Solved MS asking for cell phone number

bobkn · Aug 24, 2021

I dunno. I guess I've gotten so accustomed to using my cell phone for 2FA that I barely think about it any more.

I believe that I got my first junk call on the cell in less than a day after I got the number. I don't know how such calls are generated, but I hadn't given the number to anyone in the world at that point.

I like the approach Fidelity uses. When I need a 2FA code, I can get it by text or by a voice call. To my cell or land line. (The land line doesn't support text.)

Haydon · Aug 25, 2021

bobkn said:
I dunno. I guess I've gotten so accustomed to using my cell phone for 2FA that I barely think about it any more.

I believe that I got my first junk call on the cell in less than a day after I got the number. I don't know how such calls are generated, but I hadn't given the number to anyone in the world at that point.

I like the approach Fidelity uses. When I need a 2FA code, I can get it by text or by a voice call. To my cell or land line. (The land line doesn't support text.)

I am similar, although I put some 'need to know' limits to a few institutions like Microsoft, Google, bank, etc.

pparks1 · Aug 25, 2021

bobkn said:
I dunno. I guess I've gotten so accustomed to using my cell phone for 2FA that I barely think about it any more.

I believe that I got my first junk call on the cell in less than a day after I got the number. I don't know how such calls are generated, but I hadn't given the number to anyone in the world at that point.

I like the approach Fidelity uses. When I need a 2FA code, I can get it by text or by a voice call. To my cell or land line. (The land line doesn't support text.)

I'm sure the spammers just have robodial systems that call every number in the entire block. So, if you number is 517-845-0101. The probably dial 845-0100 and 845-0102, and 845-0103, so on and so forth.

Haydon · Aug 25, 2021

I signed up for an on-line lottery account. Sofar, no problem, because the winnings are so small that they are paid directly into the deposit account that I have with them. The lottery tickets are conveniently paid via the deposit account, and since over time the winnings are (of course) less than what the tickets costs, I have to replenish the deposit accout every now and then. That's cheap entertainment for me.

But what if I win $1M? They won't pay $1M directly into the deposit account, but will require further verification. Will my logon verification, the nearly empty user profile, and the payment method that I use to replenish the deposit account, be sufficient to prove that I am the winner? I hope so, but I don't really know, I never won $1M

The above may appear entertaining, but the more serious point is, even if you have nothing to hide, there are moments in life when it may not be a good idea to hide yourself. Unfortunately, and fortunately at the same time, the Internet has become part of our lives > be happy

and wary

at the same time, be very happy

and very wary

at the same time. The Internet has amplified just about everything in our lives, no running away from it.

BunnyJ · Aug 25, 2021

Haydon said:
I signed up for an on-line lottery account. Sofar, no problem, because the winnings are so small that they are paid directly into the deposit account that I have with them. The lottery tickets are conveniently paid via the deposit account, and since over time the winnings are (of course) less than what the tickets costs, I have to replenish the deposit accout every now and then. That's cheap entertainment for me.

But what if I win $1M? They won't pay $1M directly into the deposit account, but will require further verification. Will my logon verification, the nearly empty user profile, and the payment method that I use to replenish the deposit account, be sufficient to prove that I am the winner? I hope so, but I don't really know, I never won $1M

The above may appear entertaining, but the more serious point is, even if you have nothing to hide, there are moments in life when it may not be a good idea to hide yourself. Unfortunately, and fortunately at the same time, the Internet has become part of our lives > be happy and wary at the same time, be very happy and very wary at the same time. The Internet has amplified just about everything in our lives, no running away from it.

It's not about hiding something. It's unnecessary to have my or anyone's phone number. What I did was to set up a Google voice account so I could get a text sent to me without using my real cell number.

I don't buy the 'if you have nothing to hide' line. We are still allowed to have some sort of privacy.

Winuser · Aug 25, 2021

BunnyJ said:
It's not about hiding something. It's unnecessary to have my or anyone's phone number. What I did was to set up a Google voice account so I could get a text sent to me without using my real cell number.

I don't buy the 'if you have nothing to hide' line. We are still allowed to have some sort of privacy.

I don't remember if I ever gave MS my cell number. When I need a code sent to me, they send it to my email.

Dru2 · Aug 25, 2021

BunnyJ said:
It's not about hiding something. It's unnecessary to have my or anyone's phone number. What I did was to set up a Google voice account so I could get a text sent to me without using my real cell number.

I don't buy the 'if you have nothing to hide' line. We are still allowed to have some sort of privacy.

I think there's a kind of irrationality going on here that I find kind of amusing - People use the internet, Google, social media, provide credit card, phone number, and email addresses all over the place online, yet scream "privacy concerns" when they're legitimately asked to provide some information that might actually protect them from themselves.

Why??? Because everyone needs a boogeyman to feed some hypercritical behavior - voluntarily post their info all over the place, yet cry privacy concerns when they come across something they don't like or understand - even though the info requested is far more secure than some of the places they've already given the info to.

Two-Factor authentication is there for "your" protection. It alerts you if someone is trying to access "your" private accounts. Why in the world would would want to provide false, or less convenient ways to validate that the person trying to access "your" account is "actually you"??? :scream:

Anyway, I'm not here to convince anyone of anything - the choice is yours. But as I've taught my kids... no matter what you do in life there's a cost. You just have figure out if the cost is worth the action(s)?

And yes, I use two-factor authentication.

