Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How SMS fraud works and how to guard against it

apuchitnis.substack.com

Post reply on HN
Print view View original

81–90 of 107 posts

Re: How SMS fraud works and how to guard against it

#81

Post by dheera »

codetrotter wrote: post #69
dheera wrote: post #52

Earlier quoted context omitted.

How is this fraud? If you require me to use SMS (deprecated), you are doing me a disservice and you should pay for the consequences. Use e-mail. It's free, works across countries, across SIM cards, allows for alphanumeric IDs, and is decentralized and not controlled by telcos.

> Use e-mail. It's free And the email that my service sends you so that you can complete registration will land straight in spam where you won’t find it. I’ll stick to SMS for activating accounts.

I don't receive SMS, so I won't find that either. It's dated tech and I deprecated it 10 years ago.

Also, we're SIM-swapping global nomads now, not some potatoes that sit on a couch in one country all year long. Phone numbers don't work anymore.

Re: How SMS fraud works and how to guard against it

#82

Post by bevenky »

pg_bot wrote: post #5

If you haven't done this, set the MaxPrice field when sending SMS with an API provider such as Twilio. The message will fail to send if the cost of the sms exceeds the price you set. https://support.twilio.com/hc/en-us/articles/360014170533-Us...

Founder of https://www.plivo.com here. We have seen similar patterns of fraud on our customers primarily in the international markets, outside the US & Canada. It typically happens on repeating number ranges that are sometimes not even in service. MaxPrice approach did not work well based on our experience as this would lead to just blocking certain destinations completely. Alternatively, what we found better was have a geo permissions related options where customers could block destinations that are never used at a network level and additionally introduce rate limits for those networks, so its not open to an attack. Plivo's console screenshot here: https://www.dropbox.com/s/kbw3l0oyw7fcjmr/plivo_console_sms_...

Re: How SMS fraud works and how to guard against it

#83

Post by miskin »

flangola7 wrote: post #80
alwayslikethis wrote: post #67

Earlier quoted context omitted.

It's still mostly used for malicious tracking. In many countries you have to use your identity to get a phone number, and SMS verification exploits this to track users.

Never heard of getting a convenience store burner phone for cash?

This is not possible in most of EU markets, KYC is mandatory and even prepaid SIM cards must be registered and verified with ID before SIM is used for data or calls. Old SIMs without registration were blocked until they would be registered. Some exceptions may exist, but this will be harder and harder in future.

Re: How SMS fraud works and how to guard against it

#84

Post by edmundsauto »

dheera wrote: post #81
codetrotter wrote: post #69

Earlier quoted context omitted.

> Use e-mail. It's free And the email that my service sends you so that you can complete registration will land straight in spam where you won’t find it. I’ll stick to SMS for activating accounts.

I don't receive SMS, so I won't find that either. It's dated tech and I deprecated it 10 years ago. Also, we're SIM-swapping global nomads now, not some potatoes that sit on a couch in one country all year long. Phone numbers don't work anymore.

You may be in the minority here. As you are the only one inconvenienced, it also seems like a reasonable decision.

Re: How SMS fraud works and how to guard against it

#85

Post by jbverschoor »

rlpb wrote: post #29
Arch-TK wrote: post #12

I really want to know, why has everyone moved to SMS 2F"A"? What was wrong with authenticator applications? Were they really THAT user unfriendly?

AIUI, EU regulation requires 2FA in finance now, but the 2FA must also confirm details such as a target account and/or amount. Authenticator apps (at least those that use TOTP/HOTP) can't do that. SMS can. So can card readers but people hate having to carry them around. So we're stuck with SMS.

You can use the app as a second factor. But you’ll need to transfer on your pc

Re: How SMS fraud works and how to guard against it

#86

Post by jbverschoor »

cfn wrote: post #11
AdamJacobMuller wrote: post #2

This makes the assumption that Twitter blocked it due to SMS fraud. While that's a plausible theory an equally plausible theory is that they were worried about account hijacking and security (and allowed twitter blue subscribers to continue to use it on a you can pay me to be stupid context) which seems equally plausible. I take issue with a lot of the assumptions in the article but this is funny: > Identify and bloc…

Elon Musk said that they were being fleeced by SMS fraud when the change was announced.

And not for blue? It’s just a lame excuse foe the insane price of als using twilio.

If he stated the truth: sms validation is costing millions per week, twillio would lose quite some customers, because companies would finally realize there’s another way that’s cheaper

Re: How SMS fraud works and how to guard against it

#88

Post by highclass »

pg_bot wrote: post #5

If you haven't done this, set the MaxPrice field when sending SMS with an API provider such as Twilio. The message will fail to send if the cost of the sms exceeds the price you set. https://support.twilio.com/hc/en-us/articles/360014170533-Us...

Does anyone know of a good maximum price cutoff to use for SMS that would allow most non-fraudulent messages while blocking expensive fraudulent ones?

Re: How SMS fraud works and how to guard against it

#89

Post by GoblinSlayer »

brewdad wrote: post #78
rootusrootus wrote: post #56

Earlier quoted context omitted.

> it's pretty rare for me to see a financial company offer the option to set up an Authenticator 2FA As a data point, USAA (which is not the biggest bank, of course, but it is not tiny either) has supported TOTP for years. There are probably others, but at least some banks support relatively modern security.

My credit union supports TOTP. They also sent me a one time code generator thingy that I can use as a 2nd factor. Trouble is, there's a big link on the login screen that will allow anyone to bypass those options and fallback to SMS or email.

The real meat is in password recovery options.

Re: How SMS fraud works and how to guard against it

#90

Post by tzs »

crazygringo wrote: post #46
mcherm wrote: post #33

Earlier quoted context omitted.

There are numerous tools, Google Authenticator and Authy for example, that protect against this by securely storing the keys. In fact, I would venture to say that MOST users of authentication apps are using ones that provide a backup in case the phone is lost.

No, Google Authenticator does not securely store keys anywhere but your physical phone. If you lose your phone, they're gone. The only thing it provides is a way to export from one device to another, but that requires having the first device still with you. [1] On the other hand, yes fortunately Authy does provide cloud backups. But your average end user generally doesn't have the slightest idea of why they should us…

Note that the export on the source device doesn't seem to have any way to actually know whether or not you are actually setting up a new phone. It just makes QR codes with the keys for groups of accounts that Google Authenticator on a new device can scan to import those accounts.

I can't see any reason you couldn't start the export process without having a new phone and take screenshots of the QR codes, then back those screenshots up to some secure place.

You should be able to later use those screenshots to restore those accounts to a new phone without needing to have the old phone.

I don't use Google Authenticator so have not tried this.

While the above should work, I'd recommend saving the QR code for each site when you sign up for TOTP at that site. That way you can easily transfer to any other TOTP authenticator. The Google Authenticator export seems to make QR codes that combine multiple accounts and I'm not sure any other authenticators would know what to do with those.

Post reply on HN