Stop Treating Phone Numbers As A Digital ID

To the same audience: quit selling my fucking phone number!

I ditched a phone number I had for 10+ years because it was leaked everywhere. Only a few short months after updating my number with the DMV and a handful of other government agencies I started receiving scam calls/messages again.

At some point we need to adopt some fucking privacy laws. This is absolutely bonkers—is no one else fed up??

Edit: I already know how to silence unknown callers. What I want is to not have the problem in the first place, ideally by 1) having companies not sell personal data to third parties and 2) being able to block spoofed (non-encrypted) caller ID.

This should be what digital ID looks like:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZ26+ARYJKwYBBAHaRw8BAQdAsUGMjbGNUyyz9PHsHKP4xj/tIfYIuHb4miPH 0iCPpu60K0VSUk9SOiBFYXJ0aC5leGUgaGFzIGNyYXNoZWQgPG5vQGVtYWlsLmV4 ZT6IcgQTFggAGgQLCQgHAhUIAhYBAhkBBYJnbr4BAp4BApsDAAoJEI6E3uMn31Z3 028BAM5o8ER0dqTsxFlZSgZOvvgFHGuy2eFgF3rULkGKl1KrAP9fdE7WwnYbBer/ AVmw5jr0P5m/XsEQQrSueuk/FLYBBbg4BGduvgESCisGAQQBl1UBBQEBB0BDR0Bv pf4jxbwp9rVowFTnL59NGqnnh6XyF/LjAoYDGgMBCAeIYQQYFggACQWCZ26+AQKb DAAKCRCOhN7jJ99Wd1dMAP45xmN03SodkWHi7PYOORqNXJUBdMzzfsRXdqE8ZXaW vAD+PqNqPcbwJYCOEAXkg7DlZ0SX3o9MViZLdzHFQ3TpUA8= =krDh -----END PGP PUBLIC KEY BLOCK-----

PGP Key Fingerprint: 857957d40f06cc816fd3d29a8e84dee327df5677

Should be good until quantum computers come around

• Phone numbers
• social security numbers

Stop making personal information into digital ids because when it inevitably ends up in some kind of data breach. These companies all throw their hands up saying sucks to be you.

Bane of my life as about a year ago my dad switched his sim and immediately started pestering me about not being able to log into his accounts.

Yes he got rid of the old number completly and expected me to somehow make his logins work. This is still going on to this day when he complains to me something doesn't work it's because he's tied it to his old phone number.

It is the same thing that happened with US Social Security Numbers, which were originally just tracking numbers for that one purpose that were coopted by capitalists and treated like something special.

Please. It is the most annoying part of trying to use some sites and I rather not give out my number to people who store important info in plain text files.

I'm in a quest to find a good email provider that doesn't ask for a cellphone or another email address while creating an account, cock.li used to do this but now it's "getting back on its feet"

I don't want to treat phone numbers as an ID, but for some reason my customers will give their phone number to me online far more willingly than they'll cough up their email address, which is baffling only until you realize:

• Most people are technologically incompetent and are intimidated by the avalanche of crap they get in their email, and
• They never answer their phones anyway, so who cares?

I actually offer the option, because I don't give a rat's ass how people ignore me when I try to contact them. But when they place an order I at least need to be able to prove that I tried.

I've been considering getting a pager or a burner phone just for this

Are Internet security and Internet privacy incompatible goals?

They are if the security is tied to knowing that an account is a person.

Internet security and internet privacy are only incompatible goals when combined with incompetency and shit user-exerience design.

Are internet security and internet privacy incompatible goals?

Yes. They are completely incompatible goals when anything relating to identity/being is linked to it. Examples of this could be anything from your name, to your behavioral patterns, to your phone number

Disregarding the entire possibility that ANY site is hack-able/breach-able, the issue stands that the reasons that most sites request PII is valid, for security reasons. There does not exist any valid method of ensuring users identity that does not violate users privacy. CAPTCHAS are proven inefficient, email domains are easy as a 1-2 click. Once the setup is done server side changing to a new address is as easy as changing your server settings and registering a new domain, then just pointing your MX records there. Heck depending on your postfix setup you might not even have to change server settings, if your account lookup is setup to ignore the domain and it all uses the same database. Even phone numbers have proven troublesome but its the least troublesome method available

The entire reason PII style setups are used, is because its an easy verification site side, but a hard to spoof verification customer side. Like the article says, phone numbers are hard to change for verification, many only let you change so many times in X period, and usually require some form of physical identity to register, and the ones who don't are forced such as VOIP style numbers get blocked.

We lack currently a good system aside from that, because at the end of the day, how do you prove you are who you say you are, without disclosing your identity. I personally think it should be fine to give up some PII for security purposes, but this NEEDS to be restricted only to security and should never be shared with any entity, and this includes government overreach. Alas this will never happen.

On this question of verification, I don’t have a particularly foolproof solution, but maybe there just isn’t one.

I can criticize the modern web for a lot of things, but as long as we have situations where we want to check whether an account is a real person, as opposed to FarmingBot #295038, they need something. I'm not a fan of phone verification, but I'd only criticize it when we have alternatives.

I'd even be in favor of some kind of one-way algorithm by which a trusted real-person-identifying entity could tell a random third party site: Yes, this is a genuine human.

I absolutely love this.

It's not an accident. They're not stupid. It is intentional. They want your personal information. Most of your personal information is tied to your email but it's easy enough to spin up an alias to sign in with. Requiring a phone number ensures that they know exactly who you are and can buy/sell/use your data accordingly. They also know what a giant pain in the dick it is to change your phone number, especially when you need it for these security checks. They also know sales conversion rates are much higher if they can get you on the phone. So yeah, they're not going to stop doing that.

I have absolutely no need for my phone number, nor do I use it for anything that I couldn't use a voice app for. Just get rid of them altogether.

Emails can be simple - mine is $firstName@$lastName.me Tbh phone numbers are quite long and if people can't remember 4 digital pin... Still you can generate qr code mailto: links