3 ms·
This. A service I built+run started getting overrun with bot users. The signup CAPTCHA didn’t help because they’d sign-up for accounts using humans - then afte
by DaiPlusPlus 7y ago
This.
A service I built+run started getting overrun with bot users. The signup CAPTCHA didn’t help because they’d sign-up for accounts using humans - then after that’s done they’d copy their access tokens to the bot users. We couldn’t use a CAPTCHA for every operation on the platform.
But by requiring a real phone number that we verify (by placing a TTS phone call - not an SMS - as processing received TTS calls is much harder for the bot makers to automate) - but also looking-up the phone number’s SS7 info to prevent people from using Skype, Google Voice, and Twilio users - all commonly used by bot operators.
(Legitimate users that want an account but can’t make it past our bot screen can still contact us directly to be set-up - and to-date no-one has done this or complained about the (admittantly user-hostile) verification process.
- AlchemistCamp 7y agoI don't know what your service is but I simply wouldn't be able to use it as my only phone number is Google Voice. It's highly likely that prospective users just leave when encountering your restrictions and having their phone numbers rejected.
- DaiPlusPlus 7y agoIt’s a B2B service (“B2SB”?) - not targeting people/consumers - so it’s reasonable to assume they have a real phone number.
- erik_seaberg 7y agoWhich mobile carriers do you support, if not Google Fi (which is mine)? Or only landlines (which barely exist at my day job)?
- theelous3 7y agoMy last position was for a b2b voip telephony replacement type of deal. It would be trivial to load up on real geographic numbers from anywhere in the world and automate it all for bots.
- JumpCrisscross 7y ago> it’s reasonable to assume they have a real phone number Just an anecdote, but I rarely give out my non-Google Voice number on sign-up forms. I don’t want my mobile in a database to be spammed. If a phone number is required on sign-up, and my Google Voice doesn’t work, I usually pass. Whether for personal or commercial use.
- driverdan 7y agoIt's not reasonable. Voice is the only phone number I use and I use B2B services. If you prevented me from signing up I'd go to a competitor.
- AlchemistCamp 7y agoI run a business. Why is it reasonable to assume the use of legacy phone numbers?
- DaiPlusPlus 7y agoWe target a particular subset of retail-customer businesses which all generally have a phone-number.
- sheepdestroyer 7y agoI despise services that require to have a real phone number. Being locked out of something when you travel, have no reception, lost your phone or got it stollen is just a pain. Bonus hate points for banks that implement a sms code check for online payments with your visa/mastercard (common in France at least). I changed bank for one that provided me with a device generating one time codes from my CB
- DaiPlusPlus 7y agoIt’s only used for sign-up/registration in my case.
- NikolaeVarius 7y agoGoddamn Paypal MFA
- bosswipe 7y ago> but also looking-up the phone number’s SS7 info Does that really work? I'd like a service like that for my personal phone.