blu-ray which cost less than that.  It's
been a long time since I actually wanted to see a movie in a theater.

I find going to a cinema a more fulfilling experience than watching the
same movie at home.

It fills up way more time :-)

The display and the sound are way better than mine, too.

[Chris]

Post by Carlos E.R.

Post by VanguardLH
Does everyone that gets a new phone, or just a new SIM card, always get
a new phone number, and keep that one?

Depends.
I have the same mobile phone number since around 1999. Other people
change(d) it frequently, because they use offerings by various providers.

That's the default across Europe. I don't know anyone who regularly changes
their number. Porting is free and automated.

I've only had a single mobile number and I've had it about 20 years.

[Chris]

Post by Carlos E.R.
...

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not cheap,
for needed extra security.

Banks here used to provide a hardware device for free which you used with
your bank card at home.

The annoying thing was that you ended up with one for each bank - despite
using the same technology - and you were stuck if you didn't have it with
you.

[Richmond]

Post by Chris

Post by Carlos E.R.
...

As Carlos put it, people addicted to cellphones would like to
believe that everyone else "does not matter". They not only want
cellphone options, they want cellphone interaction to be enforced as
the only option. They want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not
cheap, for needed extra security.

Banks here used to provide a hardware device for free which you used
with your bank card at home.
The annoying thing was that you ended up with one for each bank -
despite using the same technology - and you were stuck if you didn't
have it with you.

I still use a little plastic device which the bank gave to me free of
charge. (And replaced free of charge when the battery went flat).

I would rather use it than use an android phone. I don't trust the
security of android phones, and I have a suspicion that banks don't
either, but they are not taking responsibility. Who will pay if your
phone gets malware on it and steals your credentials?

[Newyana2]

"Richmond" <***@gmx.com> wrote

| I would rather use it than use an android phone. I don't trust the
| security of android phones, and I have a suspicion that banks don't
| either, but they are not taking responsibility. Who will pay if your
| phone gets malware on it and steals your credentials?

That's a good question. To read the media it seems that
identity theft is rampant, though I don't actually know
anyone it's happened to.

Credit card companies will usually reimburse losses, but
they don't have to. They're doing it so far because they
profit by encouraging people to use cards without worry.

Debit cards are less protected. Commercial debit cards
have no protection in the US. With personal debit cards
there are limitations. If I remember correctly, one is that
any theft must be reported within something like 2 1/2 days.
How many people even read their bank statements or
balance their checkbook to know if something goes wrong?

The level of abstraction makes me nervous. WW3 might
be started and won by one country simply hacking into
multiple networks simultaneously and tainting the records
beyond salvaging. Then everyone wakes up the next day
a random pauper or billionaire. Everything could collapse.

On the other hand, money under a mattress also has
severe limitations.

I avoid any online banking. I can still walk and drive. Social
security is auto-deposited. I just don't need online banking,
so there's no sense risking it. I've also locked my credit. In
the US one can contact 3 credit reporting agencies, establish
a lock, and from then on no credit cards can be issued. If
you need a new credit card, you unlock it temporarily. That
method also provides a great excuse for pushy store clerks
who want me to sign up for their store card. "Oh, I'd love to,
but I have my credit locked. Haven't you done that yourself?"

[Richmond]

Post by Newyana2
| I would rather use it than use an android phone. I don't trust the
| security of android phones, and I have a suspicion that banks don't
| either, but they are not taking responsibility. Who will pay if your
| phone gets malware on it and steals your credentials?
That's a good question. To read the media it seems that identity
theft is rampant, though I don't actually know anyone it's happened
to.
Credit card companies will usually reimburse losses, but they don't
have to. They're doing it so far because they profit by encouraging
people to use cards without worry.
Debit cards are less protected. Commercial debit cards have no
protection in the US. With personal debit cards there are
limitations. If I remember correctly, one is that any theft must be
reported within something like 2 1/2 days. How many people even read
their bank statements or balance their checkbook to know if something
goes wrong?
The level of abstraction makes me nervous. WW3 might be started and
won by one country simply hacking into multiple networks
simultaneously and tainting the records beyond salvaging. Then
everyone wakes up the next day a random pauper or
billionaire. Everything could collapse.
On the other hand, money under a mattress also has severe
limitations.
I avoid any online banking. I can still walk and drive. Social
security is auto-deposited. I just don't need online banking, so
there's no sense risking it. I've also locked my credit. In the US one
can contact 3 credit reporting agencies, establish a lock, and from
then on no credit cards can be issued. If you need a new credit card,
you unlock it temporarily. That method also provides a great excuse
for pushy store clerks who want me to sign up for their store
card. "Oh, I'd love to, but I have my credit locked. Haven't you done
that yourself?"

It isn't just the card unfortunately. If you install an app rather than
just receive an SMS, that app can do other things like make payments,
and tell you the PIN number of your card. What happens if someone else
finds the PIN number from your phone? well, the Bank would like to say
it is your fault.

https://www.ftadviser.com/your-industry/2022/09/06/santander-agrees-to-reimburse-customer-after-gym-theft/

HSBC offers both physical and digital secure keys, but the digital one
involves installing an app.

https://www.hsbc.co.uk/help/security-centre/secure-key/

[Carlos E.R.]

Post by Richmond

Post by Newyana2
I avoid any online banking. I can still walk and drive. Social
security is auto-deposited. I just don't need online banking, so
there's no sense risking it. I've also locked my credit. In the US one
can contact 3 credit reporting agencies, establish a lock, and from
then on no credit cards can be issued. If you need a new credit card,
you unlock it temporarily. That method also provides a great excuse
for pushy store clerks who want me to sign up for their store
card. "Oh, I'd love to, but I have my credit locked. Haven't you done
that yourself?"

It isn't just the card unfortunately. If you install an app rather than
just receive an SMS, that app can do other things like make payments,
and tell you the PIN number of your card. What happens if someone else
finds the PIN number from your phone? well, the Bank would like to say
it is your fault.

He has to know the password to open the phone, and the password to open
the bank application. And possibly, a third password before the app
allows you to do an operation such as retrieve the pin of a credit card.

Post by Richmond
https://www.ftadviser.com/your-industry/2022/09/06/santander-agrees-to-reimburse-customer-after-gym-theft/

I don't know what that pin in app feature is, and I am a santander
client, just not in the UK.

Post by Richmond
HSBC offers both physical and digital secure keys, but the digital one
involves installing an app.
https://www.hsbc.co.uk/help/security-centre/secure-key/

[Richmond]

Post by Carlos E.R.

Post by Richmond

Post by Newyana2
I avoid any online banking. I can still walk and drive. Social
security is auto-deposited. I just don't need online banking, so
there's no sense risking it. I've also locked my credit. In the US
one can contact 3 credit reporting agencies, establish a lock, and
from then on no credit cards can be issued. If you need a new credit
card, you unlock it temporarily. That method also provides a great
excuse for pushy store clerks who want me to sign up for their store
card. "Oh, I'd love to, but I have my credit locked. Haven't you
done that yourself?" >> It isn't just the card unfortunately. If
you install an app rather >> than >> just receive an SMS, that app
can do other things like make payments, >> and tell you the PIN
number of your card. What happens if someone else >> finds the PIN
number from your phone? well, the Bank would like to say >> it is
your fault.

He has to know the password to open the phone, and the password to
open the bank application. And possibly, a third password before the
app allows you to do an operation such as retrieve the pin of a credit
card.

Malware doesn't need to do all these things. It just waits for you to do
them.

In the case of the article it doesn't explain how the phone was unlocked
but I think it likely the phone was not locked, or it had a trivial
PIN. Maybe the banking app was open too.

Post by Carlos E.R.

