I'm trying to implement a phone number based login and not sure if I should ask the users for full number, i.e country code + number or just the number.

What I have in mind so far:

  • Attempt optimistic login using whatever number user gives.
  • Most likely, it'll come back with a single user match.
  • In case there is a collision, throw an error (and show some helpful clue to the user asking them to enter full number)

I guess this is a simplistic approach with minimum friction and complexity (as opposed to IP detection, geography based resolution etc.).

  • What exactly are you trying to accomplish that you want to use a telephone number as the log in? – Tyanna Jul 30 '14 at 18:19
  • @Tyanna: Some of the users don't have email setup. However, they do have a phone. Since the client uses email address as the primary username, it forces them to create an email address which they don't want to (whatever may be their reasoning). As an alternative, using phone number as the login username solves this problem. – Mrchief Jul 30 '14 at 18:25
  • 1
    Fair enough. My only concern with this is that many people change their phone numbers often. And, at least where I am, cell numbers are recycled. You would need to take that into consideration. – Tyanna Jul 31 '14 at 14:16
  • @Tyanna: We already allow users to update their numbers and when cell numbers are recycled, they are not allotted for certain amount of time. In US its about 12-13 months and may vary in other countries. But that should be sufficient time for the users to update them (and less likely that the new subscriber tries to signup within that period). Now this got me thinking, we need to handle inactive or suspended users from occupying legitimate numbers. – Mrchief Jul 31 '14 at 19:43
  • Why do you need to have a phone number at all? Can't you just let the user choose an arbitrary user name and password? – Marcel Aug 15 '14 at 6:05

You should make them enter the whole thing in one step, and you should make the format explicit.

  1. Phone numbers are very tricky, especially on a global site. You should take every step you can to avoid ambiguity, guesswork, and fancy country-based magic.
  2. If you truly need to use phone number for "login" a single form can work better with "remember my credentials" features in browsers.

That said, I think you're setting yourself up for a disaster, because there are many issues to consider:

  • Phone number display styles and validation vary by country! For example, within Hong Kong, there are no area codes, and phone numbers are eight digits long.
  • Many people will have absolutely no idea what they'd need to dial internationally to reach their own phone. ("Country code? What's my country code?")
  • What about people who sign up using a work phone extension? Either you support that, or you force everyone in an office has to share an account. (Or to use a personal phone number.)
  • The phone number a person uses may not have any relationship to where their current residence or their computer is right now.
  • You raise some good points. I was going to stay away from formatting them. Work extension based login is not a requirement (yet). Most users are expected to use their personal phones (more people seem to have smartphones than email apparently). – Mrchief Jul 30 '14 at 18:22
  • It is precisely for your second bullet point (users not knowing the country code) is why I need to start with taking just the number first. And then come back and ask for country only if there's a collision. – Mrchief Jul 30 '14 at 18:28
  • How do you tell the difference between an accidental collision and an intentional match? If I'm on vacation in Germany, and I enter my US local phone number which happens to match the German local phone number of another user... – Darien Jul 30 '14 at 18:30
  • I don't. Any collisions will have to be resolved by the user by supplying complete number. And it doesn't matter where you're logging in from. The phone number is always stored as country + number and the combination is kept unique. – Mrchief Jul 30 '14 at 18:34

This is a classic case of YAGNI.

Sure, you might get duplicate phone numbers. But ten digits allow for 10 billion possible phone numbers, so I doubt you're going to have this problem any time soon.

By the time you have a large enough user base that this might become a problem, it will be a good problem to solve, and you'll have the necessary resources to solve it.

  • I like your thinking and that's how I'm soothing myself but unfortunately, this doesn't answer my question! :) – Mrchief Jul 30 '14 at 16:46
  • Of course it does. All programming involves tradeoffs; you evaluate the requirements, and make a decision. In this case, the problem is statistically insignificant. As to how Facebook does it, I don't have the slightest idea, and neither does anyone else here, unless they happen to work for Facebook. I can speculate, if you like: they probably require you to use a different login process (i.e. email address) if the number is a duplicate. – Robert Harvey Jul 30 '14 at 16:47
  • I updated question with what I have in mind. Based on Facebook's help pages, I guess that's what they are doing too. I'm not after what FB does exactly but something simple that can be vetted by experts here. – Mrchief Jul 30 '14 at 16:58
  • As you wish. But you're trying to solve a problem that (for all intents and purposes) doesn't exist. You're trying to build a site that can handle 100 million users, when you don't even have one user yet. Build it for ten thousand users, or a hundred thousand. Worry about phone number collisions later, when you've made enough money that fixing it won't be a problem. – Robert Harvey Jul 30 '14 at 16:59
  • What makes you think I don't have a single user? Sure enough, I don't have millions but that doesn't matter if a high profile client faces an issue. – Mrchief Jul 30 '14 at 17:24
  1. on sign up have a country drop down with the dial code +1 US, +44 UK, +55 Portugal...
  2. Validate the number to the user by sending an SMS with a validation code, expensive but important.
  3. Allow login by just the CNS - local number as the DB can match the password, if you have 2 numbers both different country codes the password will match.
  4. If you wanted to do extensions use a / slash . point or # to specify.
  5. Don't store the number in any format, all local format a cns or number in its full entirety is 441233661666 but the login will accept just 01233661666 as any trailing 0 is ignored.
  • We're doing the same! :) – Mrchief Aug 16 '14 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.