Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#121

Post by yodon »

ChrisDutrow wrote: post #62
andrei_says_ wrote: post #39

Earlier quoted context omitted.

Greg, it would be very useful if you could recommend a setup which would allow forwarding sms to employee numbers without the risk of account suspension. Many of us use twilio and an account suspension is an undesirable scenario. “Forward unless spam/problematic” would be very nice.

I just talked to Greg, he said something that might help would be to add "FWD: " before the forwarded message. Or possibly "Forwarded from XXX.XXX.XXXX: " I can confirm that my system did forward the message without any modifications at all. (my employee knew what it was because he knows all text messages from that number are forwards)

This sounds like a highly problematic solution. If twilio actually greenlights spam that starts with "Forwarded from XXX.XXX.XXXX:" as Greg suggests, you can be sure actual spammers reading this thread will catch on and start sending spam texts with a header intro like that, probably by EOD today.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#122

Post by ChrisDutrow »

madars wrote: post #88
vorpalhex wrote: post #8

Earlier quoted context omitted.

I have set up a few twilio accounts like this where a business number blindly forwards to the business owner's personal cell, maybe some logic for business hours and holidays. If twilio wants us to start filtering spam messages for these cases, they need to give us the API/tooling. Or let us pre-register receiving numbers through an opt-in process. I understand Twilio not wanting to be an open relay but the reported…

Yeah this sounds highly problematic. Maybe in the meantime you can text links to your own portal instead. I.e. "New SMS received from +123... . Read it at: https://your-internal-infrastructure.com/sms/[GUID] " (maybe with a simple login so Twilio auto-fetch, if any, gets a benign page). That way there is no spammer-controlled message content (apart from the phone #) in the message you send. Or convert them to jpeg an…

Yes, these are very good ideas. Didn't even think of the JPEG one, very cool!

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#123

Post by ChrisDutrow »

jdavis703 wrote: post #73
vorpalhex wrote: post #8

Earlier quoted context omitted.

I have set up a few twilio accounts like this where a business number blindly forwards to the business owner's personal cell, maybe some logic for business hours and holidays. If twilio wants us to start filtering spam messages for these cases, they need to give us the API/tooling. Or let us pre-register receiving numbers through an opt-in process. I understand Twilio not wanting to be an open relay but the reported…

If someone has already written a custom integration, how hard can it be to wire it up to a spam detection API? It sounds like the integration was sending spam (not intentionally of course), which none the less is a TOS violation. If they can’t update the integration with spam filtering, then it seems like they should be using COTS software.

I'm already using a spam detection API. But remember those things don't block all spam.

Also, there are other ways to solve this specific problem given that they are intent on auto-suspending my account in this type of context. I could relay the messages using a different platform as an example.

Thats not really the point though. Me not paying for the spam API or not using it when I relay messages internally to employees is not a good reason to shut my whole business down and not give me a way to contact them. This should be obvious.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#124

Post by ChrisDutrow »

chc wrote: post #97
YXNjaGVyZWdlbgo wrote: post #93

Earlier quoted context omitted.

Because they are not in the business of filtering spam they are in the business of receiving and delivering messages. The spam filtering outbound is to protect their own core service. Running spam protection for your own service is a lot different to offering spam protection for customers.

If you're going to hold people responsible for meeting a metric, you need to ensure they have a way of measuring the thing in question. To do otherwise is unreasonable by definition. If Twilio's definition of "sending spam" matched the OP's, where it's about sending messages the user did not agree to receive, then that would be reasonable. But instead it's something more intangible. And like you say, they do need to…

Exactly. Also I should point out that we weren't sending spam. It's just relaying the messages that we receive internally.

I would think sending spam would be more if we allowed people to sign up for a our service and then people used it to send spam.

But these are all internal communications.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#125

Post by somehnguy »

grouseway wrote: post #3

For an alternative, maybe relay the texts to a slack channel (that's easy enough to receive on a phone for your coworkers). Zapier can probably integrate twilio/slack quickly.

I use Slack like this for various notifications. I just setup a new Slack instance and created channels for each notification area (smart home, media server, etc). Now all the software in those various areas can send messages (via webhook) and I can set the alert preferences per channel. Makes it easy to quickly look at Slack and know things are running fine.

