Permanent U.S. Phone Number for Two Factor Authentication

[wingssail]

Originally Posted by Dockhead

Well, Tello is not GSM and won't work in Europe.

Redpocket international roaming is data only (no voice, no text)

Same thing with US Mobile.

So much for international roaming on the $10/mo plans.

I have kept a US number (skype) since 2004 or so. I have forwarded calls all over the world. I have forwarded to a forward quite often, (US to Hong Kong to anywhere). So in that way calls to my US number always reach me on my local phones. My outgoing calls over skype appear to come from my US number. Except for SMS it has always worked. It is not free but it is reasonable from my point of view.

Two Factor Authentication has presented a snag which I have not fully solved although I have developed some work-arounds. The option to send an email is best but some companies won't do that. PayPal login is one which is more difficult but I've hacked a way to beat that too.

One caution to CF readers who are overseas a lot. Some US financial institutions will not maintain accounts, even for US citizens, if you do not remain primarily in the US. It does not matter that you have a US address, vote in the US, and have a US phone number. You have to reside there. When, while complaining that the SMS method would not work outside of the US, I mentioned to a service rep that I was out of the country and had been for some years, they instantly dropped my account and no amount of argument had any effect on that decision.

[wholybee]

Worth noting regarding multifactor authentication. Multifactor authentication requires more than one of the following: Something you know, something you have, or something you are (biometrics etc.)

If you use a service that allows you to receive a text message via an app you install and access with a password, that satisfies the "something you know" (password) option but does not satisfy "something you have" option, because the app could be installed and authenticated with a password on any device.

Knowing two passwords is not Multifactor Authentication, it is a single factor, twice.

An SMS to a cell phone with your SIM card in it satisfies "something you have"-even if that phone is connected via wifi. You have a SIM card.

So what you are really trying to do is defeat a security standard (PCI) that financial institutions are required by law to adhere to. (AFAIK MFA is currently a recommendation in PCI, but will likely be a requirement in the future) What this also means is that if you do find a VoiP service that works with SMS and MFA, then it is by accident, and subject to being stopped at any time.

I would like to see banks offer MFA via a keyfob. I would like to be able to buy a single RSA keyfob, and use it as MFA for *any* site that required MFA.

In the meantime, yes it is expensive, but real phone service through a SIM card is the only way an SMS will satisfy MFA.

[Montanan]

Originally Posted by wingssail

One caution to CF readers who are overseas a lot. Some US financial institutions will not maintain accounts, even for US citizens, if you do not remain primarily in the US. It does not matter that you have a US address, vote in the US, and have a US phone number. You have to reside there. When, while complaining that the SMS method would not work outside of the US, I mentioned to a service rep that I was out of the country and had been for some years, they instantly dropped my account and no amount of argument had any effect on that decision.

FYI:

Reference link to the Americans Citizens Abroad [ACA] website which snipet is copied below but to which one has to link to so as to attain the relevant weblinks:

https://www.americansabroad.org/bank...e-patriot-act/

BANKING AND THE PATRIOT ACT
There is NO provision in the Patriot Act, not any US law or regulation, which prohibits banks from accepting clients who do not live in the US. However, US banks are looking at the increased diligence provisions in the Patriot Act and using this guidance to remove clients who are too difficult to assess. Lack of a US residential address along with lack of US utility bills to support proof of residency is one of the common requirements that many US banks are requesting in order to open or maintain US based accounts. It is a private bank decision as to what documentation they will accept in order to open or maintain a US based account.
The US Treasury Department has offered to help citizens who have problems with account closures at US banks. If you are notified of account closure of an existing account by a US national bank (i.e. not a “local” bank), you can file a complaint with the Customer Assistance Group of the Treasury Dept. www.occ.treas.gov/customer.htm . You should also consider filing a complaint with the Consumer Finance Protection Bureau www.consumerfinance.gov/complaint and the Federal Reserve https://www.federalreserveconsumerhe...mcomplaint.cfm

ACA, Inc. as well as the Congressional Americans Abroad Caucus are very interested in getting feedback from people who use these resources. And also, ACA, Inc. recommends that you write your own representative in Congress about your banking problems.

As a service to members, ACA is now offering access to the State Department Federal Credit Union which accepts overseas Americans as customers. https://www.americansabroad.org/sdfcu-account/

[wingssail]

Originally Posted by wholybee

Worth noting regarding multifactor authentication. Multifactor authentication requires more than one of the following: Something you know, something you have, or something you are (biometrics etc.)

If you use a service that allows you to receive a text message via an app you install and access with a password, that satisfies the "something you know" (password) option but does not satisfy "something you have" option, because the app could be installed and authenticated with a password on any device.

Knowing two passwords is not Multifactor Authentication, it is a single factor, twice.

An SMS to a cell phone with your SIM card in it satisfies "something you have"-even if that phone is connected via wifi. You have a SIM card.

So what you are really trying to do is defeat a security standard (PCI) that financial institutions are required by law to adhere to. (AFAIK MFA is currently a recommendation in PCI, but will likely be a requirement in the future) What this also means is that if you do find a VoiP service that works with SMS and MFA, then it is by accident, and subject to being stopped at any time.

