When connecting to the Internet via Dial-Up, why did ISPs require a username/password to authenticate the session?

Question

It's been many years now, but when I used to connect to the Internet via Dial-Up back in the day I noticed at the time that as well as entering the phone number for my Dial-Up provider, a username/password were also required. Why did Dial-Up providers use this method of authentication - could the identity of the connecting party not simply be identified by their phone number?

Answer 1

No, the identity of the customer couldn't be confirmed by the phone number alone, for a number of reasons:

• Customers expected to be able to call in from different locations, using different stationary phone lines and therefore different phone numbers each time.
• Caller ID wasn't that widespread in the 1990s, and wasn't available for all phone companies in all countries.
• Caller ID could be faked.

Answer 2

In addition to sfrey's answer, using caller ID would prevent multiple accounts logging in from the same phone number, as in a family situation or a small office.

But the real reason is probably due to technical ease. Most ISPs offering dial-up service were essentially leasing UNIX accounts and disk space (or accounts on similar multi-user systems). The username/password requirement was dictated by those systems' existing authentication mechanisms.

Answer 3

Both of the existing answers here get at the issues involved (accounts are expected to be able to roam, multiple account holders may call from the same phone number, etc.) but there was another issue at play that complicated the whole situation: Very often, the service you were connecting to didn't know your phone number — nor did they care.

A brief digression to more recent developments

When ISDN came along, and then DSL after it, you'll notice that authentication largely disappeared from the equation — at least, for a while. Eventually some providers added it back in. (I remember there being a Windows system tray app from Verizon that you had to authenticate with, after connecting to their DSL service.)

But for users with original ISDN-level service, typically it was sold by the company that physically provisioned the line (or a company partnered with them), and billed as a hardware/service package bundled with the line it was delivered over. And in those situations, one of the attractive features was that there was indeed no authentication necessary — your modem just auto-dialed the number your provider supplied, and you were online. It worked much the same way that cable modems, today, typically don't require sign-in — the modem's physical connection to the broadband drop is more than adequate to identify you as the recipient of the service, especially since most providers authenticate the hardware itself.

Prior to that, controlled chaos

But like I said, that was one of the big changes that telco-managed dialup brought. Until that point, dialup service was nearly always provided by a company with no relationship whatsoever to the one that you bought your telephone service from, which is what led to all of the things Jim and sfrey pointed out. For a company with no ties to your telco, making your access to their service dependent on the number you called from just wouldn't have made any sense. Not only is caller ID easy to spoof and unreliable, but your dialup provider wouldn't have wanted to deal with the hassle of updating your account if, say, you moved and changed your phone number. You could still use the exact same service you had before, assuming they provided a toll-free dialup in your new location.

ISPs didn't always authenticate dialup users, by the way. There were situations where they didn't bother — not because they used your phone number or any other means to identify you, but simply because they didn't need to know who you were.

Take AOL, for instance

When an AOL user dialed one of their local access numbers and connected to the service, for example, the dialup connections were typically handled by a service officially named "AOLNet", but which we referred to as "BigDial" (its original codename, when it was under development). BigDial was built and managed by ANS, a backbone network provider that eventually became an AOL subsidiary, but still an independent company which operated the service under contract to AOL.

When a call came in on one of AOL's access numbers, aside from some minor negotiation with the software itself BigDial didn't do any authentication. Not only was it unnecessary given that the software itself identified the call as an AOL connection, but there was no way for ANS to authenticate AOL users if they'd wanted to. As the network service provider, they had no access to AOL's subscription database. So, any incoming calls from AOL's software simply had their data routed to the central AOL systems in Reston, and everything from authentication onward was handled there.

AOL is only one example

The AOL situation sounds like a special case. And in the sense of it being a software-managed connection rather than a general system-wide internet connectivity service, it was. But a lot of what we think of as more traditional "dialup internet" service was provided the same way: physical connectivity provided by one company, service provided by a completely different one. Authentication was often deferred until the last link in that chain, performed by a company that had no real interest in what phone number you happened to be calling from, and plenty of incentives not to care.

How I know

For two years from 1997-1998, I was a member of the 9-person BigDial Development team at ANS.