4 ms·

Hey Twilio, maybe now you'll implement webauthn for both your internal systems and for your customers? Its pretty frustrating that there's a well known technic

Hey Twilio, maybe now you'll implement webauthn for both your internal systems and for your customers? Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and companies like twilio simply have not prioritized it yet. Replacing SMS and Push based 2fa with webauthn is the best bang for your buck security upgrade available to companies right now. EDIT a bit later: > We have reemphasized our security training to ensure employees are on high alert for social engineering attacks, and have issued security advisories on the specific tactics being utilized by malicious actors since they first started to appear several weeks ago. We have also instituted additional mandatory awareness training on social engineering attacks in recent weeks. Separately, we are examining additional technical precautions as the investigation progresses. Security training is ineffective against phishing attacks like this. Please stop wasting your money and your employees time; implement the technical solution that nullifies the attack.

Kerrick 4y ago
Isn’t SMS based 2FA responsible for a lot of Twilio’s revenue?
- reaperducer 4y ago
  I guess dogfooding isn't a great idea if the kibble is rancid.
- Jenk 4y ago
  SMS campaigns, both target and blanket, simply must dwarf any 2fa usage. In just one role I saw Sms-shots with 10s of thousands of recipients. SMS is also fairly heavily used for non-secure notifications (you bill is due / payment received / your password changed, etc.) quite heavily IME.
  - powerhour 4y ago
    I wonder how often SMS 2FA serves as the entry point for more business. Like, devs choosing Twilio to try it out for low volume work before expanding into large campaigns.
    - skrtskrt 4y ago
      It's kind of both. SMS 2FA is more likely to serve as an onramp for "good customers" who are developers actually building real applications using your services, rather than people who are mass-blasting borderline spammy marketing texts. Traffic that gets identified as marketing traffic as opposed to traffic that will involve a human responding (like a chat bot to schedule with your doctor's office) actually costs Twilio much more to send because the Telco carriers charge more because they have to put more into mitigating the risk of getting blocked and sued for spamming. So the "good customers" are lower volume but higher margin, and generally more likely to grow at a sustainable pace and not disappear off the map, as the have a lot of code around using your APIs, not just "Send a kajillion messages". Those "marketing" customers will jump off your platform in a blink of an eye if someone offers them cheaper prices and less oversight on their spammy practices.
Aeolun 4y ago
> Security training is ineffective against phishing attacks like this. I wouldn’t say that. There’s a significant effect of training on the number of people that click. The big problem is that the attackers have to only get it right the one time.
- psanford 4y ago
  Unless security training takes the click rate to zero it is ineffective in protecting your organization from phishing attacks.
  - malyk 4y ago
    Nothing can take the risk to zero. The goal is to take steps to minimize that risk. The average “click rate” for phishing emails is something like 18% (don’t quote me on that exactly) and if you can institute training that brings it lower then you are working to minimize risk. You should do other things as well to further reduce risk, but training is one tool in the toolbox to help.
    - psanford 4y ago
      That is incorrect. Mandatory WebAuthN eliminates this risk. Stop wasting your time with inferior alternatives.
      - Aeolun 4y ago
        How much communication would shift to informal methods if the barrier to communicating over approved channels got too big?
- kelnos 4y ago
  I think that's exactly the grandparent's point: any mitigation that relies on making 100% of people 100% perfect, 100% of the time, is not going to be effective.
rsync 4y ago
"Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and companies like twilio simply have not prioritized it yet." I understand your frustration but you are missing the point. 2FA with a valid (non-VOIP) SIM card is not for your security. They tell you it is, and they dress up the process as if it is, but they are lying to you. Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago. Instead, they do what they can: throw sand in the gears and slow down the bad actors with ridiculous, obviously absurd (put in any phone number we have never seen before to prove that it's you) mechanisms and hope the real customer base doesn't balk.
- lima 4y ago
  They can require a phone number for signup while still supporting WebAuthn.
- Dwolb 4y ago
  "Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago." That's an interesting point I hadn't heard that before. Don't banks essentially do some form of this with KYC checks? Would expect being smart about bringing in some components of that process would reduce spam while not introducing too much user friction.
  - toast0 4y ago
    Bank KYC is different because all the banks have to do it, so you can't really avoid it (although maybe some are worse than others). Also, banking usually has more switching costs; people don't usually sign up for a bank, run a couple transactions and leave for another. Twilio is one of a large number of players in this market, spending a lot of effort on KYC likely turns off some customers and may be overinvesting for tire kickers.
- skrtskrt 4y ago
  I have worked in this space - aside from WebAuthN, the spam/scam problem is tough for a SaaS Telco company because anti-spam/scam is directly at odds with a low-friction self-serve experience. You also have to realize that Twilio is not a Telco, they ride on top of big Telco company infrastructure and ultimately has to answer to big Telco, and big Telco is very risk averse and generally has to answer to regulators. So Twilio doesn't want spammers either because they get dinged, blocked, or marked as spam by the Telcos. Ultimately there's probably more that the underlying Telco infrastructure could do more to support anti-spam measures but these companies are dinosaurs that move very slowly. It's easy to deride them from the position of enlightened SaaS company employees, but they're the ones in the capital-intensive business of maintaining worldwide networks of copper wires in the ground, physical switches, systems designed in the 1980s or the 1950s and complying with incredibly complex and outdated regulatory structures. It's the "legacy system" of a developer's nightmare to the 100th power. Having a good flow for self-serve customers to sign up and get going is the cheapest way to get new business, and developers will not even look twice at you if it's hard to get going in a self-service manner on you platform. However, it's exactly that low friction that gets spammers going easily. So what do you do? You try to come up with heuristics and even ML models to identify bad actors early. It's an ongoing constant battle, a game of whack-a-mole where the moles have basically zero cost overhead, no legal entity associated with them, and can just keep popping up over and over and over forever. So you're staffing a fraud detection team of engineers, you have lawyers and finance people on this, you have customer service for customers who get caught as a false positive - it's all an extremely expensive pain in the ass.
judge2020 4y ago
It's important to note that Twilio can't sell WebAuthn as a service, at least not until they try to compete with Auth0 or Okta B2C directly. If they provide it on their own accounts instead of dogfooding their 2fa products, it probably doesn't inspire their customers with confidence in Twilio's product.