Post by Richmond
https://www.ftadviser.com/your-industry/2022/09/06/santander-agrees-to-reimburse-customer-after-gym-theft/

I don't know what that pin in app feature is, and I am a santander
client, just not in the UK.

It may have been removed now, the article is from 2022 and it says
"Morgan has called on Virgin Active UK to review its security as a
result of the incident and on Santander to remove its PIN-in-app feature
from its mobile banking app, or to at least make it an optional feature
for customers "

[AJL]

Post by Newyana2
I avoid any online banking. I can still walk and drive. Social
security is auto-deposited.

I go one step further. ALL my bills are automatically deducted from my bank
accounts including using my (cashback) credit card if allowed by the vendor
(some don't because of the extra expense to them). And likewise the
deposits: SS, my retirement check, and investment income. Nothing has come
by physical mail in years which IMO is much more dangerous...

Post by Newyana2
I've also locked my credit. In
the US one can contact 3 credit reporting agencies, establish
a lock, and from then on no credit cards can be issued. If
you need a new credit card, you unlock it temporarily.

Perhaps for a NEW card but I also have had all 3 credit bureaus locked for
years and my (cashback) cards keep automatically renewing...

Post by Newyana2
That
method also provides a great excuse for pushy store clerks
who want me to sign up for their store card. "Oh, I'd love to,
but I have my credit locked. Haven't you done that yourself?"

I just say no thank you as I present my (cashback :) card. No excuses are
required...

[Chris]

Post by Richmond

Post by Chris

Post by Carlos E.R.
...

As Carlos put it, people addicted to cellphones would like to
believe that everyone else "does not matter". They not only want
cellphone options, they want cellphone interaction to be enforced as
the only option. They want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not
cheap, for needed extra security.

Banks here used to provide a hardware device for free which you used
with your bank card at home.
The annoying thing was that you ended up with one for each bank -
despite using the same technology - and you were stuck if you didn't
have it with you.

I still use a little plastic device which the bank gave to me free of
charge. (And replaced free of charge when the battery went flat).
I would rather use it than use an android phone. I don't trust the
security of android phones, and I have a suspicion that banks don't
either, but they are not taking responsibility. Who will pay if your
phone gets malware on it and steals your credentials?

In that scenario the TOTP is least of your problems. Access to your emails
is far more valuable.

[Carlos E.R.]

Post by Chris

Post by Carlos E.R.
...

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.

Addicted? No, simply banks are using a device that everybody has,
instead of making their clients buy an extra hardware device, not cheap,
for needed extra security.

Banks here used to provide a hardware device for free which you used with
your bank card at home.
The annoying thing was that you ended up with one for each bank - despite
using the same technology - and you were stuck if you didn't have it with
you.

Yep.

Another method was a card with a list of random numbers, and each time
we had to type one of those. It is cheaper than the gadget, but
otherwise, you have to carry it around and it has no password hiding it.

[Frank Slootweg]

Newyana2 <***@invalid.nospam> wrote:
[...]

Post by Newyana2
People in this thread are actually getting angry at
merely the suggestion of having options besides cellphones
for taking care of business.

IMO that's misrepresenting what's being said.

Some - and probably even many - might *prefer* using a mobile phone,
but AFAICT nobody is insisting on it being the *only* option (for other
people). And IME it never *is* the only option.

But don't let facts get in the way of your rants.

[Yet another Newyana2 rant on other people's lifestyles being inferior
to his, deleted.]'

[AJL]

Post by Newyana2
| That would be me. I visit my branch maybe twice a year to get cash for
| emergencies (like if the checkout system is down) and tips. Everything
else
| is done with the credit card. Love that Cashback card. Also love that
folks
| who pay with cash help support it...
Yes, I remember that about you.

I'm flattered. I remember you too. That's why I threw out the cashback
fishhook. It worked... :)

Post by Newyana2
The man who would
buy an expired lottery ticket if he could get cash back.

I don't gamble but you're right, everything goes on the cashback card. I
usually get over $1000US back per year. Better than gambling because I
always win...

Post by Newyana2
The
man who wants to purchase a gravestone that says, "Here
lies a man who never failed to get cash back."
The trend seems to be much bigger than cash-back-mania,
though. People in this thread are actually getting angry at
merely the suggestion of having options besides cellphones
for taking care of business.
Cellphones have become a lifestyle.
Many of those people are not even using charge cards.

I still use a card. I find it easier to dig my card out at the store
than my cell phone.

Post by Newyana2
They're
using debit, Square, Venmo...

Not me. I'm still using (gasp) checks. For example, one fits nicely
under the front doormat for the yard guy...

Post by Newyana2
They've actually become
accustomed to paying someone else to handle their cash, so
that all transactions -- even lending $20 to a friend -- go
through a payment service.

You'd be proud of me. I give the grand and greatgrandkids CASH gifts.

Post by Newyana2
Some people are just afraid of cash, fearing that they'll
be mugged if they have money.

And if they are mugged and don't have any cash, no loss...

Post by Newyana2
Others feel Jetson-esque,
waving their iPhone at Starbucks.

Hardly, since almost EVERYBODY is waving their phone these days. But
they probably would all stop and point at someone using cash... ;)

Post by Newyana2
Many young people
probably know payment services as where money comes from.
But I suspect the main motivator is just habit: Once people
are constantly using their cellphone, it becomes convenient
to do everything through it.

Sure beats a phone being tied to the wall IMO.

Post by Newyana2
As Carlos put it, people addicted to cellphones
would like to believe that everyone else "does not matter".
They not only want cellphone options, they want cellphone
interaction to be enforced as the only option. They
want to live in Cellphone World.
I'm not so sure about automated checkouts, though. Some
stores in the US are deciding to remove or reduce them due
to theft.

It's a balancing act. If the increased $$ theft is less than the fired
cashiers salary $$ then they are still $$ ahead.

Post by Newyana2
https://www.cnn.com/2023/12/08/business/self-checkout-dollar-general-retail/index.html
At the same time, you run the risk of being accused of
https://www.coreycohen.com/blog/2022/12/have-you-been-accused-of-self-checkout-theft/

Life's a bitch, huh.

Having my receipt checked on the way out is no big deal for me. And it
is a theft deterrent which helps to keep the prices down for us honest
folks...

Post by Newyana2
There's also a controversy around restaurants with QR
code menus. Most people are happy to use their cellphone
to read the menu, but then they're questioning why they
should tip for barebones service...

Since I don't give to any charities I use tipping as my charity and tip
well. Those folks who wait tables need it IMO. And since I generally eat
out most every day that does come to a few (credit card cashback)
bucks... ;)

Post by Newyana2
So we run into an entirely
different issue: How does human society work without
personal interactions? Maybe you'll be able to use your
famous cash-back charge card to buy conversations...
Perhaps Monty Python's argument service wasn't so
farfetched. :)
I used a self checkout for the first time recently. There
were 8 women with full carts at the only Target register,
and the self checkout took cash. I don't really mind it
there. They have the best prices, by far, on household
items. And Target seems to be the only place left to buy
such a simple thing as a pack or sponges -- just a plain old
4-pack of kitchen sponges, without a "patented
scrubber surface" or any other overpriced gimmick. So
I accept that they need to cut corners. Though I have to
find another source for underwear and socks now. Target
has locked them in display cases! Apparently people were
stealing them and sneaking through the self-checkout.

I have 2 Targets within 5 miles of me. My favorite purchases have been
new cell phones on the discount rack. I got one for $13US and another
for $15. I never used them for phones but they made great Android toys
(see, I'm back on topic)...

