[buildbuildbuild]

Beware the edge case: I responded STOP to a message years ago, then was unable to receive SMS from a popular money transmission app during the signup flow to claim funds that a friend sent me.

After over a month of troubleshooting, it turns out that I had sent "STOP" to that number years ago on a different device (no longer visible in chat history) and now had to send "UNSTOP" in order to receive the phone verification SMS required to sign up for the service. It was a shared number between multiple apps.

[JaggedJax]

This happened to me with a major bank. They were using the same number for 2FA and some other types of texts. I got locked out of my account for a while because I had unsubscribed from their marketing texts. What an unbelievably dumb way to send 2FA codes.

[thebytefairy]

Had a similar thing happen to me, but for Facebook. Account got locked, to unlock I needed to verify identity via text. Never received the text because I had disabled getting text fb notifications, which apparently included account recovery. Managed to find this on some obscure thread to text some number to resubscribe and get it to work - no mechanism from fb, no alternate way to verify, no indication that this was the issue.

[grotorea]

I think something similar happened to me, but I used the phone's block and report feature. I assume it was the number of some SMS sending service that had both legitimate and spam clients.

[hypeatei]

Yet another reason why SMS 2FA should not be used. Shameful.

[zahlman]

It's used, as far as I can tell, because banks don't want to have to explain to millions of customers how to use anything else.

[reginald78]

Also because once they get that number under the guise of needing it for security they can use it for marketing texts. It's a win win!

[hypeatei]

It's perfectly fine if people want to use it, but at least provide the option for TOTP or hardware keys behind a big scary warning page or something.

[jpadkins]

What is a better 2FA channel?

[AndrejPanjkov]

an authentication app like google authenticator. there are others as well. https://en.wikipedia.org/wiki/Comparison_of_OTP_applications

No communication occurs to serve your 2fa code - it's a time based 2fa protocol.

[Onavo]

Passkeys or WebAuthn, TOTP based 2FA (regardless of whether it's hardware or software based) is vulnerable to phishing. Protocols like WebAuthn are tied to the domain and is a lot trickier to compromise (at least not without significant effort).

A lot of people here are complacent when it comes to phishing because they believe "I am a big overpaid technical person on Hackers News, I am not dumb enough to fall for suspicious links unlike those dumb unwashed masses" but as most security people know, the sort of mass phishing attempts your grandma receives are relatively low effort compared to actual targeted spear phishing. A dedicated phishing attempt won't have broken English, CSS styling issues, weird punycode etc. It would be practically indistinguishable from the real thing unless you were specifically looking for it.

[_whiteCaps_]

An authenticator app or hardware MFA device.

[lelandbatey]

TOTP (thing that generates the 6 numbers every 30 seconds) whether that's a dedicated device (secure but very annoying) or a TOTP app on your phone (what most people use).

[caseyohara]

Password managers like 1Password also support TOTP, it doesn't have to be an app on your phone.

[joveian]

I at least have a different user account that only does TOTP but it isn't really a second factor if it is on the same device (since the idea is to make getting access to the code significantly more difficult than just getting access to the password).

I like this simple TOTP code generator:

https://github.com/arachsys/totp

[pwenzel]

TTOP via password manager

[tmikus]

Ideally use a dedicated hardware key, but if you can’t just use a 2fa app

[weberer]

Any dedicated MFA app, such as Authy.

[AndrejPanjkov]

I just saw on https://en.wikipedia.org/wiki/Comparison_of_OTP_applications that Authy is discontinued as of March 2024?

[mixedump]

Authy desktop apps are discontinued, the mobile apps are up and running.

[sim7c00]

I find it such a weird thing, maybe it's nice in some cases, but really this is a weird mechanism.

Phone numbers are exchanged a lot and repurposed. Most providers/carriers will likely have a do-not-use-for-x-amount-of-time bin to put newly reclaimed numbers in, but after a while, it will always be re-used. hence this kind of issue can happen.