I also have a #critical channel anything can post to that always has alerts enabled on my phone so I don't miss anything important.

It actually works pretty well and costs nothing.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#126

Post by ChrisDutrow »

yodon wrote: post #121
ChrisDutrow wrote: post #62

Earlier quoted context omitted.

I just talked to Greg, he said something that might help would be to add "FWD: " before the forwarded message. Or possibly "Forwarded from XXX.XXX.XXXX: " I can confirm that my system did forward the message without any modifications at all. (my employee knew what it was because he knows all text messages from that number are forwards)

This sounds like a highly problematic solution. If twilio actually greenlights spam that starts with "Forwarded from XXX.XXX.XXXX:" as Greg suggests, you can be sure actual spammers reading this thread will catch on and start sending spam texts with a header intro like that, probably by EOD today.

I think one of the key contexts here is being forgotten:

These are all internal messages. Someone cannot use our system to text random people. It's literally one person seeing them. We're a local service company. We're not SAAS or something like that. It's just people messaging us "Hey can you guys come Thursday?"

This would be like if you signed up for a VOIP provider for your business phones and they suspended your account because someone sent you a phishing text message.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#127

Post by ChrisDutrow »

helloworld11 wrote: post #84
jbkiv wrote: post #24

Earlier quoted context omitted.

Makes total sense. If you buy a subscription for few dollars/month, don't expect a human being to answer your call. Google/Twillio/Sendgrid, whatever the service, all the same ticketing system and no real answer. HN crowd looks down on sales reps. But a good sales rep will 1) understand your business 2) will look for ways to match your needs to solutions they offer 3) will be your point of contact when things go wron…

I've dealt with several web hosting companies that had fully human operators respond very nicely when I had a problem even though my monthly hosting fees were tiny, rarely more than $20 per month. It's not impossible to offer a low cost service and still avoid being an unresponsive piece of shit to clients.

Yeah GoDaddy and HostGator are like this.

Amazon EC2 is not.

Also Google treats businesses like this if they have profiles on their maps. A business might rely on their google maps profile for 100k+ in revenue, but they can't get someone from google on the phone to help deal with it. I had someone steal my google maps listing from me and they got away with it because google would not connect with me about it. It was horrible and it was wrong.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#128

Post by rsync »

fatnoah wrote: post #2

> Temporarily, I will re-program the system so that it does not forward text message content to my employees phone numbers. I might be reading this wrong, but it sounds like you take inbound text messages to one number and then send outbound messages with the same content to employee phone numbers. Is that right? If so, that sounds like you're SENDING the spam messages in addition to receiving them. Regardless, it so…

"If so, that sounds like you're SENDING the spam messages in addition to receiving them."

This is a bizarre and almost intentionally obtuse interpretation of the ops problem (albeit literally correct).

If I have built an auto-forward between two endpoints that I control (or at least have permission or authority over) I am not a bad actor in any capacity.

A much more appropriate workflow here would be for Twilio to cross-check this "spam" with inbound spam into twilio itself for some other number his account controls.

Which is to say, if a Twilio account originates a suspect message, first check to see that suspect message was sent, inbound, to it before auto-DoSing an entire business. This shouldn't be too tough, especially since these events probably occur in step with each other.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#129

Post by mfkp »

howdydoo wrote: post #9
grouseway wrote: post #3

For an alternative, maybe relay the texts to a slack channel (that's easy enough to receive on a phone for your coworkers). Zapier can probably integrate twilio/slack quickly.

Then what do you do when Slack bans your account?

Self-host Zulip - which in my opinion is better than Slack anyway and supports slack incoming webhooks.

https://zulip.com/

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#130

Post by [deleted] »

ChrisDutrow wrote: post #117
YXNjaGVyZWdlbgo wrote: post #87

Earlier quoted context omitted.

It's not even good business practice you are paying for something that is essentially free if implemented in every other way. This is not creative this abusing a system going against their ToS and blaming them for your own failure. I am suggesting you ingest the received messages and distribute it any other way like a lot of twilio customers probably do. This is merely a hack and a bad one at that.

Quoted post unavailable.

[deleted]
Post reply on HN