[Bob Henson]

|> As V said, the simple answer is that they want to spy.
|
| No, that's not it. Not for a bank.
|
Of course that's it.
| They want to know that you are an actual person with a phone and
| contract. They have to trust the company giving those numbers.
|
An actual person with a phone contract? So you're saying that
having a cellphone is more proof of ID than my drivers license? You've
been drinking the kool-aid.

Nevertheless, that's what they want.

At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

[Newyana2]

"Bob Henson" <***@outlook.com> wrote

| > At one point I played with crypto a bit. I had to upload a picture
| > ID (drivers license), as well as giving them my email address and
| > access to my bank account. As I recall I think they sent a voice
| > message code to my landline, which is a lot more security in terms of
| > proof of ID than a cellphone. The lamdline is registered to -- and
| > wired to -- a physical address.
|
| They will struggle in the UK soon, then. All landlines disappear by the
end
| of 2025 - there will only be VoIP.
|

That's a technical distinction. In the US I used to have
a landline over copper wires. They don't want to maintain
those anymore. I then had a landline over cable Internet.
They started pricegouging. I switched to VOIP. It's still
a landline. It's still running over wires provided by my cable
company. I'm just no longer paying them an extra fee for
the phone service over the same wire.

I'd call all of those landlines. They're all anchored to the
physical address, they all use landline phones that
don't support texting, and they're all running direct over
wires. No cellphone/radio towers involved.

So maybe the situation is not so different in the US,
though that's no excuse for requiring cellphones for 2FA.

It may be decades before landlines are gone in the US.
People I know in rural areas have limited cell
service. Many don't have cable TV. But they all have
phone lines going to their houses, on the same poles as
electricity. I have a brother who's never had cell service at
home and only recently bought a Musk satellite antenna
for Internet. (He used to have a dish that went out in
the rain. :) Much of the US is similar, with rural populations
that the phone companies simply don't want to buy towers
for. It's not worth the investment to them.

I think that people living in cities and suburbs often don't
understand that the ubiquity of cellphones is not universal.
Europe is different. People are closer together, in a landscape
that's been stable for centuries. And governments are more
likely to be reining in corporations for the public good.

There was a good example of that just this week. The EU
fined Apple $2 billion and is forcing them to stop the monopoly
scam of charging a 30% cut for their app store. Apple then
revoked the developer license of Epic Games, to stop them
opening a now-legal iPhone app store that taakes a 12% cut.
Epic complained to the EU. Apple is now restoring their ability
to run their store. In the US? It's unlikely that any such control
over Apple will happen. If it does, it will be thanks to the EU.

[Jörg Lorenz]

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.

For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Here in Switzerland VOIP/ip-endpoints are mandatory since 2017.

[Bob Henson]

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.
Here in Switzerland VOIP/ip-endpoints are mandatory since 2017.

Here we designate wired analogue connections running under PSTN as
landlines - nothing else. What I say is correct. There will be options to
continue the old lines for a few who cannot cope, but not for long.

https://tinyurl.com/2lgbqv49

[Dave Royal]

Post by Bob Henson

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.
Here in Switzerland VOIP/ip-endpoints are mandatory since 2017.

Here we designate wired analogue connections running under PSTN as
landlines - nothing else. What I say is correct. There will be options to
continue the old lines for a few who cannot cope, but not for long.
https://tinyurl.com/2lgbqv49

The word 'landline' can mean a several things in the UK. What's
being discontinued are the copper pairs which run between the
cabinets in the street and local exchanges, which carry analogue
voice calls (PSTN aka POTS - 'Plain Old Telephone System'). The
pairs between the cabinet and the premises may continue to carry
DSL or may be replaced by fibre.

The old (self powered) analogue phone service has become known to
the public here as a 'landline' only since they had a choice (or
no choice) to replace it with what's generally called a 'digital'
phone.

But the word 'landline' can also mean just the wires. Many people
have a landline but no phone on the end, but they still have to
pay for a 'landline'.

And to younger people, who have mobile phones, a 'landline'
probably means just a permanent phone in their home as opposed
to a mobile.

[Bob Henson]

Post by Dave Royal
The old (self powered) analogue phone service has become known to
the public here as a 'landline' only since they had a choice (or
no choice) to replace it with what's generally called a 'digital'
phone.

Not so. You're obviously not as old as me. When I first used telephones
there were (apart from snailmail or a runner with a cleft stick) two ways
to communicate - telephones (landlines) and radio (no lines at all) - the
latter not being for the public (outbound, at least) at that time.
Telephones lines remained "landlines" until mobile phones appeared - not
that long back, in the global order of things.

[Richmond]

Post by Jörg Lorenz

Post by Newyana2
At one point I played with crypto a bit. I had to upload a
picture ID (drivers license), as well as giving them my email
address and access to my bank account. As I recall I think they sent
a voice message code to my landline, which is a lot more security in
terms of proof of ID than a cellphone. The lamdline is registered to
-- and wired to -- a physical address. >> They will struggle in the
UK soon, then. All landlines disappear by >> the end >> of 2025 -
there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a
cell phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.
Here in Switzerland VOIP/ip-endpoints are mandatory since 2017.

Once a landline number has been switched to VOIP it can easily be
switched to any VOIP provider, so in that sense I think it is less
secure than a PSTN landline.

[Chris]

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

[Dave Royal]

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

BT's System X, installed from the '80s, didn't use packet-switching.

[Carlos E.R.]

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.

In fact, companies hide the VoIP credentials so that connecting a VoIP
phone instead is not trivial.

The stated goal is to remove all copper exchanges, migrating everybody
to fibre (or some form of radio). The buildings can then be sold, they
are in the city centres and are worth a packet.

My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

[Frank Slootweg]

Carlos E.R. <***@es.invalid> wrote:
[...]

[About 'landlines':]

Post by Carlos E.R.
I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.

I (in The Netherlands) have the same kind of setup on our (coax, HFC)
cable connection and I indeed connect the (DECT) phone to the RJ-11 of
the modem/router.

Ours is indeed a 'landline' and has a city-based landline number
(non-06), not a mobile number (06).

OTOH, the phone is a 'mobile' phone, just not very mobile! :-)

[Carlos E.R.]

Post by Frank Slootweg
[...]
[About 'landlines':]

Post by Carlos E.R.
I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.

I (in The Netherlands) have the same kind of setup on our (coax, HFC)
cable connection and I indeed connect the (DECT) phone to the RJ-11 of
the modem/router.
Ours is indeed a 'landline' and has a city-based landline number
(non-06), not a mobile number (06).
OTOH, the phone is a 'mobile' phone, just not very mobile! :-)

Yep, same thing here.

I forgot to mention that this "advancement" means that the phone dies if
the house power fails, unless you invest on an UPS for the router. So
you can not call the electrician.

[Frank Slootweg]

Post by Carlos E.R.

Post by Frank Slootweg
[...]
[About 'landlines':]

Post by Carlos E.R.
I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.

I (in The Netherlands) have the same kind of setup on our (coax, HFC)
cable connection and I indeed connect the (DECT) phone to the RJ-11 of
the modem/router.
Ours is indeed a 'landline' and has a city-based landline number
(non-06), not a mobile number (06).
OTOH, the phone is a 'mobile' phone, just not very mobile! :-)

Yep, same thing here.
I forgot to mention that this "advancement" means that the phone dies if
the house power fails, unless you invest on an UPS for the router. So
you can not call the electrician.

Yes, in Australia, a subscriber can get (or gets by default?) a UPS as
part of the set up of such 'landlines' on the fibre NBN (National
Broadband Network).

Next thing, users connect their DECT phones, which also need power,
but which are not connected to the UPS. Guess what happens in case of a
power failure? :-) (Yes, I've seen it with my very eyes.)

[Carlos E.R.]

Post by Frank Slootweg

Post by Carlos E.R.

