Seems like it’s his fault. I’m currently using the twilio API. A simple Python script could be used to filter out any messages that weren’t sent from an employee. He essentially has an unauthenticated open relay, a one way ticket to get put on a spam blacklist in the SMTP world.
Ask HN: Twilio suspended account because someone sent us a fraud text
81–90 of 207 posts
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#82Hey Chris, Greg from Twilio here. I'm so sorry for the frustration, lack of communication, and high friction to get this resolved. Want to drop me an email at gb@twilio.com and we'll see if we can get it sorted out?
The fact that this particular customer was only able to get a "friendly" human resolution for this by first posting about his problem on a tech-heavy social media platform like HN speaks very poorly about your company's customer service. I know that the giants like Google, Facebook et al shit all over their users now that they're large, but it would be nice to believe that it hasn't turned into a fad even among smaller companies doing it against their fully paying clients. Shameful.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#83Earlier quoted context omitted.
You are suggesting that a service that has no idea of what your business is should curate your data and "simply drop it"? yikes.
The are otherwise curating the data and calling it spam on the outbound, so… yes?
They're receiving the spam because it's sent to the customer.
They're sending spam when the customer asks.
They're also deciding that that customer is a customer no longer because of the choices that customer made with regards to sending spam, not receiving spam.
These are pretty different things.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#84My thought is that for any business-critical service, you need to have bought the service from person-to-person sales channels. Many boring meetings where they walk you through a slideshow of their service even though you already have it working. Many meetings worth of negotiating a price that's 10x the off-the-shelf price. All instead of, you know, making your product. It's just the cost of doing business -- $5/user…
Makes total sense. If you buy a subscription for few dollars/month, don't expect a human being to answer your call. Google/Twillio/Sendgrid, whatever the service, all the same ticketing system and no real answer. HN crowd looks down on sales reps. But a good sales rep will 1) understand your business 2) will look for ways to match your needs to solutions they offer 3) will be your point of contact when things go wron…
I've dealt with several web hosting companies that had fully human operators respond very nicely when I had a problem even though my monthly hosting fees were tiny, rarely more than $20 per month. It's not impossible to offer a low cost service and still avoid being an unresponsive piece of shit to clients.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#85Seems like it’s his fault. I’m currently using the twilio API. A simple Python script could be used to filter out any messages that weren’t sent from an employee. He essentially has an unauthenticated open relay, a one way ticket to get put on a spam blacklist in the SMTP world.
Except that "open relay" is to very specific numbers, not to just any # . I would like to think there must be a way to send whatever to authenticated / opted in numbers?
DISCLAIMER: I do work for TWLO, but on a completely unrelated division. My opinion and this message does not represent my employer in anyway. I'm just shooting the breeze here.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#86Not excusing their lack of support, but at the end of the day you sent a spam/phishing message through their service. What exactly are they supposed to do? If they don't immediately shut down accounts that send these messages, they're going to be in hot water with the cellular carriers. It's by far the lesser of two evils to just shut down accounts that send spam.
No, someone else sent a spam message into Twilio's system, and, rather than dropping it on the floor, Twilio's system then forwarded the spam on to their customer's list, then blamed the customer for it.
Nope, that's not how Twilio works. Yes, someone else sent a spam message, but Twilio did not forward it to "their customer's list" whatever that means. Twilio forwarded it to their customer's application, which was the end of the line for Twilio. At that point, their customer's application sent out that spam message to whoever was configured to receive it. As far as Twilio is concerned, the incoming and outgoing messages have no relation.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#87Earlier quoted context omitted.
The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…
I did mitigate the problem last time. I communicated with them and they told me it was fine. I'm very curious. Is this a communication mistake? Like do you think I'm some big company that forwards text messages to random people? Do you understand these are text messages being sent to one of like 3 employees at my small company? We are not generating outbound content or allowing anyone else to do so. Your question abo…
It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#88> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…
I have set up a few twilio accounts like this where a business number blindly forwards to the business owner's personal cell, maybe some logic for business hours and holidays. If twilio wants us to start filtering spam messages for these cases, they need to give us the API/tooling. Or let us pre-register receiving numbers through an opt-in process. I understand Twilio not wanting to be an open relay but the reported…
Yeah this sounds highly problematic. Maybe in the meantime you can text links to your own portal instead. I.e. "New SMS received from +123... . Read it at: https://your-internal-infrastructure.com/sms/[GUID]" (maybe with a simple login so Twilio auto-fetch, if any, gets a benign page). That way there is no spammer-controlled message content (apart from the phone #) in the message you send. Or convert them to jpeg and send as MMS hoping that Twilio won't OCR that :D
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#89Earlier quoted context omitted.
Twilio does not allow a user to "consent" to receive spam. This is specifically covered in their ToS by the way. "We never allow some types of content on our platform, even if our customers get consent from recipients for that content." This is for the simple reason that a lot of folks are using Twilio for application to person / transaction messaging - and the key to delivery quality is to have no crap content going…
> If you operate an open relay for email - your IP address is going to be blacklisted very quickly. Same here This doesn't sound like an open relay (since the incoming message can't be forwarded to arbitrary destinations), this sounds like a mailing list. And if my mailing list was banned because someone else sent spam to it, I'd be upset too.
I'm making the point that sending messages on behalf of others DRAMATICALLY increases the risk that you will send low quality messages. Spam, phishing etc.
I'm more surprised that folks don't get that.
Twilio is clear. You are responsible for all messages you send using their platform. They are clear in their terms that this applies EVEN IF you allow others to use your service in ways that result in crap going out.
They DO NOT want spam or phishing messages going out from their numbers.
Everyone here saying this is "bad design", outrageous or whatever has not had to deal with spammers / scammers. This simple rule, you are responsible, full stop, for what you send using our API's, and if you send crap, we will suspend you - probably saves them from 90% of the abuse issues they would otherwise deal with.
Downstream, T-mobile, verizon etc - they don't care that the message was "consented" to by someones supposed "employees". When their customer reports spam coming from one of these numbers and if that number is verified -> game over for twilio
Re: Ask HN: Twilio suspended account because someone sent us a fraud text
#90Earlier quoted context omitted.
if twilio can not differentiate between inbound messages that are being forwarded and outbound messages that are created by the twilio customer then their service can't guarantee to be reliable because someone could basically create a DOS attack by sending spam to any twilio customer expecting that twilio will blame their customer and suspend the account.
It's not their job to differentiate they are just a carrier they scan for outgoing spam to protect their own core business and to not get blacklisted everywhere. Read the ToS they are pretty specific about it.
but then they are simply not suitable for the use case of forwarding inbound messages because the risk is to great that i'll get shut down just because i am receiving spam.