[0]: for some level of security. My father was a farmer at that time and I know he wasn't talking about a nation state adversary ;-)
Just for fun i went ahead and verified 2024561414 with the demo of this thing. It gave me a nice little check mark showing that I was definitely the White House
I believe the SMS verification is something that companies use to avoid liability alone, technically they can use any number as the caller ID if they choose to.
I've worked in VOIP quite a bit, and even built a product based on the fact you can fake caller id over SIP i.e. "keep your number but lower your outgoing call rates"
https://developers.facebook.com/docs/accountkit/overview
What do you guys think?
I'm getting tired of services that only accept facebook users. Having a facebook login or any other facebook service requiring the user to be a facebook user is not bad in itself (and can be pretty useful), but it should _always_ have an alternative.
That's why I think projects like Dial2Verify Twilio are a great thing. They're still not perfect though, as some said here on HN.
The problem is, a lot of people will find this cool and will also not evaluate the threat landscape. In fact, it's even worse. They will assume the threat landscape has already been evaluated. The code is out there, so it must be good. They will then implement this into some "super duper secure" service which should require a far more security for user authentication. It will then take me 15 minutes of pulling my hair out in a security review to explain to whomever implemented it that it offers no security. The team will walk away from our meeting wondering if I was just trolling them and ask how their entire team could have made this mistake. They will then come to the conclusion they are smart and I must be wrong. They'll then call me back to explain again, at which point I'll take them through a full video demonstration with their VP of operations on the call. This time they will actually "get it" because they saw it exploited on video. Their VP of operations will then fire the project manager and lead developer and I'll feel like shit for being responsible for the termination of two careers.
Another example - you can't use uber on a desktop without going to m.uber.com last I checked. There's no way to order trasnportation without that m. (why!)
Another - gmail. You either need another email or a phone, and at the time, neither were possible. (why!!)
For tons of reasons, I just don't like having a phone in my pocket 24/7/365. Mostly, I just enjoy the peace of mind of being unreachable. I've been oncall for years, but that oncall vibe is extending more and more into social situations, for the worse. I hate it. Devs - PLEASE account for those like me! I'm really tired of people telling me (accurately :(.) "You wouldn't have these issues if you had a phone." on account of your laziness or lack of awareness for sensible security.
Note, I'm not a criminal, I just play one in my day job.
https://gigaom.com/2011/12/13/indias-missed-call-mobile-ecos...
You can get more than 1-bit of information as well if you sync the clock on your phone with the recipient. That gives you approximately 3.3 bits of information if you use the minute modula 10. This only works if you previously agree upon a meaning for values (Mod 0: Yes, Mod 5: No, etc).
Also, I have to assume Twilio would look at this as a form of abuse.
They can't, that's why there's an ever-increasing amount of verification.
Just pay the 0.02¢ or whatever phone services charge these days. If your business is actually big enough to have to worry about phone verification, do it right. Users don't like to call your number since they don't know the costs associated with it (especially international users). Furthermore, it makes number spoofing much harder.
The classical text message verification schemes barely have this issue in most of the world as the recipient pays nothing, but of course the sender gets billed instead.
Could we also do phone verification at no cost, however instead by outbound call? Is there any free/paid host providing such service?