Post by Frank Slootweg
[...]
[About 'landlines':]

Post by Carlos E.R.
I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.

I (in The Netherlands) have the same kind of setup on our (coax, HFC)
cable connection and I indeed connect the (DECT) phone to the RJ-11 of
the modem/router.
Ours is indeed a 'landline' and has a city-based landline number
(non-06), not a mobile number (06).
OTOH, the phone is a 'mobile' phone, just not very mobile! :-)

Yep, same thing here.
I forgot to mention that this "advancement" means that the phone dies if
the house power fails, unless you invest on an UPS for the router. So
you can not call the electrician.

Yes, in Australia, a subscriber can get (or gets by default?) a UPS as
part of the set up of such 'landlines' on the fibre NBN (National
Broadband Network).

An UPS should not be needed. Instead, the hardware should have
batteries. Way more efficient.

Post by Frank Slootweg
Next thing, users connect their DECT phones, which also need power,
but which are not connected to the UPS. Guess what happens in case of a
power failure? :-) (Yes, I've seen it with my very eyes.)

[Chris]

Post by Carlos E.R.

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.
In fact, companies hide the VoIP credentials so that connecting a VoIP
phone instead is not trivial.
The stated goal is to remove all copper exchanges, migrating everybody
to fibre (or some form of radio). The buildings can then be sold, they
are in the city centres and are worth a packet.
My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

I'm aware of that, but that's the recent (domestic) move away from copper
lines and VOIP.

Jörg's comment was about the backhaul being ip-based for a much longer
period.

[Carlos E.R.]

Post by Chris

Post by Carlos E.R.

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.
In fact, companies hide the VoIP credentials so that connecting a VoIP
phone instead is not trivial.
The stated goal is to remove all copper exchanges, migrating everybody
to fibre (or some form of radio). The buildings can then be sold, they
are in the city centres and are worth a packet.
My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

I'm aware of that, but that's the recent (domestic) move away from copper
lines and VOIP.
Jörg's comment was about the backhaul being ip-based for a much longer
period.

It is so in his country, to my understanding.

The Swiss I know have a tendency to think that the changes applied in
their country have also been applied elsewhere :-D

Like no TV over the air.

[Jörg Lorenz]

Post by Carlos E.R.

Post by Chris

Post by Carlos E.R.

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.
In fact, companies hide the VoIP credentials so that connecting a VoIP
phone instead is not trivial.
The stated goal is to remove all copper exchanges, migrating everybody
to fibre (or some form of radio). The buildings can then be sold, they
are in the city centres and are worth a packet.
My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

I'm aware of that, but that's the recent (domestic) move away from copper
lines and VOIP.
Jörg's comment was about the backhaul being ip-based for a much longer
period.

It is so in his country, to my understanding.
The Swiss I know have a tendency to think that the changes applied in
their country have also been applied elsewhere :-D
Like no TV over the air.

Very Old Style! We use satellite or fibre-based IP-TV. More reliable and
much better quality.

BTW: Classical TV is a thing of the past.

[Dave Royal]

Post by Jörg Lorenz

Post by Carlos E.R.
It is so in his country, to my understanding.
The Swiss I know have a tendency to think that the changes applied in
their country have also been applied elsewhere :-D
Like no TV over the air.

Very Old Style! We use satellite or fibre-based IP-TV. More reliable and
much better quality.
BTW: Classical TV is a thing of the past.

"Switzerland will switch off its free-to-air digital terrestrial
television (DTT) service in 2019. The decision is based on the
very low penetration for DTT in Switzerland and the continuing
rise in IPTV subscriptions. The move is part of a package of
cost-saving measures agreed between the Swiss public broadcaster
SRG and the Swiss Federal Council following the recent No-Billag
referendum"

<https://dvb.org/news/why-is-switzerland-switching-off-dtt/>

There's a link to the No-Billag referendum in the piece. Interesting.

[Carlos E.R.]

...

Post by Jörg Lorenz

Post by Carlos E.R.

Post by Chris

Post by Carlos E.R.
My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

I'm aware of that, but that's the recent (domestic) move away from copper
lines and VOIP.
Jörg's comment was about the backhaul being ip-based for a much longer
period.

It is so in his country, to my understanding.
The Swiss I know have a tendency to think that the changes applied in
their country have also been applied elsewhere :-D
Like no TV over the air.

Very Old Style! We use satellite or fibre-based IP-TV. More reliable and
much better quality.

Tsk, tsk. Actually, in Spain, some channels transmit in better quality
over the air than via fibre. Just a fact, they do.

Post by Jörg Lorenz
BTW: Classical TV is a thing of the past.

I know you would say that. But it is not classical TV over here, it is
digital, and it is going strong.

There are many people here without access to fibre. Those in rural
places in small villages an isolated places. Cottages and beach places
(secondary residences).

Fibre is expensive.

[Chris]

Post by Carlos E.R.

Post by Chris

Post by Carlos E.R.

Post by Chris

Post by Jörg Lorenz

Post by Bob Henson

Post by Newyana2
At one point I played with crypto a bit. I had to upload a picture
ID (drivers license), as well as giving them my email address and
access to my bank account. As I recall I think they sent a voice
message code to my landline, which is a lot more security in terms of
proof of ID than a cellphone. The lamdline is registered to -- and
wired to -- a physical address.

They will struggle in the UK soon, then. All landlines disappear by the end
of 2025 - there will only be VoIP.

Hardly ever read so much nonsense. We know Newyana does not have a cell
phone but he or she wants to have a big mouth in technical groups
discussing mobile technology.
For you: IP-telephone lines are landlines. Landlines are not what you
think they are. The backend is even in the UK ip-based for years.

Do you have evidence for that? It's true that UK telephony has been digital
for a long time within the BT network, but that doesn't mean it's
internet/ip-based.

I don't know about UK, but here in Spain all clients on fibre have a
VoIP system, hidden. At the home, there is a device called ONT (Optical
network terminal), which can be integrated on the router, that converts
the phone over IP signals to an RJ-11 where we connect our traditional
phone terminals.
In fact, companies hide the VoIP credentials so that connecting a VoIP
phone instead is not trivial.
The stated goal is to remove all copper exchanges, migrating everybody
to fibre (or some form of radio). The buildings can then be sold, they
are in the city centres and are worth a packet.
My understanding is that the UK is doing more or less the same, and many
countries are on the same road. Which means that a lot of the current
phone network is no longer circuit switched.

I'm aware of that, but that's the recent (domestic) move away from copper
lines and VOIP.
Jörg's comment was about the backhaul being ip-based for a much longer
period.

It is so in his country, to my understanding.
The Swiss I know have a tendency to think that the changes applied in
their country have also been applied elsewhere :-D

Maybe so. He hasn't answered my question so looks he's just assuming.

Post by Carlos E.R.
Like no TV over the air.

[VanguardLH]

Post by Carlos E.R.

Post by Newyana2

Post by The Real Bev
WTF? Why is the google voice number not a REAL phone number?

As V said, the simple answer is that they want to spy.

No, that's not it. Not for a bank.
They want to know that you are an actual person with a phone and
contract. They have to trust the company giving those numbers.

Well, that *is* tracking to a device. They hope the device belongs to
you, and you're the one in charge of the phone when the call arrives.
Rather a stupid concept: send the code to the same phone that is trying
to log into a web form. Geez, of course the thief or hacker just must
ignore the code sent to that phone for the login they're trying to hack.

[Frank Slootweg]

Post by VanguardLH

Post by Carlos E.R.

Post by Newyana2

Post by The Real Bev
WTF? Why is the google voice number not a REAL phone number?

As V said, the simple answer is that they want to spy.

No, that's not it. Not for a bank.
They want to know that you are an actual person with a phone and
contract. They have to trust the company giving those numbers.