Good luck.

flashh4 · Aug 25, 2021

It's called freedom of choice and i choose not to give out certain information ! All my other accounts have 3 different email addresses none have my cell# and they are fine with that & have never asked again for my cell #, so why isn't that good enough for MS .... it should be !! !!

bobkn · Aug 25, 2021

Dru2 said:
I think there's a kind of irrationality going on here that I find kind of amusing - People use the internet, Google, social media, provide credit card, phone number, and email addresses all over the place online, yet scream "privacy concerns" when they're legitimately asked to provide some information that might actually protect them from themselves.

(snip)

A bit harsh. But cogent.

Haydon · Aug 25, 2021

Dru2 said:
... yet scream "privacy concerns" when they're legitimately asked to provide some information that might actually protect them from themselves.

Yeah, and that's on top of the fact that you leave a VERY BIG footprint on the Internet.

For example, Microsoft knows a hell of a lot more about your computer and how you use your computer than you yourself do. So, Microsoft is in a much better position to protect your computer and your use of your computer than you yourself are.

Similarly, Google knows a hell of a lot more about your use of Google than you yourself do. Although I personally am not sure that I can trust Google as much as Microsoft > I tell Google less than Microsoft.

And I tell Facebook even less. In the olden days, I even told Facebook my birthday was February 30, now Facebook doesn't allow it anymore LOL. OTOH, I couldn't care less if I lose my Facebook account.

I guess in real life it's called different messages for different audiences :) You even practiced that with your own kids all along when they were growing up :)

Haydon · Aug 25, 2021

BunnyJ said:
It's not about hiding something. It's unnecessary to have my or anyone's phone number. What I did was to set up a Google voice account so I could get a text sent to me without using my real cell number.

I don't buy the 'if you have nothing to hide' line. We are still allowed to have some sort of privacy.

You seem to take postings personally, that's not the case. On top of that you missed the point in this case. I did NOT make a 'if you have nothing to hide' point. The point of my metaphor is about losing something which can be access to your account or data in your account or whatever.

Nothing against personal choice :)

Dru2 · Aug 25, 2021

flashh4 said:
It's called freedom of choice and i choose not to give out certain information ! All my other accounts have 3 different email addresses none have my cell# and they are fine with that & have never asked again for my cell #, so why isn't that good enough for MS .... it should be !! !!

You prove my point.... you had a choice and made it.

And yes, privacy should always be number one, but I use this analogy... if you're going to play in the water you're going to get wet :wink:

badrobot · Aug 25, 2021

It is not like your credit card will get charged or MS is going to call you. It is a very convenient way to verify your account. It made the process so easy when I recently had my MS account locked because I was building a PC and there was multiple activation activities. MS is only gonna use it to send you an OTP for verification.

Dru2 · Aug 25, 2021

This reason why you "want" to give them your phone number is because that's the device you have on your all the time. I would hope someone notified me someone not me was trying to access my account. I don't want to hear about it three weeks later on some phone I don't use :scream:

Haydon · Aug 26, 2021

johnlgalt said:
Now, if you don't have my key, you ain't logging in -

How many copies of the key do you have?

badrobot · Aug 26, 2021

Freedom vs Covenience, I'd choose convenience. Same reason I shop online and give away my credit card info.

There is a reason there is a feature called "Caller ID". If you don't recognize the number, either ignore it, or block it.

johnlgalt · Aug 26, 2021

Haydon said:
How many copies of the key do you have?

I have 2 sets (total of 4, 2x USB A and 2x Bluetooth), one (complete set) of which is in a bank safety deposit box and the Bluetooth is in my personal safe at home. I use the USB A one, because most of my accounts I can also supply TOTPs through my KeePass database.

Mind you, though, these are not 'copies' - each key is a separate physical key in its own right, completely independent of the others. All of my important G-Suite accounts have all 4 keys registered, and my important personal Google accounts that are not throwaway accounts do as well.

I don't like it much when a site only offers a single method for 2FA. But I've also been using my Google Voice number for years (one of the early true βeta testers), and that is the number I use for all SMS verification methods for 2FA.

Well, except for Discord - as they don't accept Google Voice. There might be one or two other sites / services that also don't accept GV, I forget. I'd have to check KeePass.

As for the Solo v2, I'm getting one locked and one 'Hacker' edition (unlocked) which I'll use with my DiceKeys to make my own random set generator for the hacker one. IIRC, (I'll have to verify) I think at any time I can make the Hacker edition locked by uploading the correct fw onto it, but I may be wrong.

When I get the locked Solo v2, it will be my go to key and the current Titan will go in the safe with the other - after I spend a couple hours setting all my accounts up to recognize the new Solo, of course.

Haydon · Aug 27, 2021

Thanks, key management is key (pun intended) :)

Haydon · Aug 29, 2021

Kidding aside, there is only so much that we can do on our side of things. How about the other side? Facebook was breached and private photos of the CEO was exposed. What if it was your biz info that was exposed (in case you were doing biz on that platform)

Thoughts?

BunnyJ · Aug 29, 2021

Haydon said:
Kidding aside, there is only so much that we can do on our side of things. How about the other side? Facebook was breached and private photos of the CEO was exposed. What if it was your biz info that was exposed (in case you were doing biz on that platform)

Thoughts?

Nothing is really hack proof and yes, MS could be hacked but I find it less likely that they will than a Facebook. I don't take Facebook security as seriously as I would say MS or any other real tech company.