<story><title>Phone Numbers Were Never Meant as ID. Now We’re All at Risk</title><url>https://www.wired.com/story/phone-numbers-indentification-authentication/</url></story><parent_chain></parent_chain><comment><author>wtmt</author><text>&amp;gt; But the United States doesn&amp;#x27;t offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise.&lt;p&gt;Oh, please! No! No! No! India bulldozed a national identification number (called Aadhaar) on its residents and it has made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement. As with things related to government, the governing organization for Aadhaar, called UIDAI, always claims that it’s completely secure, while ignoring the fact that linking one number to everything in one’s life increases the attack surface and the severity of the threats.&lt;p&gt;So please research on the number of ways Aadhaar has failed, and is making some feeble attempts to recover, before getting into a “let’s create a new static number to identify people with instead of a phone number or SSN”. That’d just be changing the narrative without achieving anything.&lt;p&gt;Bottom line, it’s not the phone number that’s the problem, but having a unique and non-changing number and linking it to everything else (including one’s phone numbers).</text></comment>
<story><title>Phone Numbers Were Never Meant as ID. Now We’re All at Risk</title><url>https://www.wired.com/story/phone-numbers-indentification-authentication/</url></story><parent_chain></parent_chain><comment><author>simmons</author><text>Bootstrapping identity is a very hard problem, and implementors can&amp;#x27;t resist the easy path of piggy-backing on someone else&amp;#x27;s identity or authentication system -- social security numbers, email addresses, telephone numbers, etc.&lt;p&gt;AT&amp;amp;T is being sued by someone who lost $24M in cryptocurrency because someone decided to piggy-back authentication on AT&amp;amp;T.  While AT&amp;amp;T should certainly be called out for having sloppy security, I can&amp;#x27;t help but feel that they never really signed up for the job of protecting such a valuable asset.  It&amp;#x27;s like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open.</text></comment>