Well, that *is* tracking to a device. They hope the device belongs to
you, and you're the one in charge of the phone when the call arrives.
Rather a stupid concept: send the code to the same phone that is trying
to log into a web form. Geez, of course the thief or hacker just must
ignore the code sent to that phone for the login they're trying to hack.

Huh? Who is saying that the "log into a web form" is done on a *phone*?

It's more likely done on a computer and in that case, the scenario
involves *two* devices and the thief/hacker must be in possesion of the
second device (phone), which he isn't.

*If* the "log into a web form" is done on a phone, then it's most
likely not a "web form" - i.e. via a web-browser -, but an *app* on the
phone and that app will - together with the bank (or other service
provider) - provide the needed security (by checking hardware IDs, PIN,
fingerprint, etc.).

[VanguardLH]

Post by Frank Slootweg
Huh? Who is saying that the "log into a web form" is done on a *phone*?

Web traffic volume generated by phones has surpassed web traffic
generated by desktop PCs. Most logins are on phones, not desktops.

https://gs.statcounter.com/platform-market-share/desktop-mobile/worldwide/

Post by Frank Slootweg
It's more likely done on a computer and in that case, the scenario
involves *two* devices and the thief/hacker must be in possesion of the
second device (phone), which he isn't.

2FA isn't about using 2 devices. It's about 2 pieces of evidence:
password and 2FA code.

[Frank Slootweg]

Post by VanguardLH

Post by Frank Slootweg
Huh? Who is saying that the "log into a web form" is done on a *phone*?

Web traffic volume generated by phones has surpassed web traffic
generated by desktop PCs. Most logins are on phones, not desktops.
https://gs.statcounter.com/platform-market-share/desktop-mobile/worldwide/

Who says that these 'stats' are any indication of "log into a web
form" versus just browsing?

Anyway, in our country (NL), 'desktop' is still slightly higher than
'mobile'! :-) (Both stupid terms, without an explanation.)

And just look at 'Desktop vs Mobile vs Tablet Market Share Worldwide'
to see how silly/meaningless those stats are.

Post by VanguardLH

Post by Frank Slootweg
It's more likely done on a computer and in that case, the scenario
involves *two* devices and the thief/hacker must be in possesion of the
second device (phone), which he isn't.

password and 2FA code.

FTR, the context is sending a code by SMS, that's 2SV (2 Step
Verification), not 2FA (2 Factor Authentication).

2FA is about two *factors*, knowledge and possesion.

2SV is about two *steps*, in this case 1) (username and) password and
2) getting/entering the code.

2FA is a 2SV process, because it (normally) involves 2 steps.

But 2SV is not a 2FA process, because it doesn't involve possesion,
you don't own/posses the code, you get the code.

[AJL]

Post by Frank Slootweg
FTR, the context is sending a code by SMS, that's 2SV (2 Step
Verification), not 2FA (2 Factor Authentication).
2FA is about two *factors*, knowledge and possesion.
2SV is about two *steps*, in this case 1) (username and) password and
2) getting/entering the code.
2FA is a 2SV process, because it (normally) involves 2 steps.
But 2SV is not a 2FA process, because it doesn't involve possesion,
you don't own/posses the code, you get the code.

FTR Professor Google says they are the same:

"With 2-Step Verification, also called two-factor authentication, you
can add an extra layer of security to your account in case your password
is stolen."

<https://support.google.com/accounts/answer/185839?hl=en&co=GENIE.Platform%3DDesktop>

Who to believe? Professor Google or Professor Slootweg? Hmmmmm... ;)

[Frank Slootweg]

Post by AJL

Post by Frank Slootweg
FTR, the context is sending a code by SMS, that's 2SV (2 Step
Verification), not 2FA (2 Factor Authentication).
2FA is about two *factors*, knowledge and possesion.
2SV is about two *steps*, in this case 1) (username and) password and
2) getting/entering the code.
2FA is a 2SV process, because it (normally) involves 2 steps.
But 2SV is not a 2FA process, because it doesn't involve possesion,
you don't own/posses the code, you get the code.

"With 2-Step Verification, also called two-factor authentication, you
can add an extra layer of security to your account in case your password
is stolen."
<https://support.google.com/accounts/answer/185839?hl=en&co=GENIE.Platform%3DDesktop>
Who to believe? Professor Google or Professor Slootweg? Hmmmmm... ;)

Professor Google's blurb is probably intended to keep things simple.

But more to the point, *in the context* of that text - which is the
'2-Step Verification' setting of your Google Account, i.e. specific, not
generic - some of the options of the second step *are* indeed 2FA,
namely Google prompts, security keys, (AFAIK) Google Authenticator /
verification code apps and backup codes, because all these use a second
*factor*, instead of just a second *step*.

Bottom line: *In context*, you can believe *both* Professor Google
*and* Professor Slootweg.

FYI, sofar Professor Slootweg uses / has used all of the above
methods, except verification code apps.

[Dave Royal]

Post by Carlos E.R.

Post by Newyana2
| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.

No, that's not it. Not for a bank.
They want to know that you are an actual person with a phone and
contract. They have to trust the company giving those numbers.

Exactly. Banking regulations require them to use 2FA and SMS is a
simple and cheap way of doing it. Not very secure, though more
secure than email. Also it's easily understood by customers, and
that's very important. AMEX send me _both_ an SMS and an email,
which is convenient but more insecure - an OTP should go to
exactly one device.

I have a TOTP client on both my phone (FreeOTP) and tablet
(andOTP) but none of my UK banks or savings accounts uses them.
One bank provides me with an OTP gadget, but that was before 2FA
became a legal requirement. I can also use their banking app to
generate a code: I think that's what will replace SMS for most
people.

That banks or banking authorities are actually thinking about the
security of these SMSs and refusing to send them to some mobile
services is vaguely encouraging.

[Carlos E.R.]

Post by Dave Royal

Post by Carlos E.R.

Post by Newyana2
| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.

No, that's not it. Not for a bank.
They want to know that you are an actual person with a phone and
contract. They have to trust the company giving those numbers.

Exactly. Banking regulations require them to use 2FA and SMS is a
simple and cheap way of doing it. Not very secure, though more
secure than email. Also it's easily understood by customers, and
that's very important. AMEX send me _both_ an SMS and an email,
which is convenient but more insecure - an OTP should go to
exactly one device.
I have a TOTP client on both my phone (FreeOTP) and tablet
(andOTP) but none of my UK banks or savings accounts uses them.
One bank provides me with an OTP gadget, but that was before 2FA
became a legal requirement. I can also use their banking app to
generate a code: I think that's what will replace SMS for most
people.
That banks or banking authorities are actually thinking about the
security of these SMSs and refusing to send them to some mobile
services is vaguely encouraging.

There was an attack on Orange, basically breaking all internet service,
and it was commented that had the attacked machines (RIPE database?)
used a simple 2FA, the attack would not have succeeded.

Nothing is fully safe, but an SMS to a mobile is better than nothing.

[Chris]

Post by Newyana2
| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.

Just because you're paranoid doesn't mean they're NOT after you.

However, in this case it's by design not nefarious. The 'F' in. 2FA is
"factor" meaning that you need two different sources of truth. Your
password is one and a known device is the second. VOIP is neither known nor
a device so cannot be trusted as the endpoint could be almost anything.

[VanguardLH]

Post by Chris
However, in this case it's by design not nefarious. The 'F' in. 2FA is
"factor" meaning that you need two different sources of truth. Your
password is one and a known device is the second. VOIP is neither
known nor a device so cannot be trusted as the endpoint could be
almost anything.