Kerrick 4y ago

Isn’t SMS based 2FA responsible for a lot of Twilio’s revenue?

reaperducer 4y ago
I guess dogfooding isn't a great idea if the kibble is rancid.
Jenk 4y ago
SMS campaigns, both target and blanket, simply must dwarf any 2fa usage. In just one role I saw Sms-shots with 10s of thousands of recipients. SMS is also fairly heavily used for non-secure notifications (you bill is due / payment received / your password changed, etc.) quite heavily IME.
- powerhour 4y ago
  I wonder how often SMS 2FA serves as the entry point for more business. Like, devs choosing Twilio to try it out for low volume work before expanding into large campaigns.
  - skrtskrt 4y ago
    It's kind of both. SMS 2FA is more likely to serve as an onramp for "good customers" who are developers actually building real applications using your services, rather than people who are mass-blasting borderline spammy marketing texts. Traffic that gets identified as marketing traffic as opposed to traffic that will involve a human responding (like a chat bot to schedule with your doctor's office) actually costs Twilio much more to send because the Telco carriers charge more because they have to put more into mitigating the risk of getting blocked and sued for spamming. So the "good customers" are lower volume but higher margin, and generally more likely to grow at a sustainable pace and not disappear off the map, as the have a lot of code around using your APIs, not just "Send a kajillion messages". Those "marketing" customers will jump off your platform in a blink of an eye if someone offers them cheaper prices and less oversight on their spammy practices.

