Why does yahoo need my phone number code#

YahooвЂ™s forgot password feature let me enter a phone number, and after entering a code sent to my phone I was able to read my email. Last week I went to regain access to a Yahoo account I hadnвЂ™t used in almost five years. Many major providers still let people reset their passwords with just a text message. The account is sent to collections and closed, and the phone number gets released back into the general pool for reassignment after a period of time. But maybe someone goes through a nasty divorce or separation, and can no longer access their phone or phone accounts. The biggest reason is lack of payment for past phone bills. And thereвЂ™s nothing anyone can do to stop it except to stop using phone numbers as identity documents.вЂќД«eyond SIM-swapping attacks, there are a number of ways that phone numbers can get transferred to new owners, Nixon said. вЂњBut from that siteвЂ™s side, when they see a password reset come in via that phone number, they have no way to know if thatвЂ™s me. вЂњAs a consumer, IвЂ™m forced to use my phone number as an identity document, because sometimes thatвЂ™s the only way to do business with a site online,вЂќ Nixon said. In this attack, the fraudster doesnвЂ™t need to know the victimвЂ™s password to hijack the account: He just needs to have access to the targetвЂ™s mobile phone number. Nixon said countless companies have essentially built their customer authentication around the phone number, and that a great many sites still let users reset their passwords with nothing more than a one-time code texted to a phone number on the account. Illegal SIM swaps allow fraudsters to hijack a targetвЂ™s phoneвЂ™s number and use it to steal financial data, passwords, cryptocurrencies and other items of value from victims. Nixon said much of her perspective on mobile identity is colored by the lens of her work, which has her identifying some of the biggest criminals involved in hijacking phone numbers via SIM swapping attacks.

How exactly did we get to the point where a single, semi-public and occasionally transient data point like a phone number can unlock access to such a large part of our online experience? KrebsOnSecurity spoke about this at length with Allison Nixon, director of security research at New York City-based cyber intelligence firm Flashpoint.

At the same time, when you lose control over a phone number - maybe itвЂ™s hijacked by fraudsters, you got separated or divorced, or you were way late on your phone bill payments - whoever inherits that number can then be you in a lot of places online. They stink because most of us have so much invested in these digits that theyвЂ™ve become de facto identities. Phone numbers stink for security and authentication.

Why does yahoo need my phone number