Yet 2FA codes are also sent by e-mail. Someone is on your phone using a
web browser, gets the login 2FA interruption, and the 2FA code gets sent
to e-mail which is accessed on the same phone. Yeah, that really
thwarted the 2FA-enabled login ... not! 2FA only makes sense when 2
*different* devices are used for login and to where the 2FA code is
sent. Where do 2FA SMS texts get sent? Yep, to the same phone someone
is using a web browser trying to login. There is nothing about 2FA that
gurantees nor even mandates that different devices are used for login
and 2FA code reception. The "factor" is NOT about using different
devices. It is about using two pieces of /evidence/ (password and 2FA).

All the site knows that is sending the 2FA code is either your e-mail
address or your SMS-capable phone number. How do they know that where
the 2FA code is received is at a different device than where the login
was attempted? Smartphones generate the most volume of web traffic.

https://gs.statcounter.com/platform-market-share/desktop-mobile/worldwide/

Most users are logging into a site via a web browser on their phone. It
is the same device that receives e-mails and SMS texts. The web site
knows your IP address, not your phone number, when you use a web browser
on your phone trying to log into a site. They send a 2FA code to your
phone number, but they don't know that is the same device as from where
you are web browsing - unless they are tracking your IP address to the
IMEI of your phone. Even with the IMEI of your phone, you use another
phone to web browse to the same site, it sends a 2FA code via e-mail or
SMS, and you see it on that phone.

Login on a smartphone via web browser, and 2FA code sent to the SAME
device. Just where is the mandate 2 different devices are used for
login and to where 2FA codes get sent?

I haven't delved much into TOTP, because I've yet to log into any sites
that use it, but it might be more secure than 2FA.

https://en.wikipedia.org/wiki/Time-based_one-time_password

My bank did add TOTP by letting their customers using the Authy app.
Alas, Authy discontinued their desktop (Windows) client leaving only
their mobile apps. Yet I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail. Obviously I can't
get texts on my desktop PC (it has no cellular service), and I'm not
running around the house to find my smartphones to power them up and
wait to get a 2FA code via SMS that I have to manually copy into the 2FA
form in the web browser on my desktop PC. At the server, 2FA codes
expire, so it could take me longer to use a phone with SMS than it took
to use Authy on my desktop where I was trying to login.

There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

[Dave Royal]

Post by VanguardLH
....
There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

IME sites cite one or two TOTP clients that they 'support' - Authy
is common - but I suspect any standards-based client will work.
I've used andOTP on Android to read the QR code tokens from
Authy-supporting sites, and later transferred the tokens to
FreeOTP on iOS.

There must be offline Windows opensource clients. A quick Google
turn this up, but it's not clear to me how you install it if you
don't get it from MS.
https://github.com/2fast-team/2fast

(I tried chocolatey once, but got lost in it and gave up.)

[Frank Slootweg]

VanguardLH <***@nguard.lh> wrote:

[Yet another mixup of 2FA/2SV deleted.]

Post by VanguardLH
I haven't delved much into TOTP, because I've yet to log into any sites
that use it, but it might be more secure than 2FA.
https://en.wikipedia.org/wiki/Time-based_one-time_password
My bank did add TOTP by letting their customers using the Authy app.
Alas, Authy discontinued their desktop (Windows) client leaving only
their mobile apps. Yet I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail. Obviously I can't
get texts on my desktop PC (it has no cellular service), and I'm not
running around the house to find my smartphones to power them up and
wait to get a 2FA code via SMS that I have to manually copy into the 2FA
form in the web browser on my desktop PC. At the server, 2FA codes
expire, so it could take me longer to use a phone with SMS than it took
to use Authy on my desktop where I was trying to login.
There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

See this list of OTP 'apps'/programs for possible Windows solutions
(pointed to by the 'See also:' of your reference)

'Comparison of OTP applications'
<https://en.wikipedia.org/wiki/Comparison_of_OTP_applications>

[VanguardLH]

Post by Frank Slootweg
[Yet another mixup of 2FA/2SV deleted.]

Post by VanguardLH
I haven't delved much into TOTP, because I've yet to log into any sites
that use it, but it might be more secure than 2FA.
https://en.wikipedia.org/wiki/Time-based_one-time_password
My bank did add TOTP by letting their customers using the Authy app.
Alas, Authy discontinued their desktop (Windows) client leaving only
their mobile apps. Yet I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail. Obviously I can't
get texts on my desktop PC (it has no cellular service), and I'm not
running around the house to find my smartphones to power them up and
wait to get a 2FA code via SMS that I have to manually copy into the 2FA
form in the web browser on my desktop PC. At the server, 2FA codes
expire, so it could take me longer to use a phone with SMS than it took
to use Authy on my desktop where I was trying to login.
There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.
See this list of OTP 'apps'/programs for possible Windows solutions
(pointed to by the 'See also:' of your reference)
'Comparison of OTP applications'
<https://en.wikipedia.org/wiki/Comparison_of_OTP_applications>

Authy will drop their desktop (Windows client), but the desktop is where
I do the vast majority of my web surfing and logins. Google and
Microsoft have their authenticators, but those are apps for Android or
iOS, so they are no value to me on a desktop. Besides Authy, my bank
says they support Symantec VIP which has clients for Windows, Mac,
Android, and iOS. Authy originally said they were dropping their
desktop client in August 2024, but they moved to this mid-March.

I read about Bitwarden for 2FA/TOTP, but that's a premium feature
($10/yr subscriptionware). Symantec VIP (well, I think) is free. The
wiki article doesn't mention that one. Until the wiki article, I had
not heard of SAASPASS Authenticator. Alas, while the wiki article makes
SASSPASS Authenticator look superior, the table is a bit misleading.
The personal-use client is only for mobile platforms. I'll probably
lookup comparisons between Symantec VPI and Bitwarden.

I was looking at the protocols, and it seems on the surface that just
about any authenticator app should work, but that could be me being
naive or overly hopeful. I didn't want to get into the incompatibility
with old chat clients that had their own protocols, so you had to use
the same chat app as with whomever you wanted to chat (unless you got
XMPP working on both ends, but typically on lesser featured chat
clients). From some forums, Symantec VIP provides the TOTP seed in some
non-standard form, so it seems sites that support Symantec VIP means
that's what you have to use, and other sites using OTP have you using
yet another authenticator.

While OAUTH change from OAUTH1 as a protocol to OAUTH2 as a framework,
seems everyone adapted the Google/Microsoft (who were the major players
in the OAUTH2 spec). Doesn't seem to have been true for TOTP and
authenticators. I'll probably try Bitwarden first, but I'm not finding
a trial of Bitwarden Premium.

[Dave Royal]

Post by VanguardLH

Post by Frank Slootweg
[Yet another mixup of 2FA/2SV deleted.]

