2 ms·
I wonder if this is a potential denial-of-service bug? There are two scenarios: 1. The expected use-case: Create account(s), assign number for verification,
by iam-TJ 5y ago
I wonder if this is a potential denial-of-service bug?
There are two scenarios:
1. The expected use-case: Create account(s), assign number for verification, verify, account active, number remains assigned to account(s)
2. The unexpected: Attempt to create account(s), assign number for verification, ignore or fail verification, no account created
If the attempted use of the number in (2) is counted and remembered then there's an anonymous potential DOS against any number
- malka 5y agoyou could use a lot of different cheap pre-paid sim card to burn a lot of numbers too.
- iam-TJ 5y agoYes, but my thought with (2) is you can use someone else's telephone number without their permission or knowledge until it is permanently blocked as a method of verification and authentication.