5 ms·

I’m curious what (free) solution exists here that won’t be abused by spammers.

by endisneigh 5y ago

derbOac 5y ago
A security key? Depends on why they really want a phone number.
- endisneigh 5y ago
  A security key wouldn’t prevent spam since you can buy multiple. It would increase the cost of spamming, but it’s unclear of the relatively affordable price of security keys would love the needle enough vs attrition from legit users
  - floodle 5y ago
    Security keys are typically $20, that seems pretty expensive to me if you are a spammer opening hundreds or thousands of accounts.
    - tkanarsky 5y ago
      https://github.com/MattGorko/libu2f-emu https://github.com/MattGorko/libu2f-emu can spin up virtual U2F tokens which are indistinguishable (in my experience) from real ones plugged into a USB port
    - kam 5y ago
      WebAuthn deliberately doesn't give relying parties a way to tell if two registrations are from the same device.
  - mattnewton 5y ago
    You can buy more phones too, though presumably the phone companies don't sell bulk phone numbers for short term use and make it prohibitively expensive and time consuming to do so. Basically seems like it works by outsourcing those spam combating efforts to the local phone companies.
altairprime 5y ago
Google is piggybacking cost-free on the ID verification efforts of phone carriers, so for whatever it's worth, this is a free solution — from Google's standpoint. From a user standpoint, I know of no service that will perform ID verification for 'free' and certify that verification onto a third-party verification request. (Credit card verification, or mail-you-a-postcard verification, doesn't count, as there's no ID check.) I believe this ends up having to be a government service, where the post office is obliged to certify third-party verification requests presented to it (for private parties, corporations, and/or government divisions), and this service is offered for free at personal-use volumes and for one postage stamp per request at for-profit volumes. It's still possible a B-corp or non-profit could decide to offer this as a public service, but that would take a billion-dollar endowment and would duplicate the USPS frameworks already in place to check IDs and verify mailing addresses for Informed Delivery at every post office in the country, so I wouldn't bet on anyone taking on that cost without payment.

I’m curious what (free) solution exists here that won’t be abused by spammers.

derbOac 5y ago

A security key? Depends on why they really want a phone number.

endisneigh 5y ago
A security key wouldn’t prevent spam since you can buy multiple. It would increase the cost of spamming, but it’s unclear of the relatively affordable price of security keys would love the needle enough vs attrition from legit users
- floodle 5y ago
  Security keys are typically $20, that seems pretty expensive to me if you are a spammer opening hundreds or thousands of accounts.
  - tkanarsky 5y ago
    https://github.com/MattGorko/libu2f-emu https://github.com/MattGorko/libu2f-emu can spin up virtual U2F tokens which are indistinguishable (in my experience) from real ones plugged into a USB port
  - kam 5y ago
    WebAuthn deliberately doesn't give relying parties a way to tell if two registrations are from the same device.
- mattnewton 5y ago
  You can buy more phones too, though presumably the phone companies don't sell bulk phone numbers for short term use and make it prohibitively expensive and time consuming to do so. Basically seems like it works by outsourcing those spam combating efforts to the local phone companies.

altairprime 5y ago

Google is piggybacking cost-free on the ID verification efforts of phone carriers, so for whatever it's worth, this is a free solution — from Google's standpoint. From a user standpoint, I know of no service that will perform ID verification for 'free' and certify that verification onto a third-party verification request. (Credit card verification, or mail-you-a-postcard verification, doesn't count, as there's no ID check.) I believe this ends up having to be a government service, where the post office is obliged to certify third-party verification requests presented to it (for private parties, corporations, and/or government divisions), and this service is offered for free at personal-use volumes and for one postage stamp per request at for-profit volumes. It's still possible a B-corp or non-profit could decide to offer this as a public service, but that would take a billion-dollar endowment and would duplicate the USPS frameworks already in place to check IDs and verify mailing addresses for Informed Delivery at every post office in the country, so I wouldn't bet on anyone taking on that cost without payment.