Post by VanguardLH
I haven't delved much into TOTP, because I've yet to log into any sites
that use it, but it might be more secure than 2FA.
https://en.wikipedia.org/wiki/Time-based_one-time_password
My bank did add TOTP by letting their customers using the Authy app.
Alas, Authy discontinued their desktop (Windows) client leaving only
their mobile apps. Yet I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail. Obviously I can't
get texts on my desktop PC (it has no cellular service), and I'm not
running around the house to find my smartphones to power them up and
wait to get a 2FA code via SMS that I have to manually copy into the 2FA
form in the web browser on my desktop PC. At the server, 2FA codes
expire, so it could take me longer to use a phone with SMS than it took
to use Authy on my desktop where I was trying to login.
There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.
See this list of OTP 'apps'/programs for possible Windows solutions
(pointed to by the 'See also:' of your reference)
'Comparison of OTP applications'
<https://en.wikipedia.org/wiki/Comparison_of_OTP_applications>

Authy will drop their desktop (Windows client), but the desktop is where
I do the vast majority of my web surfing and logins. Google and
Microsoft have their authenticators, but those are apps for Android or
iOS, so they are no value to me on a desktop. Besides Authy, my bank
says they support Symantec VIP which has clients for Windows, Mac,
Android, and iOS. Authy originally said they were dropping their
desktop client in August 2024, but they moved to this mid-March.
I read about Bitwarden for 2FA/TOTP, but that's a premium feature
($10/yr subscriptionware). Symantec VIP (well, I think) is free. The
wiki article doesn't mention that one. Until the wiki article, I had
not heard of SAASPASS Authenticator. Alas, while the wiki article makes
SASSPASS Authenticator look superior, the table is a bit misleading.
The personal-use client is only for mobile platforms. I'll probably
lookup comparisons between Symantec VPI and Bitwarden.
I was looking at the protocols, and it seems on the surface that just
about any authenticator app should work, but that could be me being
naive or overly hopeful. I didn't want to get into the incompatibility
with old chat clients that had their own protocols, so you had to use
the same chat app as with whomever you wanted to chat (unless you got
XMPP working on both ends, but typically on lesser featured chat
clients). From some forums, Symantec VIP provides the TOTP seed in some
non-standard form, so it seems sites that support Symantec VIP means
that's what you have to use, and other sites using OTP have you using
yet another authenticator.
While OAUTH change from OAUTH1 as a protocol to OAUTH2 as a framework,
seems everyone adapted the Google/Microsoft (who were the major players
in the OAUTH2 spec). Doesn't seem to have been true for TOTP and
authenticators. I'll probably try Bitwarden first, but I'm not finding
a trial of Bitwarden Premium.

It's easier than you think. All the TOTP sites I use - admittedly
not many and none of them banks - use standards protocols. I
think all of them suggested Authy - not sure. GitHub and Mozilla
suggested FreeOTP IIRC.

The reason I chose andOTP on my Android tablet was (a) it's
opensource (b) it's offline (c) it can produce an encrypted
backup of its tokens (d) it requires a password to access.
FreeOTP on iOS could not do (c) and (d). All the tokens I have
originated on my Linux desktop. I point the Android tablet's
camera at the barcode on the screen to install it, then back it
up onto both. If I want to transfer the token to my iPhone - I
usually don't in case it's lost ot stolen, see (d) - I display
the barcode on the tablet and read that with the iPhone.


Is all this more secure than an SMS to a phone? Debatable. The SMS
should end up on _one_ place, whereas the TOTP tokens may be on
several.

But it certainly makes life easier if you want to change your
phone number, as I did recently!

I notice on WikiP that andOTP is no longer supported. But it works
and should continue to work unless Android breaks it. I must back
up the APK.

[Anssi Saari]

Post by Dave Royal
I notice on WikiP that andOTP is no longer supported. But it works
and should continue to work unless Android breaks it. I must back
up the APK.

Another FOSS HOTP and TOTP client for Android is Aegis and it can import
from andOTP.

[Dave Royal]

Post by Anssi Saari

Post by Dave Royal
I notice on WikiP that andOTP is no longer supported. But it works
and should continue to work unless Android breaks it. I must back
up the APK.

Another FOSS HOTP and TOTP client for Android is Aegis and it can import
from andOTP.

An important feature of andOTP, for me, is that it will backup all
the tokens to a standard AES256 symmetrically encryted file
(.json.aes). So text-format tokens can be imported into another
authenticator, or even made into QR codes, in case andOTP becomes
unavailable or inoperable.

I see that Aegis can produce an encryted copy of it's 'vault'. Do
you know if the tokens therein be recovered without using Aegis
itself ?

[Anssi Saari]

Post by Dave Royal
I see that Aegis can produce an encryted copy of it's 'vault'. Do
you know if the tokens therein be recovered without using Aegis
itself ?

Looks like an OTPClient dev asked about importing an Aegis encrypted
backup in https://github.com/beemdevelopment/Aegis/issues/902 and from
their project page at https://github.com/paolostivanin/OTPClient/ they
support that now. So at least OTPClient has the required support.

More reading, there's a script decrypt.py in the docs directory of
Aegis' Github which apparently can be used to decrypt the vault as
well. I don't know what format that produces or if it can be imported by
other tools. I should try that, obviously.

[Dave Royal]

Post by Anssi Saari
More reading, there's a script decrypt.py in the docs directory of
Aegis' Github which apparently can be used to decrypt the vault as
well. I don't know what format that produces or if it can be imported by
other tools. I should try that, obviously.

Obviously!
But I hadn't actually tried decrypting an andOTP backup. So I did,
on Linux, using this:
https://github.com/asmw/andOTP-decrypt

It produces a set of QR code image files.

[Anssi Saari]

Post by Dave Royal
But I hadn't actually tried decrypting an andOTP backup. So I did,
https://github.com/asmw/andOTP-decrypt
It produces a set of QR code image files.

I tried using the decrypt.py on an Aegis backup and it decrypted into a
straightforward looking json file. Looks like the packaged OTPClient in
Debian 11 is too old to support importing from Aegis. I'll have to try
this again after upgrading to Debian 12.

[VanguardLH]

Post by Dave Royal
It's easier than you think. All the TOTP sites I use - admittedly
not many and none of them banks - use standards protocols. I
think all of them suggested Authy - not sure. GitHub and Mozilla
suggested FreeOTP IIRC.
The reason I chose andOTP on my Android tablet was (a) it's
opensource (b) it's offline (c) it can produce an encrypted
backup of its tokens (d) it requires a password to access.
FreeOTP on iOS could not do (c) and (d). All the tokens I have
originated on my Linux desktop. I point the Android tablet's
camera at the barcode on the screen to install it, then back it
up onto both. If I want to transfer the token to my iPhone - I
usually don't in case it's lost ot stolen, see (d) - I display
the barcode on the tablet and read that with the iPhone.

Bitwarden is open source, too; however, to get TOTP means paying for
their Premium version ($10/yr). From the wiki article mentioned by
Frank (https://en.wikipedia.org/wiki/Comparison_of_OTP_applications),
Bitwarden supports the platforms I want and the features I want (if I
pay to get TOTP), but it's not a feature-rich comparison. FreeOTP and
andOTP are unusable on Windows. I don't want a TOTP solution only for
mobile platforms. I need an authenticator on desktops (Windows now,
perhaps Linux later) where I do the vast majority of web surfing (I hate
it on phones), and also available on Android, and would like to use as
few as possible, like just one authenticator on all platforms.

Bitwarden is also available as a Firefox add-on, the primary web browser
I use on a Windows desktop and on my Android phone. Firefox Mobile
allows installation of add-ons, but only some that are vetted for
Android. The Firefox Desktop add-on mentions support for 2FA (which
looks to be TOTP). The add-on is free, and if 2FA/TOTP is supported in
the add-on, then I don't need to buy their Premium version that includes
TOTP. I can't think of anywhere I've connected where 2FA is initiated
that wasn't when I was web surfing to a site. Web-centric apps handle
their own connections and authentication. So, Bitwarden as a Firefox
add-on should work for me: free, includes 2FA/TOTP.
But there remains the problem that TOTP doesn't yet seem a standardized
protocol, so Bitwarden might not work everywhere, like at sites that
tell you to use Symantec VIP. Too much is still proprietary. I see a
Symantec Authentication Client Extension add-on for Firefox Desktop, but
it's description leads me to believe you must have their authenticator
app installed, plus it's not a vetted add-on available for Firefox
Mobile, so I can't use that add-on on my Android phone within Firefox.

