Stop Treating Phone Numbers As A Digital ID

Oh everyone is fed up but we just elected a guy and government who is sure to make it all way way way worse.

He just helped put the nail in the coffin of the lie that crypto is for anything but scams, don't worry, it's gonna get real bad before it gets any better.

I'm pretty sure a lot of scam calls use machines that call every possible phone number within an area code and see who answers. There is no way to avoid it.

lists sourced from drivers licenses and motor vehicle registration records are literally sold by some states.

quit selling demanding my fucking phone number!

FTFY

Australia has a "do not call register". It seems to mostly work, but telcos are having trouble with calls originating from outside the network with spoofed caller ID. We still get spam/scam calls from India among other places.

Even if they're not calling you directly, they are still using your phone number to link you to things and create a shadow profile behind the scenes.

Don't worry, here in Europe we are full of privacy laws but I still receive tents of spam calls per day. Usually from non UE countries faking the number with my country numbers.

At some point we need to adopt some fucking privacy laws.

Yeah we absolutely had to ban TilTok because of privacy concerns but the idea of creating a law to protect our privacy is ridiculous beyond all reasoning. The stupidity of the United States government is absolute.

I set my phone to decline calls from unknown callers years ago.

These calls are already illegal. I used to report them to the FTC but I never heard anything back so I have no idea what happens, but I presume nothing. If I had the time to take them, and if they spoke English, I would record them with the Cube ACR app (which no longer works) and convince them to incriminate themselves. Ask their name, company, location, time/date, whether they ran my number through the DNC registry.

At some point we need to adopt some fucking privacy laws. This is absolutely bonkers—is no one else fed up??

Look at you, trying to use the government to solve every day problems that face pretty much all of us.

Don't you know we only focus on gridlock issues to distract us from real issues now?

I have an app called Silence that lets me block calls from numbets not in my addreasbook. Highly recommended

https://github.com/x13a/Silence

Reminder: Dont blindly trust random internet sources!

I'm confused of how this keeps happening to people.

Like I use my phone on most sites that allow it and I've never had spam/scam calls really, but I've also explicitly unchecked the marketing boxes that appear on the signup so maybe that it.

The last instance that actually happened to me was with entering my university a few years ago for my BS degree. They 1000% sold my contact information as some part of the deans/honors list process. I reached out to them and stopped that so fast.

I'm sad PGP didn't become a popular way to log into websites. A challenge-response protocol could have even been built into web browsers. Big tech is reinventing that idea as Passkey, but with a very big tech flavor.

Now type it a form that doesn’t allow copy and paste.

Thanks, gonna need your phone number to verify that though.

I want to preface this response saying I full agree with this, I want something like this to happen, I am responding because of some concerns I have. The real major one: How do you verify the authentication part of the data security chain?

A PGP key alone does not authentically validate that you are who you say you are. When the source is the untrusted party, it doesn't accomplish the site's goal. It's the equivalent to me handing you a piece of paper saying "I'm John Smith and this is what I use to say I'm this" which works amazing for trusted exchanges, but when the source is "just trust me bro" it doesn't solve anything for the website owner.

Websites get around this by having trust certificates/root servers that are co-signed with the PGP key. However, we lack any system like that for personal identities. Arguably, setting up such a system would isolate most of the known internet, as it is a significant roadblock, much like how SSL certificate usage was a huge roadblock for sites before Let's Encrypt became a thing.

This setup would be amazing for logging into sites. However, it fails to accomplish what the websites that are asking for PII are looking for, which is verification that their user is who they say they are, and not a random third party.

To reliably use this setup, we would need something similar to Let's Encrypt, but for user identification. The issue with that is it would become the de-facto attack vector (for both law enforcement and criminal parties), and that site would need to require PII to address the biggest concern on these sites, which is that you are who you say you are, and not Jo Smo or a bot looking to harvest data. Additionally, as mentioned earlier, a massive retraining of the internet would need to be done, which would mostly affect non-tech folk.

I am hopeful that an easy function that won't violate users privacy comes out, but I don't think the two topics are compatible sadly

