1

More and more I've been seeing online services that want to verify my identity using an automated phone call or text message. The trouble is - they ask me to provide the phone number! It seems the only thing they've verified is that I own a phone. I suspect a skilled attacked could even use a "burner" phone or virtual number of some kind to make the verification anonymous.

I've also considered this might be a new type of CAPTCHA, but considering how easily a computer could parse the data, that seems unlikely.

Does the verification process actually add any value from a security standpoint?

EDIT: This is not just during sign up, it's used to verify existing accounts as well. See sample screenshot from G Suite (Google Apps for Bussiness). I signed into an account that does not have 2FA enabled from a computer I do not normally use to sign into the account. After entering my cell number, I got a verification text and was able to get in the account.

Phone Verification Screenshot

2

Does the verification process actually add any value from a security standpoint?

It is an anti-spam system. Here's how it works.

Each phone number can be used to re-activate accounts a small number of times before it won't be accepted anymore, and each Gmail account can send to a limited number of recipients every day.

Because most people don't buy things from spammers, they need to work with lots of accounts in order to send enough email to make money. If we think an account might be being used by a spammer, we lock it until the owner provides a phone number. So, spammers need to have access to a large number of phone numbers to unlock all their accounts. This is very expensive for them but pretty easy for most regular people. In most cases it is expensive enough for the spammer that it becomes unprofitable for them to spam, so they give up.

source:-https://productforums.google.com/forum/#!topic/gmail/r_EfrI4BQU8

  • This might be what I saw on google, but I'm not convinced it is. I've seen no evidence that my account was used for spam and I got no warning from google (other than the phone verification) that I need to change my password! – just.another.programmer Dec 10 '17 at 11:50
  • Also - this doesn't explain why I've seen similar systems on other non google sites! – just.another.programmer Dec 10 '17 at 11:50
  • @just.another.programmer - What other systems? If this is public WiFi, it's so they can trace abuse at least to a phone number. – paj28 Dec 10 '17 at 13:49
  • @paj28 I've seen it at two different credit card online account systems and a couple of local government sites. – just.another.programmer Dec 10 '17 at 17:44
  • @just.another.programmer - and they let you enter any number? You have a very different online experience to me. I'm not sure if this is country specific (I'm UK) or what. – paj28 Dec 12 '17 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.