I'll first try Bitwarden as a Firefox Desktop add-on on my Windows host,
and test if it works with my bank that says to use Symantec VIP. If
not, I'm stuck having to also install Symantec VIP on my Windows host.
On my Android phone, doesn't look like there is a Bitwarden add-on for
Firefox Mobile. Based on the prior successful test on Windows, maybe I
can get by with just the Bitwarden app on my Android phone. If not,
I'll have to install both the Bitwarden and Symantec VIP apps on my
Android phone, and hope having multiple authenticator apps don't
interfere with each other.

[Chris]

Post by Frank Slootweg
[Yet another mixup of 2FA/2SV deleted.]

Post by VanguardLH
I haven't delved much into TOTP, because I've yet to log into any sites
that use it, but it might be more secure than 2FA.
https://en.wikipedia.org/wiki/Time-based_one-time_password
My bank did add TOTP by letting their customers using the Authy app.
Alas, Authy discontinued their desktop (Windows) client leaving only
their mobile apps. Yet I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail. Obviously I can't
get texts on my desktop PC (it has no cellular service), and I'm not
running around the house to find my smartphones to power them up and
wait to get a 2FA code via SMS that I have to manually copy into the 2FA
form in the web browser on my desktop PC. At the server, 2FA codes
expire, so it could take me longer to use a phone with SMS than it took
to use Authy on my desktop where I was trying to login.
There are other TOTP desktop clients, but I don't know which will work
with my bank. They list only a couple TOTP clients, one of which is the
Symantec client that is geared to enterprise users. They don't list
other TOTP clients, like Google or Microsoft Authenticator.

As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

[Frank Slootweg]

[...]

Post by Chris

Post by Frank Slootweg
As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

It's similar in The Netherlands, at least for my banks and other banks
I know of. But SMS and automated call are (AFAIK) not used. Just a
bank-specific hardware TOTP device (uses your bank card as one of the
factors) or TOTP in their apps. I use the TOTP devices, because it's not
much of a bother and more secure.

[Dave Royal]

Post by Frank Slootweg
[...]

Post by Chris

Post by Frank Slootweg
As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

It's similar in The Netherlands, at least for my banks and other banks
I know of. But SMS and automated call are (AFAIK) not used. Just a
bank-specific hardware TOTP device (uses your bank card as one of the
factors) or TOTP in their apps. I use the TOTP devices, because it's not
much of a bother and more secure.

Does this bank-specific TOTP device use your normal bank
credit/debit card (i.e. the one you you make payments or withdraw
cash with) or a specific TOTP card. I have one of the latter -
though the bank doesn't use it for payments requiring
2FA.

Amex has recently taken to asking for 2 digits of my credit card
PIN to authorise some transactions - after years of saying we
should never reveal it.

[Frank Slootweg]

Post by Dave Royal

Post by Frank Slootweg
[...]

Post by Chris

Post by Frank Slootweg
As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

It's similar in The Netherlands, at least for my banks and other banks
I know of. But SMS and automated call are (AFAIK) not used. Just a
bank-specific hardware TOTP device (uses your bank card as one of the
factors) or TOTP in their apps. I use the TOTP devices, because it's not
much of a bother and more secure.

Does this bank-specific TOTP device use your normal bank
credit/debit card (i.e. the one you you make payments or withdraw
cash with) or a specific TOTP card. I have one of the latter -
though the bank doesn't use it for payments requiring
2FA.

It uses my normal bank card. Mostly a debit card, because most 'local'
(in NL (and EU?)) on-line transactions can be done by a debit card,
which - in our country - is a safer card than a credit card. But also
some credit card transactions work with the bank's TOTP device (our
credit cards are issued by our banks).

Post by Dave Royal
Amex has recently taken to asking for 2 digits of my credit card
PIN to authorise some transactions - after years of saying we
should never reveal it.

When I use my credit card in the bank's TOTP device, I need to give
the 4-digit PIN of that card, i.e. the PIN is one factor of 2FA, the
physical card is the other.

[Dave Royal]

Post by Frank Slootweg

Post by Dave Royal

Post by Frank Slootweg
[...]

Post by Chris

Post by Frank Slootweg
As Dave Royal also mentioned, your bank probably mentions/'supports'
one or more TOTP 'apps'/programs, but - assuming they have not
re-invented the wheel - their systems should be standards-compliant and
hence worke with any standards-compliant 'app'/program.

Sadly in the UK that's not the case. They either use SMS, an automated call
or their own TOTP available in their app.

It's similar in The Netherlands, at least for my banks and other banks
I know of. But SMS and automated call are (AFAIK) not used. Just a
bank-specific hardware TOTP device (uses your bank card as one of the
factors) or TOTP in their apps. I use the TOTP devices, because it's not
much of a bother and more secure.

Does this bank-specific TOTP device use your normal bank
credit/debit card (i.e. the one you you make payments or withdraw
cash with) or a specific TOTP card. I have one of the latter -
though the bank doesn't use it for payments requiring
2FA.

It uses my normal bank card. Mostly a debit card, because most 'local'
(in NL (and EU?)) on-line transactions can be done by a debit card,
which - in our country - is a safer card than a credit card. But also
some credit card transactions work with the bank's TOTP device (our
credit cards are issued by our banks).

Post by Dave Royal
Amex has recently taken to asking for 2 digits of my credit card
PIN to authorise some transactions - after years of saying we
should never reveal it.

When I use my credit card in the bank's TOTP device, I need to give
the 4-digit PIN of that card, i.e. the PIN is one factor of 2FA, the
physical card is the other.

That's obviously OK on an offline gadget. It's providing (part of)
the PIN to a website I find dubious - even if that website
purports to be AMEX itself.

I don't know why NatWest in the UK doesn't use it's own credit
card in its own TOTP gadget for 2FA. Perhaps because it uses
Mastercard, whereas AMEX cards are their own.

[kelown]

Post by VanguardLH
I don't do banking on my phone, only on my
desktop PC. So, Authy yanked their desktop client, can't use it anymore
with my bank, so I'm stuck with them sending the 2FA code to my Google
Voice phone number which forwards to me via e-mail.

WinAuth v3.5 works just as well as Authy and uses the same credentials
for TOTP account registrations. It also has an easy to use recovery feature.
https://winauth.github.io/winauth/download.html

Post by VanguardLH
There are other TOTP desktop clients, but I don't know which will work
with my bank.

TOTP desktop client credentials are interchangeable as long as you start
with each account's secret key or QR code, which I'm sure you have saved.

[Chris]

Post by VanguardLH

Post by Chris
However, in this case it's by design not nefarious. The 'F' in. 2FA is
"factor" meaning that you need two different sources of truth. Your
password is one and a known device is the second. VOIP is neither
known nor a device so cannot be trusted as the endpoint could be
almost anything.

Yet 2FA codes are also sent by e-mail. Someone is on your phone using a
web browser, gets the login 2FA interruption, and the 2FA code gets sent
to e-mail which is accessed on the same phone. Yeah, that really
thwarted the 2FA-enabled login ... not! 2FA only makes sense when 2
*different* devices are used for login and to where the 2FA code is
sent.

Incorrect. It needs to be two different factors. Like I said a password is
something you *know* and a phone is a device you *have*. Two, three or more
devices are still one factor.

This is why MFA is a thing as other factors are included now like time
since last log in, location, time of day, etc.

[Jörg Lorenz]

Post by Chris

Post by Newyana2
| WTF? Why is the google voice number not a REAL phone number?
|
As V said, the simple answer is that they want to spy.

Just because you're paranoid doesn't mean they're NOT after you.

+1

Post by Chris
However, in this case it's by design not nefarious. The 'F' in. 2FA is
"factor" meaning that you need two different sources of truth. Your
password is one and a known device is the second. VOIP is neither known nor
a device so cannot be trusted as the endpoint could be almost anything.