Aeolun 4y ago

> Security training is ineffective against phishing attacks like this. I wouldn’t say that. There’s a significant effect of training on the number of people that click. The big problem is that the attackers have to only get it right the one time.

psanford 4y ago
Unless security training takes the click rate to zero it is ineffective in protecting your organization from phishing attacks.
- malyk 4y ago
  Nothing can take the risk to zero. The goal is to take steps to minimize that risk. The average “click rate” for phishing emails is something like 18% (don’t quote me on that exactly) and if you can institute training that brings it lower then you are working to minimize risk. You should do other things as well to further reduce risk, but training is one tool in the toolbox to help.
  - psanford 4y ago
    That is incorrect. Mandatory WebAuthN eliminates this risk. Stop wasting your time with inferior alternatives.
    - Aeolun 4y ago
      How much communication would shift to informal methods if the barrier to communicating over approved channels got too big?
kelnos 4y ago
I think that's exactly the grandparent's point: any mitigation that relies on making 100% of people 100% perfect, 100% of the time, is not going to be effective.

rsync 4y ago

"Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and companies like twilio simply have not prioritized it yet." I understand your frustration but you are missing the point. 2FA with a valid (non-VOIP) SIM card is not for your security. They tell you it is, and they dress up the process as if it is, but they are lying to you. Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago. Instead, they do what they can: throw sand in the gears and slow down the bad actors with ridiculous, obviously absurd (put in any phone number we have never seen before to prove that it's you) mechanisms and hope the real customer base doesn't balk.

lima 4y ago
They can require a phone number for signup while still supporting WebAuthn.
Dwolb 4y ago
"Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago." That's an interesting point I hadn't heard that before. Don't banks essentially do some form of this with KYC checks? Would expect being smart about bringing in some components of that process would reduce spam while not introducing too much user friction.
- toast0 4y ago
  Bank KYC is different because all the banks have to do it, so you can't really avoid it (although maybe some are worse than others). Also, banking usually has more switching costs; people don't usually sign up for a bank, run a couple transactions and leave for another. Twilio is one of a large number of players in this market, spending a lot of effort on KYC likely turns off some customers and may be overinvesting for tire kickers.
skrtskrt 4y ago
I have worked in this space - aside from WebAuthN, the spam/scam problem is tough for a SaaS Telco company because anti-spam/scam is directly at odds with a low-friction self-serve experience. You also have to realize that Twilio is not a Telco, they ride on top of big Telco company infrastructure and ultimately has to answer to big Telco, and big Telco is very risk averse and generally has to answer to regulators. So Twilio doesn't want spammers either because they get dinged, blocked, or marked as spam by the Telcos. Ultimately there's probably more that the underlying Telco infrastructure could do more to support anti-spam measures but these companies are dinosaurs that move very slowly. It's easy to deride them from the position of enlightened SaaS company employees, but they're the ones in the capital-intensive business of maintaining worldwide networks of copper wires in the ground, physical switches, systems designed in the 1980s or the 1950s and complying with incredibly complex and outdated regulatory structures. It's the "legacy system" of a developer's nightmare to the 100th power. Having a good flow for self-serve customers to sign up and get going is the cheapest way to get new business, and developers will not even look twice at you if it's hard to get going in a self-service manner on you platform. However, it's exactly that low friction that gets spammers going easily. So what do you do? You try to come up with heuristics and even ML models to identify bad actors early. It's an ongoing constant battle, a game of whack-a-mole where the moles have basically zero cost overhead, no legal entity associated with them, and can just keep popping up over and over and over forever. So you're staffing a fraud detection team of engineers, you have lawyers and finance people on this, you have customer service for customers who get caught as a false positive - it's all an extremely expensive pain in the ass.

judge2020 4y ago

It's important to note that Twilio can't sell WebAuthn as a service, at least not until they try to compete with Auth0 or Okta B2C directly. If they provide it on their own accounts instead of dogfooding their 2fa products, it probably doesn't inspire their customers with confidence in Twilio's product.