How to allow login of user through mobile number?

In India at least, people rarely change their number. They change their handsets/devices, their operators, but not their numbers. (Number Portability is allowed in India and many other countries).

And in rare cases, when a user does happen to change his number, and opens any app which was attached with his old number, he is given OTP option (in which his old number will receive an OTP one last time); or security questions (in which he’ll be asked a few security questions). And this way he can effect the number change.

And this is practically happening in India daily.

「いいね!」 4

:clap::clap::clap::clap::clap::clap:

「いいね!」 1

There is very wide spread precedent of “mobile phone number == identity”. This is how whatsapp works, they have 1.5 billion active users.

I think any experiment here should probably start with a plugin. It would be an interesting experiment and require some SMS inbound API integration.

How notifications would be handled though is a conundrum under a system like this.

「いいね!」 11

As part of the broad PWA Spec, browsers will be able to read one-time passwords from SMS using a new web API. This is coming this year to Chrome on Android, and was created to deal with cases like this.

https://bugs.chromium.org/p/chromium/issues/detail?id=670299&q=owner%3Agoto%40chromium.org&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

「いいね!」 6

Passwords through SMS is not secure though, e.g.

Why would we want to support that?

「いいね!」 7

The uptake of email in India is rising too. In 2011 only 2% of the population had any form of email, as of last year it’s close to 1 in 6.

「いいね!」 3

As we experience first hand in India in an average district, majority of these new users have to get someone to create an account on Gmail, just because they want to use WhatsApp and WhatsApp cannot be downloaded unless you’ve a playstore login ID (that’s =Google id).

And thereafter they never sign in to their Gmail. Not even once. For all purposes, they never know what’s their id is (far is password).

And sometime, for whatever reason, they happen to logout of their account on android, and they need to login once again in their Gmail account, they keep carrying their Mobiles to different known persons, requesting them to help start their mobile again. (they consider their mobile to be not usable if either WhatsApp stops, or calling stops)

「いいね!」 4

We would be extremely happy to take place in any plugin experiment. How would we proceed to find someone to author it? Do we need to fund the SMS gateway for phone validation?

Please advise. I think it’s worthwhile testing it and see the uplift in registrations, as opposed to continue the debate. There’s a reason why Fcaebook / whatsapp offer it.

As far as notifications go, considering now that we have browser based notifications, at least there’s an alternative. Looking into occasional SMS notifications is not a bad idea, though I don’t think it’s the priority right now. I would expect it could start with a weekly or monthly reminder that there are new updates (if user hasn’t visited the community) and take users to their notifications page. Easy optout would be needed. Again, I wouldn’t include this in the plugin mvp.

「いいね!」 1

Sorry, I should have clarified above - those figures aren’t ‘email accounts created in India’, that’s the number of unique mobile device users actively connecting to email devices every month.

Those figures are also against the total Indian population for 2018 of 1.344 billion. Measured against the 566 million internet users in that same period, the number of active email users is just over 35%.

「いいね!」 1

ProCourse is actually in the middle of a project like this for a client that is willing to let us open-source the work.

The idea is not to use SMS as a password, but to simply replace the sending of emails with sending SMS through Twilio, Africa’s Talking, and Braze campaigns. The first two are currently implemented and seem to be working well. The last is currently in development.

The concept is to hide the email address on sign-up and fill it in behind the scenes with addresses that mimic the phone number: phone+555-555-5555@example.com. That way Discourse still works with emails if it needs.

But then we tie into specific events (user creation, password update, PM sent, mentions, etc…) and send SMS notifications on top of the email. But since the email is going to the aliased email, the user never has to deal with it.

「いいね!」 15

What if a user wants to swap from using SMS authentication to email-based? Do you have plans to cater for that?

Not currently. This plugin was designed as a complete swap. The main audience being African countries where most people don’t have an email address but most everyone has a smartphone.

「いいね!」 6

so what requirements would a forum provider have if they want to integrate? Create their own Twilio and/or Braze account?

Install the plugin, create a Twilio account, and fill out the site settings for it. It’ll require the API Key for Twilio and the email domain to use for the aliased email account.

「いいね!」 6

Has anyone considered using Facebook’s account kit? It’s a passwordless login method that works with e-mail or phone number. I think it’s free up to 100.000 sms per month.

「いいね!」 4

@joebuhlig、この件について一度お話しできますか?お電話かメールでお願いします。

そのサービスは終了しました。

「いいね!」 1

皆様、こんにちは。

この機能リクエストに関する進捗や更新情報があるか確認するため、トピックを復活させたいと考えています。特に @joebuhlig 様からの情報をお待ちしております。

背景:インド・タミルナド州の農業コミュニティ(大半は小規模農家)と連携しています。電子メールの普及率はほぼゼロで、携帯電話の普及率は非常に高いです。

Discourse の素晴らしいフォーラム機能に、携帯電話ベースの認証および通知機能を追加していただければ幸いです。

よろしくお願いいたします。

「いいね!」 7

申し訳ありません。私のほうからは報告すべきことはありません。プロジェクトは完了に至りませんでした。

「いいね!」 4

ああ、それは残念ですね。メールエイリアスを使うのが良い回避策だと思っていました。更新情報をありがとうございます。