3 ms·

I run a SaaS, whose users can enable sending SMS from their number. We have an agreement with a bulk SMS provider to allow us to do this (we had to show proof

by rbut 5y ago

I run a SaaS, whose users can enable sending SMS from their number. We have an agreement with a bulk SMS provider to allow us to do this (we had to show proof of our application, our mobile number verification process, and give our use case). When users send an SMS from within our application, we send it as if it came from their number. Then recipients can then reply directly to their phone. Our users love it. So yes, there are real use cases where the ability to do this is beneficial.

WaxProlix 5y ago
"Our users love it" is not the same as "yes,there are real use cases where...", which is not the same as "this is good and correct because..." Users can love or hate all kinds of things, and often those preferences are at odds with security or other best practices. Aspire to better.
- rbut 5y ago
  The alternative is a shared number, which then requires logic to determine which user sent a message to X. When receiving a reply from X, you must determine which user to associate the reply to and then forward it to them. This can and does go wrong. Especially if multiple users are messaging the same recipient within a time period. If we have validated our users mobile numbers via a TOTP code, informed them that they are sending SMS as their number, then how is it different to an application like Signal or iMessage linking your messages to your mobile number? It's not. And that's why it's allowed with certain SMS gateways. The SMS gateways are doing the due diligence to ensure you are sending spoofed messages appropriately and only as the user who actually owns the number. Edit: The spammers are most likely using gateways who aren't doing these checks. The solution is to fine or shut these gateways down.
  - ecf 5y ago
    The solution is to completely rip out the ability to do anything remotely close to arbitrarily choosing which number is sent along with a text or phone call. Until then, every legitimate use case pales in comparison to even a single spam call taking a second of my attention in a day.
  - riskable 5y ago
    > The alternative is a shared number... No, the alternative is to include proper contact information in the message. Security comes with all sorts of tradeoffs and one of them is often convenience. Is it inconvenient to have to reply to a different number? Sure. Is it worth it--if it means we all no longer have to deal with spoofed ID scam texts? Hell yes!

by rbut 5y ago

WaxProlix 5y ago

"Our users love it" is not the same as "yes,there are real use cases where...", which is not the same as "this is good and correct because..." Users can love or hate all kinds of things, and often those preferences are at odds with security or other best practices. Aspire to better.

rbut 5y ago
The alternative is a shared number, which then requires logic to determine which user sent a message to X. When receiving a reply from X, you must determine which user to associate the reply to and then forward it to them. This can and does go wrong. Especially if multiple users are messaging the same recipient within a time period. If we have validated our users mobile numbers via a TOTP code, informed them that they are sending SMS as their number, then how is it different to an application like Signal or iMessage linking your messages to your mobile number? It's not. And that's why it's allowed with certain SMS gateways. The SMS gateways are doing the due diligence to ensure you are sending spoofed messages appropriately and only as the user who actually owns the number. Edit: The spammers are most likely using gateways who aren't doing these checks. The solution is to fine or shut these gateways down.
- ecf 5y ago
  The solution is to completely rip out the ability to do anything remotely close to arbitrarily choosing which number is sent along with a text or phone call. Until then, every legitimate use case pales in comparison to even a single spam call taking a second of my attention in a day.
- riskable 5y ago
  > The alternative is a shared number... No, the alternative is to include proper contact information in the message. Security comes with all sorts of tradeoffs and one of them is often convenience. Is it inconvenient to have to reply to a different number? Sure. Is it worth it--if it means we all no longer have to deal with spoofed ID scam texts? Hell yes!