Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#41

Post by willcipriano »

tobyjsullivan wrote: post #34
fatnoah wrote: post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

There are two layers here. 1) You're absolutely right that the account ends up texting out a phishing link which any automated system would rightfully detect as phishing (regardless of whether the recipient has "consented" to receiving the message - it still contains a phishing link). But that's not the real issue, which is 2) Twilio's response to detecting the sending of a phishing link (possibly more than one) is t…

As a text message recipient, I can't say I'm mad about Twillo's choice here.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#42

Post by soco »

YXNjaGVyZWdlbgo wrote: post #33
ChrisDutrow wrote: post #13

Earlier quoted context omitted.

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#43

Post by YXNjaGVyZWdlbgo »

soco wrote: post #42
YXNjaGVyZWdlbgo wrote: post #33

Earlier quoted context omitted.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

And where are those people receiving the spam message in the first place? From Twilio's system right. If they are so good at detecting it circulating internally, why didn't they detect it and block it in the first place?

It is simply against the ToS to send spam over twilios network. Objectively this is what OP is doing. You are allowed to receive spam maybe your core business even depends on getting spam numbers or analyzes the spam for phishing links itself. You can receive and ingest it in anything you want you just can't send it over twilio yourself. Sorry this is not a design flaw this is just a bad workflow.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#45

Post by onphonenow »

Turing_Machine wrote: post #32
onphonenow wrote: post #17

Earlier quoted context omitted.

I'm actually very glad Twilio doesn't allow itself to be used for SMS spam. I hate SMS spam. Twilio doesn't know that these are "employees".

If Twilio can detect that it's spam, surely the correct procedure would be to block it when it first comes into Twilio's system from outside, not blindly forwarding it to a customer's list and then blaming the customer for it! Sorry, this is just bad design. Re: > The customer may want to handle / filter the spam. Then provide the customer with a "yes, send me all the spam" option. Which do you suppose is the common…

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service.

Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#46

Post by csdvrx »

SN76477 wrote: post #6
daneel_w wrote: post #4

It's been a year or two since Twilio became so large that the left hand has no idea what the right hand is doing. You have my sympathies. Good luck.

They were also a nightmare for us. We had to find another provider.

Could you recommand one that provies SIP trunking and number porting?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#47

Post by jlundberg »

ChrisDutrow wrote: post #13
fatnoah wrote: post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

This is not quite right. We aren't sending the messaged from the original number. As far as I know, that isn't really possible because we don't "own" that original number. The business case of relaying inbound text messages to an employee's phone number should be a very common one and should not warrant an account suspension.

This is actually technically possible in the networks, at least here in Europe (generally).

However, obviously allowing such sms forwarding have to be done with care.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#48

Post by onphonenow »

Xylakant wrote: post #26
onphonenow wrote: post #17

Earlier quoted context omitted.

I'm actually very glad Twilio doesn't allow itself to be used for SMS spam. I hate SMS spam. Twilio doesn't know that these are "employees".

Twilio could fairly easily verify that the phone number owner consents: when setting up the recipient number, allow for double opt in - send a verification code that must be entered somewhere.

Twilio does not allow a user to "consent" to receive spam.

This is specifically covered in their ToS by the way.

"We never allow some types of content on our platform, even if our customers get consent from recipients for that content."

This is for the simple reason that a lot of folks are using Twilio for application to person / transaction messaging - and the key to delivery quality is to have no crap content going out.

If you operate an open relay for email - your IP address is going to be blacklisted very quickly. Same here, if twilio allows spam and fishing to go out, deliverability is going to go way down. Down the chain people don't know folks have "opted in" to the facebook phishing emails.

Sign up here for a code to win XXX. Then they send you the code (which is the twilio opt in code) and bam, you are in the spam list. All these things have happened on the email and other platforms side already.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#50

Post by onphonenow »

boardwaalk wrote: post #25
onphonenow wrote: post #17

Earlier quoted context omitted.

I'm actually very glad Twilio doesn't allow itself to be used for SMS spam. I hate SMS spam. Twilio doesn't know that these are "employees".

Maybe they should know they are employees? i.e. allow an employee to register their number and require inputting a texted code to confirm? (I don’t know if they do, not a customer.) This does seem like a very common use case that Twilio needs to not punish.

No, they aren't designed for this use case. Sending messages from third parties is always MUCH higher risk then sending your own messages.

Same principal with money transfer. If you start accepting money from someone to transfer to another person that is MUCH MUCH higher risk - every bank / online payment player should be looking out for that and probably getting you into a different account type.

Twilio is clear, they are designed for systems where you message folks.

Post reply on HN