I would like to see banks offer MFA via a keyfob. I would like to be able to buy a single RSA keyfob, and use it as MFA for *any* site that required MFA.

In the meantime, yes it is expensive, but real phone service through a SIM card is the only way an SMS will satisfy MFA.

Google has recently taken to sending a "notification" to my phone with a number. This is not an SMS and it apparently satisfies Google that it is "something I have" (Though Google is not a financial institution, (or is it?))

[s/v Jedi]

Originally Posted by Dockhead

Well, Tello is not GSM and won't work in Europe.

Redpocket international roaming is data only (no voice, no text)

Same thing with US Mobile.

So much for international roaming on the $10/mo plans.

Roaming? GSM? No, wifi calling is what we use outside the US.

[belizesailor]

Originally Posted by chrisboat

TextNow phone number was rejected by bank so not a option either.

So for now there are no options.

Thats unusual, Im using it with several USA based financial institutions.

[belizesailor]

Re retaining a TextNow number.

Ive done some reading on their web site and my understanding is that there are currently 2 ways to keep you TextNow number from being "recycled" as they call it.

1. Subscribe.

2. Receive at least 1 message per month to your TextNow number. The frequency of message receipt varies in some discussions on their web site, but 1 per month seems to be the most common statement. Sending from the TextNow number does not count, it must be received.

I have a TextNow number. No subscription. I use it actively with several entities for 2FA so easily meet the usage requirement. No issues so far. Happy customer (though it appears that live support is basically non-existent).

[stu291]

I recently started an account with textnow they have no ad light for $1.99 per month and they won't take your number away, a problem I'm having is I needed to port a number in and although it seems like it was possible recently that seems to have changed, and yes I agree there is no customer support

[chrisboat]

Some info to clarify TextNow from their site. Oh how I wish they could fully support TwoFactor Authentication.

1. The first link is the plans available. $9.99 per month keep your number and remove adds. $1.99 per month remove adds only.

https://blog.textnow.com/blog/2020/1...xtnow-account/

2. The second link. How to keep you number active. From that link:

Simple right? Let me expand on that with some more details. Any number on a free WiFi-supported account runs the risk of expiring if the number is not used regularly. Why is that? you might ask. As we mentioned above, we don’t have an unlimited amount of phone numbers to give out and we want to make sure that the number on that account does not go to waste, especially in more popular area codes. A number on a dormant account may expire so it can be readied to give to an active subscriber to use.

The Specifics
We recommend you use your TextNow number for an outgoing call or text at least once every 2 days. While your number won’t necessarily expire after two days, every account and area code is different. So if you are adamant about keeping that number, make sure to stay active and don’t let your account become dormant.

Also be aware that incoming calls and texts do not count towards keeping your TextNow number active. There must be an indication that the account is in use, so an outgoing call or text is required.

https://blog.textnow.com/blog/2020/0...extnow-number/


3. You can only port your number if you take one of the Nationwide Talk and Text Plans.

4. There actually is support but it was difficult to find. Go to support .. Click on Browse Article then scroll to the bottom and a support bubble will show up. Once I got there the support was good.

[stu291]

Even though they have a bubble that says you can contact them all you get is a bot there is no customer support
You can Port your number if you use their SIM card but that's really not helpful for this purpose at all because I am out of the country their SIM card does not work for me

[chrisboat]

1. somehow the other day going in that same way i got a person after telling the bot i needed an agent. their support hours are 10am-5:30pm (Eastern)

2. Yes the sim card goes with the Nationwide Talk and Text Plans.

[Dockhead]

Originally Posted by s/v Jedi

Roaming? GSM? No, wifi calling is what we use outside the US.

OK. Can you receive text messages when on WIFI and out of the network?

[s/v Jedi]

Originally Posted by Dockhead

OK. Can you receive text messages when on WIFI and out of the network?

yes! with wifi-calling feature, the phone works anywhere in the world as long as it has a wifi connection to the Internet. It will work like if you are in the US with 5-bar signal. You create an IP tunnel with the cellphone provider. My iPhone normally says "Verizon" but with active wifi calling it says "VZW Wi-Fi".

It will default to roaming so I force it to wifi calling by setting it to airplane mode with wifi enabled.

[Dockhead]

Originally Posted by s/v Jedi

yes! with wifi-calling feature, the phone works anywhere in the world as long as it has a wifi connection to the Internet. It will work like if you are in the US with 5-bar signal. You create an IP tunnel with the cellphone provider. My iPhone normally says "Verizon" but with active wifi calling it says "VZW Wi-Fi".

It will default to roaming so I force it to wifi calling by setting it to airplane mode with wifi enabled.

That's very cool

[chrisboat]

s/v Jedi

Looking at Tello maybe it would work well for us. Do you primarily or exclusively use the phone outside the US using Wifi. Do you frequently get two factor texts over wifi. Do you also use it for voice on wifi. Do you basically keep the phone on airplane mode all the time.
We have a Caribbean phone plan that provides unlimited calling to the entire Caribbean, US and Canada but we could put this second sim in our phone and use Tello via wifi to replace our US Skype number and also get our two factor messages.