Nah, there are more than enough algorithms available that won't work on quantum computers, I'm not too worried about that

 undefined

    
-----BEGIN PGP MESSAGE-----

hF4D7cLqolaUp8cSAQdAOCdAgwhjdDgwk6TsYbey9XLZrKT7ny+KRAORyTPJsmUw
Fl1llKK3dYtwrPDUts8CA71uU8D2SOWwrk/mrQxlrP/btjNNj6j1vXehQJ0+FIuc
0sBPAU3onDQoAiPLDU7qky1cgtbgitMp4nGEnZ48Xh8OhWS03d9YfU4iIIuf/AWA
MTzzbMLZCLqZrIiJGyE2EgJOLIMAOToxidQ6Z/blrT6W9effeu4GwEB622O0eIv5
ct0jm/e2A6j1Gf/7UsnzeC21ME55/JkDIFQQ5ZrYqRGp9+M0yNHXIhJXQvO+QmHz
1CclNIdwbnupIIy0+eiy+Wn41An/IUV2NJy+bmCxRmqTXZyNrfnPMrelY5imknd9
1oZGuHc6tWqNq0ntjV1sBBsxHtAXtFIBWcqEmUgnpxEBglRxx20thoWvQINisCB4
9ptHAUM9Qjr3tWFdvL5MqOHZ14XQ65bbKXhx5MJmr5yijA==
=JKT0
-----END PGP MESSAGE-----


  

No one except this guy will be able to read this. Die out of curiosity muhahahaha

Nah, man. Gotta get my $2.97 check.

Yeah, just generate a unique ID and ask only for the information you actually need.

What I hate is when they want you to store "secret" information like your mother's maiden name/ first pet name for later verifications. You know these are stored in plain text of course. My own damn government does this stupid shit, and they've had several hacks of PII including gun registrations because as far as I can tell, nobody competent works in government IT.

I remember I was flipping through some of my mom's old college stuff and there was a club that she was involved with and everyone listed their address and social security numbers. It was wild, no idea why they felt the need to collect socials. But this was a very long time ago.

It's not just "capitalists" (whatever that means), every government agency seems to want it, employers and banks are required to ask for it, etc. It's more than just "some people misused it," we actually wrote it into regulations.

Yes. Don't forget your phone number will be exposed to the public when the business gets hacked.

Not if. When.

Just signed up for Tuta and they do not ask for this.

Proton?

There used to be a way to make Google accounts with no number but that's probably been patched. I generally refuse to add numbers if I can help it.

Proton, Mailbox & fastmail are all good options. Best way to avoid it is self-hosting but that is beyond most people (as in time-consuming).

posteo.de

Personally I use mailbox.org, it's not free, but you are not the product

Proton does this.

Selfhosted email I guess.

create 2 proton mail account und use each other as a backup e-mail

Ionos enabled me to do that.
But I chose not to.

which is baffling only until you realize

I stopped being baffled when I realized most people are dumb as shit.

It's just a fact of life, and we either see it or we don't.

Yo sign me up 867-5309

When I give out my email, I always get spam, regardless of how many boxes I uncheck.

When I give out my phone number, sometimes I don’t

Of course that no longer makes sense since I have one phone number I can’t easily change, but give out uniquely generated emails that I can individually turn off

Most phones are dual Sim these days

Just get a virtual DID number from something like Voip.ms or virtualphone. There may be other providers out there that use crypto for payment for added privacy, but if all you want to do is be able to keep your real phone # off the grid, these work.

Can pagers receive text messages? I thought they are closed ecosystems, basically?

You mean the Veritasuim video with linus in it?

Source

The technology has existed since the 80s.

X509 certificates would allow a government agency to sign a digital identity indicating that it's legitimate, would allow for remote revocation in the event of loss or theft, and can be easily integrated with every existing computer and browser.

An issued physical card would resemble a credit card, with a chip in it. Other physical form factors can take the shape of USB-devices which bundle the card and the reader into a single device.

https://www.oesterreich.gv.at/en/id-austria.html

That exists and is better than a phone number.

This assumes a legitimate need to prove who you are outside the context of that specific site, rather than just within it. Sometimes that need is real, sometimes it is not.

When it's not, and you only need to prove you are the same person who created the account, then a simple username and password is sufficient. Use 2FA (via authenticator app or key, NOT via SMS or email) on top of that. This allows users to prove to a sufficient degree that they are the owner of that account.

This is how most Lemmy instances work, for example. I can sign up by creating a username and password, with optional 2FA. They do not need my email. They do not need my phone number. They do not need my name, or my contacts, or anything else that is not related to my identity within their server.

I realize that this is untenable at large scales for any communications platform. Spam (and worse) is a problem wherever there are easy and anonymous signups. I'm honestly not sure how Lemmy is as clean as it is. I guess it's just not popular enough to attract spammers.

Yeah I mean I'd get rid of that and email entirely if I could but unfortunately there are legal and societal expectations.

Technology exists to keep all your personal data exceptionally secure. Modern encryption is incredibly difficult to break (impossible really).

Humans are fundamentally insecure. Any time you read about a data leak, it's because somebody stupidly opened an attachment or fell for a scam. Any time someone gets "hacked," they didn't. They gave away their information. Human error and a lack of education are the problems.