dial2verify-twilio
Security and privacy
phone number verification
SHOW HN2016
How HN took it
1 positive, 12 neutral or asking, 0 mixed, 7 critical, out of 20 comments about the project. Thread score -0.30.
Idea: 0 for, 3 againstExecution: 0 for, 1 againstPrivacy: 0 for, 1 againstPricing: 0 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
Objections
Caller ID can be spoofed, so verification is insecure
From 3 comments
I may get down voted for this and so be it, this must be said. This is a prime example of creating what was intended to be a security feature without understanding the threat…
patcheudor on HNIt's relatively easy to change/fake the caller ID of phone calls so unfortunately this approach isn't really secure. That's why phone number verification usually places an…
gst on HNBasically, because there is no verification/validation surrounding caller id - https://en.wikipedia.org/wiki/Caller_ID_spoofing
nmjohn on HN
Twilio may treat it as abuse or adjust pricing
From 3 comments
So you can only verify, at best, one user every 90 seconds? Also, I have to assume Twilio would look at this as a form of abuse.
DDickson on HNSo... Twilio adjusts their pricing in 3... 2... 1...
jldugger on HNHowever isn't it considered a kind of exploit? Twilio never intended users to waste their VoIP traffic. Could we also do phone verification at no cost, however instead by…
cia48621793 on HN
Rate limit of about one verification per 90 seconds
From 1 comment
So you can only verify, at best, one user every 90 seconds? Also, I have to assume Twilio would look at this as a form of abuse.
DDickson on HN
International callers may be charged for per-minute calls
From 2 comments
Are you willing to make international users pay up to 80¢ per verification? If someone cancels a call, I still have to pay for one minute (it's only free if I cancel the call).…
Matt3o12_ on HNWould 'rejecting' the call result in the calling user's operator billing them, though? This is a major concern with international usage, given phone providers' tendency to...…
ntauthority on HN
Requests
Offer outbound-call verification instead of missed calls
From 2 comments
However isn't it considered a kind of exploit? Twilio never intended users to waste their VoIP traffic. Could we also do phone verification at no cost, however instead by…
cia48621793 on HNIt's relatively easy to change/fake the caller ID of phone calls so unfortunately this approach isn't really secure. That's why phone number verification usually places an…
gst on HN
Questions
How does caller ID spoofing work
From 1 comment
At the risk of sounding like I'm actually going to abuse this capability... if it's done "relatively easily", how is this done?
wfunction on HN
Alternatives named
Facebook Account Kit
From 1 comment
Hi, there's a free phone verification using facebook. It's account kit. https://developers.facebook.com/docs/accountkit/overview What do you guys think?
kevindeasis on HN
SMS verification
From 1 comment
Would 'rejecting' the call result in the calling user's operator billing them, though? This is a major concern with international usage, given phone providers' tendency to...…
ntauthority on HN
Indian missed call notification system
From 1 comment
Haha, this is the digital version of the Indian phenomenon of 'missed calls', used as 1-bit 0-cost notification mechanism. It's become such a cultural artifact, that big…
neil_s on HN