Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Twilio suspended account because someone sent us a fraud text

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 207 posts

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#181

Post by ipaddr »

ChrisDutrow wrote: post #124
chc wrote: post #97

Earlier quoted context omitted.

If you're going to hold people responsible for meeting a metric, you need to ensure they have a way of measuring the thing in question. To do otherwise is unreasonable by definition. If Twilio's definition of "sending spam" matched the OP's, where it's about sending messages the user did not agree to receive, then that would be reasonable. But instead it's something more intangible. And like you say, they do need to…

Exactly. Also I should point out that we weren't sending spam. It's just relaying the messages that we receive internally. I would think sending spam would be more if we allowed people to sign up for a our service and then people used it to send spam. But these are all internal communications.

You weren't sending spam just relaying is saying the same thing. Otherwise you could spam yourself and use that to send messages to a group of phones who could do the same thing. See the problem? I'm sure if this was a feature it was already exploited and patched.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#182

Post by ipaddr »

Sohcahtoa82 wrote: post #138
YXNjaGVyZWdlbgo wrote: post #93

Earlier quoted context omitted.

Because they are not in the business of filtering spam they are in the business of receiving and delivering messages. The spam filtering outbound is to protect their own core service. Running spam protection for your own service is a lot different to offering spam protection for customers.

Do you not see how spam protection for customers IS spam protection for your own service? They already detect outgoing spam. Good customer service in this case would be to detect that a customer is attempting to send spam and blocking it and potentially notifying them about it.

Someone sending 50 maybe 100s of spam messages at the same time is going to get anyome automatically shutoff.

Sending one and the system might not have detected the spam. It's not visiting the link. But send many at once the system gets curious.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#183

Post by Nexxxeh »

foota wrote: post #141
jdavis703 wrote: post #73

Earlier quoted context omitted.

If someone has already written a custom integration, how hard can it be to wire it up to a spam detection API? It sounds like the integration was sending spam (not intentionally of course), which none the less is a TOS violation. If they can’t update the integration with spam filtering, then it seems like they should be using COTS software.

Is sending an employee a message they've elected to receive ever spam in some sense? If the reflection were to an arbitrary number then I'd say so, but simply forwarding to a specific number you're working with seems... Fine. Maybe it's different too if it's a solution you're selling, but even then that's somewhat between you and the customer. I guess if twilio has negative impacts as a result of the perceived spam t…

It was only spam on the inbound leg. On the outbound leg, it was requested and correct content.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#184

Post by YXNjaGVyZWdlbgo »

mindslight wrote: post #177
YXNjaGVyZWdlbgo wrote: post #174

Earlier quoted context omitted.

These messages are subjectively spam for the platform you use if they specified it in their ToS you have no right to force them to serve you.

Yet again you're just stating a technical description as if it implicitly justifies the state of things. Nobody here is confused about how Twilio can legally do this or how market incentives encourage them to do so. We're discussing a higher level behavior and what ought to be. And getting a critical service pulled out from under you based on overzealous unaccountable spam filtering is certainly not what ought to be.

No we are not. You are.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#185

Post by pauldd7 »

Twilio deleted our account, phone numbers and thousands of audio recordings after we sent them a request to port a single number to a different account. Support admitted it was a mistake on their end but insisted there was nothing they could do except have us open a new account, and they could try and restore any unreleased numbers back.

All data was lost, number ID's, account ID's all completely different. It took us a LOT of dev hours to update everything, whilst losing some of our customers. Twilio is cheap, fun and dev friendly until they mess up, then you're on your own.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#186

Post by pauldd7 »

ChrisDutrow wrote: post #119

UPDATE::::: Due to Greg from Twilio seeing this post and providing me a way to reach out, I was able to get the problem resolved. He spent about an hour on the phone with me today and provided some more information about the issue. A few highlights: * Twilio has doubled in size since the beginning of the pandemic * Spamming and phishing through text message has gotten a lot more common very recently. These two things…

They only have people like Greg reaching out to you when your problem is posted on HN. They would have continued to ignore you had you not had the same reaction on HN. They've screwed up big time with us in the past and Greg wasn't reaching out.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#187

Post by throwaway12_34 »

techsupporter wrote: post #92
_hyn3 wrote: post #71

Earlier quoted context omitted.

Wonder if it runs on Twilio..

I don't know what the SMS service part of Pushover uses as we don't send SMS through Pushover. The part we use, the main feature, sends a notification through an app the user installs on their device. All of us who receive push notifications through our system have the Pushover app on our phones, some also have it on their tablets and computers. I like the Apple Watch integration as I can interact with urgent notific…

Interesting. I had an app, that had pretty much this functionality. Read the SMS from a phone and send a push notification with the content to a second phone. Google killed it though, because they said it does not have a legitimate reason to read SMS. Still a bit bitter about it.

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#188

Post by stefanve »

Turing_Machine wrote: post #38
YXNjaGVyZWdlbgo wrote: post #33

Earlier quoted context omitted.

The fact is that you are sending spam over twilios network even if it's just to your own employees. You are also saying it is not the first time it happens and you seem to have done noting to mitigate the problem at hand furthermore is it an attack vector for phishing against your company. The fact that you are not ingesting the text into another system is also a bit concerning how do you handle GDPR requests? If you…

Here's what's happening, as I see it (corrections welcome): 1) Spammer sends spam to customer's Twilio number. 2) Customer has this number set up to forward incoming texts to employees. 3) Customer has no available API to detect whether texts are spam. 4) Twilio apparently can detect that this message is spam, but rather than simply dropping it at step 1, they're blaming the customer. Sorry, there is no scenario unde…

imagine that email providers would have used the Twilio way......

Re: Ask HN: Twilio suspended account because someone sent us a fraud text

#190

Post by ChrisDutrow »

FateOfNations wrote: post #180
ChrisDutrow wrote: post #142

Earlier quoted context omitted.

Ok so are you saying that Twilio cannot be used to rely messages from company phone numbers to employee cells phones? I would understand if this was an edge case, but my understanding is this is a quite common and a core use case. I'm pretty sure this exact use case is in their basic tutorial.

All the recipient's carrier knows is they see a spam or phishing message originating from Twilio, and (profess to) have a zero tolerance for spam/phishing. They have no idea about context of the "forward to consenting employee" use case or any way of validating it. If there is any possibility that those messages could be interpreted as spam, that doesn't seem to be a valid use case for Twilio (any more). You could fo…

I think you are right that it's not a valid use case anymore, even if they still assert that it is, because the reality is that it caused this problem. Even if they had responded to me immediately, my phones would have been shut down overnight.

Also, I was looking into the pricing a few months ago and its kind of expensive because I'm actually paying for two text messages: One for the incoming one, and one for the forwarded one.

The code has been working this way since maybe 2015, possibly before (its been so long, I can't remember). I've been using Twilio since I think 2010. I started out just doing call forwarding and later on added text messaging when customers started to expect to be able to text message us.

At the time, it was a core use case. There was a tutorial and everything "Forward text messages to your phone in a few lines of code".

Post reply on HN