Skip to main content


Would you be comfortable joining an instance that required you to provide your mobile phone number to send a code you enter during registration, knowing your # wouldn't be stored and only used to verify you are not a spammer? #askFedi #fediverse

  • That's fine (20%, 348 votes)
  • I'd cautiously consider (40%, 699 votes)
  • Not at all (33%, 577 votes)
  • Just show the results (6%, 108 votes)
1732 voters. Poll end: 1 year ago

reshared this

in reply to dansup

asking for a phone number is gating out people who don't have, can't get, or can't afford phone service
in reply to infinite love ⴳ

@trwnh That's true, I'm thinking of ways we can do this as a last resort (if sus), not something that would be required for every user
in reply to dansup

generally not worth it imo. it's not even effective unless you have a "one account per phone number" policy on a centralized service, which... isn't how federation works
in reply to dansup

Key point would be establishing that trust that the number wouldn't be stored because we have all seen this abused before.
in reply to dansup

In 100% of the cases where sign-up is tied to cellphones, account recovery is also tied to cellphones. The first is acceptable to me. The second is a non-negotiably unacceptable security risk.
in reply to dansup

sorry, but most likely no. If it’s for 2-factor authentication, phone/SMS-based ones have also been shown to be less secure as well as they are susceptible to SIM-jacking attempts.

Mastodon already has built-in app-based 2FA support, and I’m already using it for my account. There’s no need to use mobile phones for this.

This entry was edited (1 year ago)
in reply to eons Luna

@eonity This would only be used for registration, no plans to support SMS 2FA
in reply to dansup

still no. I believe there are better ways to screen out spammers than providing a number. Besides, pretty sure the spammers will figure out a way to work around the requirement.
in reply to dansup

It isn't really a true barrier... You can get SMS through voip services
in reply to dansup

"knowing the number" is something I can't trust. What service is used to send the code? Etc. I probably wouldn't unless I have no other choice (e.g. other instance)
in reply to dansup

How would that process verify a user as not spammer?
in reply to Fernando

@martinewski Well I mean it's more difficult to generate a fake sms number than email account, but good point. This wouldn't be a fool-proof solution, it would just make it a bit more difficult.
in reply to dansup

I guess there's no viable fool-proof solution. You'd surely make it a little more difficult by using that process, but too easy on spammers IMO. They have zillions of phone numbers available. :sadness:
in reply to dansup

How would I "know" this?

I see these claims on websites all the time "we'll never XYZ your ABC". How are they verified?

in reply to dr 🛠️🛰️📡🎧:blobfoxcomputer:

@davidr Great point, that's why I made this poll.

If I do implement this in @pixelfed, the source code will be auditable, but I get that it's possible to edit it in production.

I'm considering this as a possible solution, but only if there is a general consensus that supports it.

in reply to dansup

You're trusting the instance owner and whomever had access with what I consider to be a very personal and important piece of information. I don't think I'd be happy with it. It's nowhere near as easy to change or anonymise as an e-mail address, password etc. for the majority of people.
in reply to dansup

Do keep in mind that verifying phone numbers gets very expensive very fast.
in reply to dansup

Daniel, both Telegram and VK rely on phone numbers to curb spam. Both spend sizable amounts on SMS and calls even at their scale. Telegram always seeks to limit the amount of SMS they send, by e.g. first sending you a login code to an existing session, and only if that fails, an SMS.
in reply to dansup

As long as I can read their terms of service first so I know what they plan to use it for.
in reply to dansup

I'd have to be convinced it's useful or does something. On the surface,, it sounds like security theater.

I'm not sure how it's actually useful or prevents misbehavior. It seems like it only works by being a hindrance. Doing that intentionally is a bit ableist, to a greater extent than it's effective.

in reply to dansup

Even if there's a way to convince the user that the pixelfed instance would not store the number: The SMS service will store that their customer (pixelfed instance XY) did send an SMS to number YX. For accounting reasons. "Your number will nowhere be stored for this procedure" will be a lie, no matter how your software is implemented, because of how SMS services work.
in reply to dansup

An issue here is how do I KNOW that my phone number isn't being stored...
in reply to dansup

If I hadn’t recently setup my own Instance, I think the need to provide a mobile number would be the prompt needed for me to try to move to a personal instance
in reply to dansup

... because you **cannot know** your # won't be saved and sold and spammed.

@profcarroll

in reply to dansup

I have a disposable SIM I use when I have to give it a phone number, so I'm already in a weird category. That said, I can be persuaded to use that number for registration if I have to.

But I'd honestly be reluctant to trust any site that said this, because:
+ if it's genuinely not stored, a spammer can use the same number for 10,000 registrations and then just get another number, or
+ some process will complain about the number being reused, showing it really is being stored somewhere.

This entry was edited (1 year ago)
in reply to dansup

@pixelfed

Besides the privacy issue, there is standing in solidarity with those who do not have mobile phones.

in reply to dansup

If the number won't be stored it will be useless, one spam bot could make as many accounts as it wants with the same number. Am I missing something?
in reply to dansup

Why not an email account? This way it can remain anonymous, but still adds a second step to curb spammers. Cell numbers are probably one of the most personal things we have, and I don't trust that everyone would act in good faith sadly.
in reply to dansup

this needs a “how do I know they won’t preserve the number or sell it?” option, though.
in reply to dansup

What makes you think that everyone on the planet even HAS a mobile phone? In many parts of the world those cost money and not everyone has them. And even people who do have them to often don't want to give out their number to random services on the Internet, for fear of getting increased junk/spam calls or other misuse. There is really know way of "knowing" your number wouldn't be stored and misused, as your question presupposes.

Personally I think this is a terrible idea, both because of the discrimination against people who do not have mobile phones, but also because you are asking users to trust random instance owners not to do anything bad with their phone numbers. The "bad apples" among instance owners (can you absolutely guarantee there aren't any?) are probably hoping something like this will be enabled real soon now!

in reply to dansup

another thing why phone numbers as a "spam protection" isn't a good idea: it's fucking expensive for the instance admin to do the SMS stuff and on the other hand it costs almost nothing to get yourself some phone numbers you could receive SMS on as spammer
in reply to dansup

As long as it allows use of a Google Voice or other VoIP number
in reply to dansup

Cautious enough that I already use a phone masking service for anytime someone asks me for my number
in reply to dansup

Are you intending to block all the (many) anonymous services that offer an SMS number that simply display all incoming messages on a public web page, precisely to get around having to give out your real mobile number to potentially untrustworthy web services?
If you’re not storing the number, what prevents a spammer using just one number to set up 10,000 accounts?
in reply to dansup

this only fights spam accounts on large centralized instances.

And we don't want large, centralized instances.

We want to encourage many, small, federated instances. So IMO any effort to improve spam fighting, should go to tools and tech for fighting spam in a world with many, small, federated instances.

in reply to dansup

it would depend a lot on how much I trust the instance owner. It’s a standard approach for mitigating bots and reasonably effective - but must every social media company that’s done this has abused the data eventually. Verification by a trusted third party might be an easier sell.
in reply to dansup

“Knowing”? No could know that. How about “Hoping”, “Believing”, or “Thinking”