Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#51

Post by ejb999 »

YXNjaGVyZWdlbgo wrote: post #40
Turing_Machine wrote: post #38

Earlier quoted context omitted.

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

>>You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

As opposed to just shutting down the customer because TWILIO forwarded the spam, that we already know that it can detect?

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#52

Post by ejb999 »

themerone wrote: post #28

> I don't need tech support, I just need someone to call, explain the situation to, and have them click a button. What you are describing is tech support.

>>What you are describing is tech support.

No that is customer support - big difference.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#53

Post by exsmelliarmus »

willcipriano wrote: post #41
tobyjsullivan wrote: post #34

Earlier quoted context omitted.

There are two layers here. 1) You're absolutely right that the account ends up texting out a phishing link which any automated system would rightfully detect as phishing (regardless of whether the recipient has "consented" to receiving the message - it still contains a phishing link). But that's not the real issue, which is 2) Twilio's response to detecting the sending of a phishing link (possibly more than one) is t…

As a text message recipient, I can't say I'm mad about Twillo's choice here.

I’m assuming you would be if your business was harmed through an honest mistake.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#54

Post by alberth »

yosito wrote: post #49

Suggestion to Twilio, if you're reading: if you have the ability to detect spam messages, perhaps give your users an API call for filterSpamAndSend instead of just send.

The carrier (ATT, Verizon, etc) probably flagged this as spam - not Twilio.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#55

Post by YXNjaGVyZWdlbgo »

ejb999 wrote: post #51
YXNjaGVyZWdlbgo wrote: post #40

Earlier quoted context omitted.

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

>>You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes. As opposed to just shutting down the customer because TWILIO forwarded the spam, that we already know that it can detect?

If you have a business that deals with spam texts or if you host a honeypot for whatever reason you are allowed to do it. You are allowed to receive spam and do whatever you want with it except sending spam over twilio itself because it's against their ToS and to protect their own core business from getting their numbers blacklisted.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#56

Post by jeremyjh »

onphonenow wrote: post #45
Turing_Machine wrote: post #32

Earlier quoted context omitted.

If Twilio can detect that it's spam, surely the correct procedure would be to block it when it first comes into Twilio's system from outside, not blindly forwarding it to a customer's list and then blaming the customer for it! Sorry, this is just bad design. Re: > The customer may want to handle / filter the spam. Then provide the customer with a "yes, send me all the spam" option. Which do you suppose is the common…

False. The customer may want to handle / filter the spam. The customer may be do a study of spam. The customer may be offering their customers a spam blocking service. Fine to provide an option to filter it perhaps, requiring twilio to block what it THINKS is spam is a recipe for disaster, spam filters are no where near perfect.

> requiring twilio to block what it THINKS is spam is a recipe for disaster

Yet they are disabling the entire account when they think it has sent spam.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#57

Post by willcipriano »

exsmelliarmus wrote: post #53
willcipriano wrote: post #41

Earlier quoted context omitted.

As a text message recipient, I can't say I'm mad about Twillo's choice here.

I’m assuming you would be if your business was harmed through an honest mistake.

I'm the kind of person who would be mad at my choices in that case. If I failed to plan for that sort of thing it's on me. "What of someone sends abuse to my text message forwarder?" isn't all that out there of a question.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#58

Post by marcosdumay »

yellow_lead wrote: post #37
marcosdumay wrote: post #30

> I should be considering bearing in mind that it would be expensive to re-write the software to work with another vendor Well, maybe next time you get somebody that implements a standard. With that kind of behavior (not letting you speak to anybody, the blocking is understandable), it's clear you shouldn't keep their services. So, you have now an opportunity to do it right, and make the next move cheaper.

There isn't a standard for these apis though

VoIP is entirely based on SIP, everywhere. Those providers just add a proprietary API over it. But if the use case is just sending texts, that one may evade the standard (I don't remember it entirely, and it certainly evolved since last I used it).

But then, if they were only sending texts, migrating wouldn't be expensive.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#60

Post by em-bee »

YXNjaGVyZWdlbgo wrote: post #40
Turing_Machine wrote: post #38

Earlier quoted context omitted.

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.

if twilio can not differentiate between inbound messages that are being forwarded and outbound messages that are created by the twilio customer then their service can't guarantee to be reliable because someone could basically create a DOS attack by sending spam to any twilio customer expecting that twilio will blame their customer and suspend the account.
Post reply on HN