undefined | Better HN

story

0 pointstoomuchtodo5y ago0 comments

I moved my Google Voice number to OpenPhone [1] (YC S18). No relation besides being a paid ($10/month) customer. If you have T-Mobile in the US, they have a similar offering called DIGITS [2] you might try (although OpenPhone offers more features for the price).

[1] https://www.openphone.co

[2] https://www.t-mobile.com/offers/t-mobile-digits

0 comments

ivank5y ago

I signed up for OpenPhone just now, but then noticed that the only thing you need to log in to someone's account is their email and a 6 digit code emailed to their account. There are no password or 2FA options. I haven't tested how rate-limited the login attempts are, but it seems like too much to ask for customers to trust that they exist and work, especially when the apparent attack success probability is already > 1/1M.

toomuchtodoOP5y ago

Your access to your email account is your password (magic link-esq). Agreed that 2FA is desirable (not sure if it's on their roadmap, will have to ping them and ask). If 2FA is a hard requirement, building your own solution on top of Twilio is preferable (as they require 2FA).

ivank5y ago

Thanks. I agree with you, except a 6 digit code is worse than a good random password, or magic link with e.g. 64 bits of entropy.

reificator5y ago

Thanks for the suggestions!

j / k navigate · click thread line to collapse

0 comments

ivank5y ago

toomuchtodoOP5y ago

ivank5y ago

Thanks. I agree with you, except a 6 digit code is worse than a good random password, or magic link with e.g. 64 bits of entropy.

reificator5y ago

Thanks for the suggestions!

j / k navigate · click thread line to collapse