boxofdelights

I have been kicking around a post idea for something like a year or a year and a half, but I've been torn between wanting to write it as a post (and tell you things) and wanting to ask for solutions.

Mr. Bostoniensis and I have been trying to consolidate our household, and the Brave New World of the Internet is... not facilitating this. Vendor after vendor, platform after platform, is organized around the concept of a single user account. Even when company accounts nominally allow multiple user accounts, typically one user account is the real user account and the other has restricted access.

For instance, when setting up joint financial instruments, we split up the work: I would set up the joint bank accounts, he would set up the joint credit cards. We subsequently discovered that he can't access the statements and tax documents in our nominally-joint bank account's online portal, and I can't have an independent login at all for our allegedly joint credit cards that show up on my credit report.

This is infuriating. What we want to happen is that he and I have equal full access to the accounts we share, such that either of us can do what needs to be done on them, which I thought was a pretty normal approach to, well, life. I did not think heterosexual marriage was some sort of weird counter-cultural edge-case, and it offends my software developer soul to be reduced to sharing usernames and passwords.

But that is exactly the case, and I would just hold my nose and do it, except for one thing.

Two-factor authentication.

If I want to be able to two-factor into an account that uses his phone number, I have to access his phone. Something best done while he is not asleep, which, unfortunately, is precisely when I am most likely to want to be paying bills or doing online shopping. Likewise, if he wants to two-factor into an account that uses my phone number, he'll need access to my phone. Which, honestly, he could probably slip into the room and grab off the charger while I'm asleep – which is precisely when he'll be wanting into those accounts – but that does him no good if say I were out of town or in the hospital or some such.

And more and more 2FA is becoming mandatory. You can't turn it off. (Or in the notable case of one of our credit cards, you can turn it off. It will two-factor you anyways, but the account settings assure you it's off.)

Two-factor authentication is stupid and awful for so many reasons, but it has only recently dawned on me that one of them is that 2FA is intended to keep anyone else from logging in to your account and I actually want someone else to log into my account. Legitimately, I think.

So.

Obviously, the Bostoniensis household requires some sort of telephony solution such that:

• text messages (SMS) sent to a single phone number propagate to two cell phones; *

• either of the two cell phones can originate text messages from that single phone number which is not the phone number of either of those phones; **

• and the phone that didn't send the reply gets a copy of it, so it can stay in sync with the convo; ***

• voice calls sent to that single phone number propagate to one, the other, or both simultaneously of the two cell phones, depending on a on-the-fly configurable schedule of when which call goes where; ****

• either cell phone can originate a voice call that will appear to come from the shared number; ****

• ideally, both cell phones could conference into the same call with a third party, but that's a bonus;

• must be compatible with Android phones, an probably needs to support iOS as well; we'd love a solution that also supports web and/or MacOS desktop access, but that's a bonus.

I am looking for recommendations for solutions that (are known to) meet this specification. There are lots of solutions for small businesses, but r/smallbusiness drags a lot of them for filth, and also we're cheap and don't want to pay a fortune, especially for a lot of businessy services we don't need like the ability to spam-SMS 10k prospective customers an hour or (all the rage right now) deploy an AI receptionist or surreptitiously surveil our customer service agents' work for quality and training purposes or integrate with Salesforce.

Also, crucially, a lot of these services seem to be based on a phone tree model, where each handset gets its own extension, and I'm really unclear how that would work with automated voice-call 2FA. Not well, I am guessing.

So what I am looking for is knowing recommendations that can answer from direct experience as to whether a solution will support our intended use case.

Has anybody else even tried to solve this problem? Or does everybody else just accept that financial instruments, online retail accounts, and virtual services can only really belong to one member of a couple at at time?

This seems like something there should be an obvious commercial service for, targetted at families, but the only one I found no longer is in the Play store and also may be wholly defunct.

As a side note, this isn't only relevant for couples. It's relevant to all sorts of multi-adult households, from polycules to multigenerational households. It is of particular relevance to people with aging elders who might want to be able to get into the elder's accounts to help them from afar. Especially adult siblings of aging parents, where no one sibling should be the only person stuck with all the administrative work. It's surprising that I haven't found a commercial solutions to this yet, and wonder if there already is one everybody else already knows about.

* Necessary to allow either member to receive a 2FA text message when either one initiates a log in.

** Necessary in the case we want to revoke texting permission to a third party by "text STOP to end".

*** Necessary not to engage in an inadvertent Abbot and Costello routine.

**** Necessary because every once in a while a 2FA system will barf on texting VOIP numbers, and only successfully get through with automated voice call 2FA. Also it would be nice for one of our other use cases – the "get Siderea's doctor's office to call back and make sure a human answers no matter when they do" use case – for there to be one number that rings through to both of us. But also necessary that we can schedule it not to ring when one or the other of us are asleep, while still ringing through to the other. I need to be able to 2FA at 2:00 A.M. and Mr. B very much needs my doing so not to cause his phone to ring.

***** Maybe not strictly necessary, but there's a lot of systems that react poorly, or at least with more scrutiny, to customer calls about accounts other than the ones associated with the number the call is coming from. It would be better if we just only ever called NStar from the number they have on record for us, but that means we need to be able to originate voice calls from the same number we'll be using with them for security purposes.


Edit: I'm really hoping for a non-Google, commercial solution.