In my country there's a place to register to disallow unsolicited marketing and other types of messaging. That's not by number you 'STOP' and hence it won't have such effects. A marketeer/sales company is simply not allowed by law to dial your number for sales/marketing, so they have auto-lookups to that registry to prevent breaching the law. translated, it's the 'do-not-call-me-registry' :D aptly named.

it won't stop phishing messages etc., but not much will. if you'd block it from 1 number, they will just use the next number..

[no_op]

The US has a 'Do Not Call' registry for unsolicited phone calls, but technically doesn't need one for texts because it's illegal to send marketing texts without prior consent in the first place. Thing is, 'consent' often just means failing to notice a checkbox during a signup flow or something, so people end up getting junk anyway.

Even more annoyingly, politicians wrote in an exception for themselves. In combination with the way campaign finance works in the US, this means that if you've ever give your number to any political campaign, it will be passed around forever and you'll have multiple politicians begging you for money for months leading up to every election. Each individual campaign/organization seems to respect 'STOP,' but once your number is on an e.g. 'Has ever donated to a Democratic candidate' list, there's seemingly no way to get it off for good. Thanks, Obama. (I gave him $50 in 2008.)

[chias]

> technically doesn't need one for texts because it's illegal to send marketing texts

It is unfortunately seemingly not illegal to send me political beg-texts multiple times per day, though.

[JohnFen]

The law specifically exempts such texts from being covered, sadly.

[nilamo]

Proof laws don't work.

[bigstrat2003]

Well... proof that we can't trust politicians to pass laws that are good for us but bad for them, at any rate.

[JohnFen]

No, it's proof that lawmakers are willing to put exemptions into the law when it benefits them. That's bad, but it doesn't mean laws don't work.

If anything, it indicates the opposite. If laws didn't work, then lawmakers wouldn't have to bother to put exemptions in them.

[iamthepieman]

Even worse if someone else signs up somehow using your contact info. I got signed up (via email thankfully) for a political party in another country and no amount of "mark as spam", unsubscribe or replying would get me off the list. Eventually I just had to create a filter that dumps those messages in the trash.

It must be something with non-U.S. English speaking countries because I get numerous semi-spam messages in email and text for services in Australia and the U.K. casinos with account numbers or PINs, two step notifications for national car registries, banking, contractors asking about work or sending invoices. Maybe it's just English speaking countries have a lot of people named "iamthepieman"

[ChuckMcM]

My wife had someone do sign up for a bank account with my wife's gmail address. She told the bank they got it wrong, and they went away for a bit and then they re-signed up AGAIN. So she told the bank to close the account. It didn't re-occur after that.

A number of elderly folks have had this issue as well. I'm really at a loss on how to fix it, some times there are bad actors but generally it seems folks are clueless and the signup flow doesn't adequately account for this.

[Spooky23]

I have a common-ish first initial, last name Gmail account. The number of people who think they have my address is staggering. Hundreds over the years.

In one case, the manager of a large factory was forwarding me an email with remote access credentials and VPN software every month.

[nraynaud]

I had that happen, but I couldn’t fix it because I couldn’t prove I was a customer, since I wasn’t.

[giancarlostoro]

Is the email in question something along the lines of firstnamelastname at gmail? I'm guessing your email address is a really common name that someone else keeps forgetting how their email actually deviates, or someone typos writing theirs.

[bigstrat2003]

Another possible scenario is that Gmail is getting wires crossed. I have had the account [e-mail] for 20 years now. About 5 years ago, some dude in Australia (who coincidentally has the same rare last name as me) started using [e-mail]. Based on the emails I've seen I believe that Gmail let him do this for a while, but eventually started delivering his emails into my inbox. I don't know if there was a technical change in Gmail for how they handled these addresses or what, but it's very odd.

[dfxm12]

[e-mail] and [e-mail] are the same address, according to gmail documentation. If this is what is actually happening (and there isn't a subtle typo, etc.), then something is more wrong than "wires crossed" & you should report it as a security vulnerability.

https://support.google.com/mail/answer/7436150?hl=en#:~:text...

https://www.google.com/appserve/security-bugs/m2/new

[Scoundreller]

Some times I get genuine ones (like a hotel reservation) for someone somewhere that’s also confused about their name.

I’d be happy to help but half the time it’s from a No-Reply email address and that shuts the door on as much effort as I’m willing to supply.

