Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Phone verification at no cost

github.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Show HN: Phone verification at no cost

#51

Post by ma2rten »

reitanqild wrote: post #20
gst wrote: post #6

It's relatively easy to change/fake the caller ID of phone calls so unfortunately this approach isn't really secure. That's why phone number verification usually places an outgoing call, to verify that you're actually able to receive calls on that number.

This has been the case since I was a kid. My dad told me that I could verify[0] the identity of a caller by calling back to a number that was known to belong to the entity in question. [0]: for some level of security. My father was a farmer at that time and I know he wasn't talking about a nation state adversary ;-)

Yeah, this should be common knowledge.

Re: Show HN: Phone verification at no cost

#54

Post by patcheudor »

I may get down voted for this and so be it, this must be said. This is a prime example of creating what was intended to be a security feature without understanding the threat landscape. I just tested it, and it's 100% vulnerable to caller ID spoofing. In 2016, caller ID spoofing is as simple as downloading an iPhone app and spending $30 for a bunch of minutes.

The problem is, a lot of people will find this cool and will also not evaluate the threat landscape. In fact, it's even worse. They will assume the threat landscape has already been evaluated. The code is out there, so it must be good. They will then implement this into some "super duper secure" service which should require a far more security for user authentication. It will then take me 15 minutes of pulling my hair out in a security review to explain to whomever implemented it that it offers no security. The team will walk away from our meeting wondering if I was just trolling them and ask how their entire team could have made this mistake. They will then come to the conclusion they are smart and I must be wrong. They'll then call me back to explain again, at which point I'll take them through a full video demonstration with their VP of operations on the call. This time they will actually "get it" because they saw it exploited on video. Their VP of operations will then fire the project manager and lead developer and I'll feel like shit for being responsible for the termination of two careers.

Re: Show HN: Phone verification at no cost

#55

Post by allannienhuis »

lstamour wrote: post #46
StavrosK wrote: post #44

Earlier quoted context omitted.

Can you recommend one that works well? I want one that hopefully provides a Greek DID, I want to be able to make calls from my Android to landlines over my home Internet connection, as you describe, but I haven't managed to find a good (read: cheapish) provider.

I use voip.ms but many others exist. Anveo, Twilio, Vonage, etc. cheapest might be a service that uses Google, but only for as long as Google offers free calls.

+1 for voip.ms. I've been using them for years - they're inexpensive, lots of features, and service has been great.

Re: Show HN: Phone verification at no cost

#56

Post by bpchaps »

patcheudor wrote: post #54

I may get down voted for this and so be it, this must be said. This is a prime example of creating what was intended to be a security feature without understanding the threat landscape. I just tested it, and it's 100% vulnerable to caller ID spoofing. In 2016, caller ID spoofing is as simple as downloading an iPhone app and spending $30 for a bunch of minutes. The problem is, a lot of people will find this cool and w…

Not to mention that it's incredibly inconvenient if you don't carry a phone, or if you lost it. I tried to signup for airbnb this weekend while traveling, but wasn't even able to go through the verification process without a physical phone. Zero alternatives for verification and even trying google voice (my main 'phone' provider) wasn't good enough. Sure, I could've borrowed someone's phone for a second, but isn't that the sort of thing these systems are supposed to guard against? I don't get it.

Another example - you can't use uber on a desktop without going to m.uber.com last I checked. There's no way to order trasnportation without that m. (why!)

Another - gmail. You either need another email or a phone, and at the time, neither were possible. (why!!)

For tons of reasons, I just don't like having a phone in my pocket 24/7/365. Mostly, I just enjoy the peace of mind of being unreachable. I've been oncall for years, but that oncall vibe is extending more and more into social situations, for the worse. I hate it. Devs - PLEASE account for those like me! I'm really tired of people telling me (accurately :(.) "You wouldn't have these issues if you had a phone." on account of your laziness or lack of awareness for sensible security.

Re: Show HN: Phone verification at no cost

#57

Post by everfree »

chambo622 wrote: post #18
kevindeasis wrote: post #7

Hi, there's a free phone verification using facebook. It's account kit. https://developers.facebook.com/docs/accountkit/overview What do you guys think?

Similar to Twitter's Digits, which has been around for a while and seems quite popular. https://get.digits.com

Why is it free?

Re: Show HN: Phone verification at no cost

#58

Post by patcheudor »

bpchaps wrote: post #56
patcheudor wrote: post #54

I may get down voted for this and so be it, this must be said. This is a prime example of creating what was intended to be a security feature without understanding the threat landscape. I just tested it, and it's 100% vulnerable to caller ID spoofing. In 2016, caller ID spoofing is as simple as downloading an iPhone app and spending $30 for a bunch of minutes. The problem is, a lot of people will find this cool and w…

Not to mention that it's incredibly inconvenient if you don't carry a phone, or if you lost it. I tried to signup for airbnb this weekend while traveling, but wasn't even able to go through the verification process without a physical phone. Zero alternatives for verification and even trying google voice (my main 'phone' provider) wasn't good enough. Sure, I could've borrowed someone's phone for a second, but isn't th…

I have a shocking number of burner phones driven by the need to register for stuff which requires phone-call validation of identity. Of course every one of those phones was purchased in cash while wearing a hoodie and sunglasses, after parking in a nearby neighborhood and walking to the store.

Note, I'm not a criminal, I just play one in my day job.

Re: Show HN: Phone verification at no cost

#59

Post by bpchaps »

patcheudor wrote: post #58
bpchaps wrote: post #56

Earlier quoted context omitted.

Not to mention that it's incredibly inconvenient if you don't carry a phone, or if you lost it. I tried to signup for airbnb this weekend while traveling, but wasn't even able to go through the verification process without a physical phone. Zero alternatives for verification and even trying google voice (my main 'phone' provider) wasn't good enough. Sure, I could've borrowed someone's phone for a second, but isn't th…

I have a shocking number of burner phones driven by the need to register for stuff which requires phone-call validation of identity. Of course every one of those phones was purchased in cash while wearing a hoodie and sunglasses, after parking in a nearby neighborhood and walking to the store. Note, I'm not a criminal, I just play one in my day job.

I might go that route, honestly. I've done a few security disclosures recently as myself and doing so has been giving me a vibe that I'm not a fan of. Same with a lot of the FOIA calls I need to make. Having a burner phone might help, as much as I'd hate to use it.

Re: Show HN: Phone verification at no cost

#60

Post by patmcguire »

patcheudor wrote: post #54

I may get down voted for this and so be it, this must be said. This is a prime example of creating what was intended to be a security feature without understanding the threat landscape. I just tested it, and it's 100% vulnerable to caller ID spoofing. In 2016, caller ID spoofing is as simple as downloading an iPhone app and spending $30 for a bunch of minutes. The problem is, a lot of people will find this cool and w…

Wow, working in security sounds awful.
Post reply on HN