Oh everyone is fed up but we just elected a guy and government who is sure to make it all way way way worse.

He just helped put the nail in the coffin of the lie that crypto is for anything but scams, don't worry, it's gonna get real bad before it gets any better.

I'm pretty sure a lot of scam calls use machines that call every possible phone number within an area code and see who answers. There is no way to avoid it.

lists sourced from drivers licenses and motor vehicle registration records are literally sold by some states.

quit ~~selling~~ demanding my fucking phone number!

FTFY

Australia has a "do not call register". It seems to mostly work, but telcos are having trouble with calls originating from outside the network with spoofed caller ID. We still get spam/scam calls from India among other places.

Even if they're not calling you directly, they are still using your phone number to link you to things and create a shadow profile behind the scenes.

Don't worry, here in Europe we are full of privacy laws but I still receive tents of spam calls per day. Usually from non UE countries faking the number with my country numbers.

I'm sad PGP didn't become a popular way to log into websites. A challenge-response protocol could have even been built into web browsers. Big tech is reinventing that idea as Passkey, but with a very big tech flavor.

Now type it a form that doesn’t allow copy and paste.

Thanks, gonna need your phone number to verify that though.

I want to preface this response saying I full agree with this, I want something like this to happen, I am responding because of some concerns I have. The real major one: How do you verify the authentication part of the data security chain?

A PGP key alone does not authentically validate that you are who you say you are. When the source is the untrusted party, it doesn't accomplish the site's goal. It's the equivalent to me handing you a piece of paper saying "I'm John Smith and this is what I use to say I'm this" which works amazing for trusted exchanges, but when the source is "just trust me bro" it doesn't solve anything for the website owner.

Websites get around this by having trust certificates/root servers that are co-signed with the PGP key. However, we lack any system like that for personal identities. Arguably, setting up such a system would isolate most of the known internet, as it is a significant roadblock, much like how SSL certificate usage was a huge roadblock for sites before Let's Encrypt became a thing.

This setup would be amazing for logging into sites. However, it fails to accomplish what the websites that are asking for PII are looking for, which is verification that their user is who they say they are, and not a random third party.

To reliably use this setup, we would need something similar to Let's Encrypt, but for user identification. The issue with that is it would become the de-facto attack vector (for both law enforcement and criminal parties), and that site would need to require PII to address the biggest concern on these sites, which is that you are who you say you are, and not Jo Smo or a bot looking to harvest data. Additionally, as mentioned earlier, a massive retraining of the internet would need to be done, which would mostly affect non-tech folk.

I am hopeful that an easy function that won't violate users privacy comes out, but I don't think the two topics are compatible sadly

Nah, man. Gotta get my $2.97 check.

Yeah, just generate a unique ID and ask only for the information you actually need.

I remember I was flipping through some of my mom's old college stuff and there was a club that she was involved with and everyone listed their address and social security numbers. It was wild, no idea why they felt the need to collect socials. But this was a very long time ago.

Proton?

Just signed up for Tuta and they do not ask for this.

You mean the Veritasuim video with linus in it?

Source

This assumes a legitimate need to prove who you are outside the context of that specific site, rather than just within it. Sometimes that need is real, sometimes it is not.

When it's not, and you only need to prove you are the same person who created the account, then a simple username and password is sufficient. Use 2FA (via authenticator app or key, NOT via SMS or email) on top of that. This allows users to prove to a sufficient degree that they are the owner of that account.

This is how most Lemmy instances work, for example. I can sign up by creating a username and password, with optional 2FA. They do not need my email. They do not need my phone number. They do not need my name, or my contacts, or anything else that is not related to my identity within their server.

I realize that this is untenable at large scales for any communications platform. Spam (and worse) is a problem wherever there are easy and anonymous signups. I'm honestly not sure how Lemmy is as clean as it is. I guess it's just not popular enough to attract spammers.