[toast0]

> this means that if you've ever give your number to any political campaign

This is campaign finance reform in action. Giving money is not worth it, because you'll be hassled. Gets the peoples' money out of politics. QED.

[skrtskrt]

I still get 5-10 texts a day from trumpy candidates because someone used my number like 5 years ago when they were spamming signups for trump rallies so the rally would be empty

[Suppafly]

>this means that if you've ever give your number to any political campaign, it will be passed around forever and you'll have multiple politicians begging you for money for months leading up to every election

They really should learn to not do that, my carrier routes most of those to spam already and the few that it doesn't, I mark as spam, so presumably they'll start getting routed to spam for other people with the same carrier.

[meowster]

What's worse is if someone accidentally uses your phone number when they sign up for something, then you're on the list and never able to get off of it.

[chiefalchemist]

If only we had the mobile numbers of numerous politicians. We could make a small donation to their opposing party and add a phone number from that last.

[pixelatedindex]

Just wanted to say that I find it curious that you have to text “UNSTOP” and not something like “START”, lol

[gwd]

So a "stopper" can also mean a plug (i.e., something you shove into the neck of a bottle or a pipe to stop things coming out). "Stop" can also then be a verb which means, "put a stopper into"; and "unstop" can mean "remove the stopper from".

Since (it sounds like) this is talking about blocking and unblocking the flow of messages from that number, using "UNSTOP" (remove the thing blocking it) makes more sense than "START"; particularly as the latter seems to imply that you're asking to immediately begin receiving messages, whereas the former simply means to no longer block the messages.

[sim7c00]

it's because of ungood design

[Tagbert]

double plus ungood!

[jaxn]

START works as well. At least for numbers provided by twilio: https://help.twilio.com/articles/223134027-Twilio-support-fo...

[dspillett]

There probably is a START instruction internally, but it won't take action against a number for which there has been a previous STOP. So UNSTOP acts like FORCE START.

[pixelatedindex]

But then you can have… RESTART?

[dspillett]

If the process is releasing a STOP (removing or soft-deleting a STOP instruction logged in the DB or some such) then whoever worked on it initially may just have not thought beyond that (especially if English wasn't their first language so unstop might not have sounded any stranger to them than restart). Once something like that is written down and others have seen it, it tends to stick.

Of course it could hav ebeen done by someone like me, who is know to give things technically-correct-but-odd names deliberately…

[lvkv]

Unfortunately, the world is opt-out, not opt-in.

[Scoundreller]

Unless you need a kidney; then we just bury perfectly good ones regularly, and let the donated ones get a bit more stale while we confirm the opt-in eleventy times.

[BobaFloutist]

It's because of the US Constitution and voters' very firm, consistent, coherent stance on bodily autonomy. Even if we consider it to be costing a life, your say over your body is considered absolute, and no federal, state, or local government is allowed to pass legislation that influences what happens to your body.

Just kidding! It's all determined on a case-by-case basis depending on the most conservative perspective of the dominant, favored religion.

[sib]

For commercial texting in the US, it is supposed to be opt-in.

Of course, there are unscrupulous parties who don't respect this.

[elfrinjo]

Probably a Cisco engineer who built that

[MaxMatti]

Wouldn't that also apply if you blocked the number?

[mway]

That only works if the marketing campaign exclusively uses the number you're blocking. In some cases - for example, political SMS in the US - it turns into whack-a-mole unless you unsubscribe properly.

[aendruk]

Yep, US political spam is unblockable. I receive “wait, you’re a Republican, this can’t be right‽” style SMS messages from 10–20 unique phone numbers every day. The FCC’s spam complaint form only accepts one sender number per submission so I’m about 1,300 complaints in so far.

[falcor84]

Unblocking might be faster, as it's something you only need to do on your end

[aendruk]

I’ve encountered a couple instances of businesses that 1) send me unsolicited marketing mail, 2) react to that being flagged as spam by internally blocklisting me, then 3) silently fail to send transactional mail such as password resets.

[Mattwmaster58]

A similar thing happened to me with my Amazon account with a forgotten password. I ended up just creating a new account.