3 ms·

A few years ago I worked for a company which was sending many hundreds of thousands of Twilio SMS messages and observed a lot of undefined behavior at scale. So

by tmpz22 7y ago

A few years ago I worked for a company which was sending many hundreds of thousands of Twilio SMS messages and observed a lot of undefined behavior at scale. Sometimes messages would be delivered twice, sometimes messages would take hours (or days!) to send, and sometimes messages weren't sent at all (even though we were charged for them). I received all sorts of "explanations" most of them naming various intermediaries in the pipe using opaque black lists and undisclosed rate limiting. Is the SMS backbone in the US reliable during peak traffic (such as at a large sporting event or in an emergency situation) such that I can trust it as a single-point-of-failure for critical applications, and how does the US SMS backbone compare to that of other countries with less investment in their IT infrastructure? Finally, how vulnerable is SMS messaging to snooping by authoritarian governments compared to other forms of authentication? FWIW this is definitely a project i'll be following, from the perspective that authentication can often be a "bounce-point" for new users of consumer applications and superior authentication strategies can translate directly to $ales.

putrikarunia 7y ago
Hi, yes we feel the problem with SMS and how delivery rate is often not 100%. If I may ask, what do you guys use the SMS for? I'm not too sure how reliable it is during peak traffic, but I think probably best not to use SMS as a single point of failure. And yes SMS in other countries are more expensive and less reliable. In our case, the SMS is not used to login users (we use trusted devices). This should reduce the reliance on SMS - only for verifying that the phone number is active. Our cross-app phone number verification also makes it so that if a user already entered SMS otp in just 1 app, they don't need to enter it again in other apps. Additionally, we're looking to integrate WhatsApp to solve this. About snooping by government officials, I'm not really sure how this applies, but basically since we don't use the SMS OTP for logging in, there is no SMS code to be shared with government officials to allow them to login to someone's account. In our case, the logins would be based off a cryptographic key that is stored in the device's secure storage. As far as I know, this should be pretty safe according to the documentations, that keys cannot be extracted from the hardware. Let me know if I'm not answering your questions :)
woodrowbarlow 7y ago
> Is the SMS backbone in the US reliable during peak traffic (such as at a large sporting event or in an emergency situation)? (anecdata) i was at the first women's march in Washington DC the day after our current president's inauguration. in the midst of it, there was zero connectivity -- nothing could get through to the network. as you made your way towards the edges (several miles), SMS became usable far before voice calls. the day before, for the inauguration, the government had arranged for cell phone providers to install portable signal-boosting appliances to handle the increased number of people. (these were switched off before the women's march, but the hardware was still physically present.) i imagine places like large sports stadiums do something similar.

by tmpz22 7y ago

putrikarunia 7y ago

Hi, yes we feel the problem with SMS and how delivery rate is often not 100%. If I may ask, what do you guys use the SMS for? I'm not too sure how reliable it is during peak traffic, but I think probably best not to use SMS as a single point of failure. And yes SMS in other countries are more expensive and less reliable. In our case, the SMS is not used to login users (we use trusted devices). This should reduce the reliance on SMS - only for verifying that the phone number is active. Our cross-app phone number verification also makes it so that if a user already entered SMS otp in just 1 app, they don't need to enter it again in other apps. Additionally, we're looking to integrate WhatsApp to solve this. About snooping by government officials, I'm not really sure how this applies, but basically since we don't use the SMS OTP for logging in, there is no SMS code to be shared with government officials to allow them to login to someone's account. In our case, the logins would be based off a cryptographic key that is stored in the device's secure storage. As far as I know, this should be pretty safe according to the documentations, that keys cannot be extracted from the hardware. Let me know if I'm not answering your questions :)

woodrowbarlow 7y ago

> Is the SMS backbone in the US reliable during peak traffic (such as at a large sporting event or in an emergency situation)? (anecdata) i was at the first women's march in Washington DC the day after our current president's inauguration. in the midst of it, there was zero connectivity -- nothing could get through to the network. as you made your way towards the edges (several miles), SMS became usable far before voice calls. the day before, for the inauguration, the government had arranged for cell phone providers to install portable signal-boosting appliances to handle the increased number of people. (these were switched off before the women's march, but the hardware was still physically present.) i imagine places like large sports stadiums do something similar.