5 ms·

> What exactly is the point of phone verification of the official answer is “lie to us about your identity”? Phone number is not about identity, but about redu

> What exactly is the point of phone verification of the official answer is “lie to us about your identity”? Phone number is not about identity, but about reducing spam (they're also not at all tied to your identity, at least not unless you buy data from service providers). The point is that you need something that is very easy for your normal user to do, but very hard for bots - effectively, it's just a glorified captcha.

jedberg 5y ago
I can accept that, but at least captchas offer an alternative, like listening to audio. With the phone number, if they've decided my number is VoIP, then I have no recourse except to borrow or steal someone's phone. It's a terrible system and they probably have no metrics on how many legit customers they are losing because of it.
- jsnell 5y ago
  Why do you think they wouldn't have metrics on it? When doing anti-abuse policies like that, you'd definitely first figure out the number of FPs during the analysis stage, and then verify it again when actually rolling out the policy.
  - jedberg 5y ago
    How do you tell the difference between bot users and legit users who just give up? Especially if you do it during a high growth period, it could easily be masked by the growth.
    - jsnell 5y ago
      There's tons of ways. What they have in common is that you don't wait for a user to fail the SMS challenge, and then try to figure out if it was a true or false positive. You work with differential behavior between populations of users. Often you're not applying these policies to everyone, but only to small sub-populations with a high density of abuse. E.g. if 1% of your accounts are created via VPNs + VOIP numbers, and 99% of those accounts are deemed to be abusive post facto, and you restrict VOIP numbers for just signups for VPNs, the absolute maximum reduction in legit signups is 0.01%. You don't even need to know how many of the legit users would find another way to create the account; you already have an upper bound that's within the guardrails. Or you can look at what actually happens after you roll out the policy. If it really is watertight, abusers will move away quickly, and all you're left with are the legit users. If that number is low enough, you might even keep the rules in place indefinitely even though all the traffic that is remaining is expected to be FPs. If those approaches sound dodgy, the default option is to run an A/B experiment. Ban VOIP numbers for the experiment group and allow them for the control group. Then simply look the number of newly created abusive accounts vs. accounts with legit interactions in the two groups. (A lot of requires you to have a way of distinguishing between abusive and legit users post facto, but if you don't, it's too early to add this kind of restriction in the first place.)
closetohome 5y ago
I get how this probably reduces spam a little, but it's another one of those things like capchas that can be a massive impediment for legitimate users, but barely a speedbump for actual spammers.

jedberg 5y ago

I can accept that, but at least captchas offer an alternative, like listening to audio. With the phone number, if they've decided my number is VoIP, then I have no recourse except to borrow or steal someone's phone. It's a terrible system and they probably have no metrics on how many legit customers they are losing because of it.

jsnell 5y ago
Why do you think they wouldn't have metrics on it? When doing anti-abuse policies like that, you'd definitely first figure out the number of FPs during the analysis stage, and then verify it again when actually rolling out the policy.
- jedberg 5y ago
  How do you tell the difference between bot users and legit users who just give up? Especially if you do it during a high growth period, it could easily be masked by the growth.
  - jsnell 5y ago
    There's tons of ways. What they have in common is that you don't wait for a user to fail the SMS challenge, and then try to figure out if it was a true or false positive. You work with differential behavior between populations of users. Often you're not applying these policies to everyone, but only to small sub-populations with a high density of abuse. E.g. if 1% of your accounts are created via VPNs + VOIP numbers, and 99% of those accounts are deemed to be abusive post facto, and you restrict VOIP numbers for just signups for VPNs, the absolute maximum reduction in legit signups is 0.01%. You don't even need to know how many of the legit users would find another way to create the account; you already have an upper bound that's within the guardrails. Or you can look at what actually happens after you roll out the policy. If it really is watertight, abusers will move away quickly, and all you're left with are the legit users. If that number is low enough, you might even keep the rules in place indefinitely even though all the traffic that is remaining is expected to be FPs. If those approaches sound dodgy, the default option is to run an A/B experiment. Ban VOIP numbers for the experiment group and allow them for the control group. Then simply look the number of newly created abusive accounts vs. accounts with legit interactions in the two groups. (A lot of requires you to have a way of distinguishing between abusive and legit users post facto, but if you don't, it's too early to add this kind of restriction in the first place.)

closetohome 5y ago

I get how this probably reduces spam a little, but it's another one of those things like capchas that can be a massive impediment for legitimate users, but barely a speedbump for actual spammers.