5 ms·

How do you deal with spam without requiring a phone number to register?

giancarlostoro 4y ago
Who is dealing with the spam SMS messages I get all year round? Phone numbers do not stop spam, they are used to distribute it. I know I received no spam when I had Google Talk... It is a solvable problem that I guess benefits nobody in power to solve.
- colinmhayes 4y ago
  Spam is one of the major reasons people don’t use sms. “The product Were replacing sucks so our product can suck too”
  - Aachen 4y ago
    I don't use SMS because I can't download an open source client to use on desktop, send pictures or other files, edit messages, encrypt conversations, share a live location, hold a poll, have group chats with some semblance of scale, it just doesn't work for more than receiving an occasional message as last resort. Spam via sms doesn't seem to really exist here, maybe two per year now, up from zero until three years ago.
soziawa 4y ago
Threema seems to manage just well. I guess payment is the natural limiter for spam there.
- uoaei 4y ago
  And accessibility.
ssizn 4y ago
rt4mn 4y ago
Give people the option to pay. I would gladly pay $100 one time fee if it meant I could avoid having a phone number associated. https://jmp.chat https://jmp.chat is a great work around but I would rather just have an email address or ideally nothing but a receipt directly associated with my signal account.
- croes 4y ago
  Isn't email even worse for security?
  - rakoo 4y ago
    "security" is vast and means different things to different people. Email can absolutely be used for with e2e encryption keeping the content of exchanges from external eyes. Email can absolutely not be used for hiding metadata of who talks to who.
  - lillecarl 4y ago
    Depends, if you're able to poison the DNS of the mailprovider / hack the recipient mailserver or do a phising attack. I just want to be able to communicate without sharing my phone number (since my phone number is bound to Swedish "Swish") meaning someone can get my ID from my phone number here. This is why drug dealers use Wickr, Threema and others, because they don't expose identity, not because they're "safer". I have a contact on Threema who I've met many times, but I have no idea how to contact him outside of Threema, because I don't know his identity and we'd both like to keep it that way.
  - eitland 4y ago
    You can trivially create as many emails as you want, anonymously and for free. In many countries, registering phone numbers anonymously is illegal and/or impossible.
    - thaumasiotes 4y ago
      > You can trivially create as many emails as you want, anonymously and for free. Where? Gmail and hotmail both don't allow this.
capableweb 4y ago
One option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.
- freedomben 4y ago
  > Add in rate limiting so you can only have N open "invitations" and spamming should be very limited. That also sounds like a good way to limit adoption as well, at least for anyone with more the N contacts, particularly >= 2N as that means likely a minimum waiting period before you can transfer over "more" contacts since some people will never accept/reject the invite because they don't use the app much. If it were me and I had to wait on others to accept or reject my invite before I can continue transferring contacts, I'm gonna move on.
- Aachen 4y ago
  I don't see the difference between some Isabelle showing up as someone to accept or deny, or some Isabelle with a "I'm a hot single in your area, click this link" message so I'm sure it's spam. On Telegram this is rampant, on average probably one person per day. It shifted from e-gold scams to sex since a few months, but both are still present. People that aren't in big groups (where the spammers scrape user IDs) have zero problems, so the trick is revealing your random identifier only to those you want to contact you. Phone number identifiers are the antithesis to spam protection: we keep our ranges just full enough that we can't shorten it by a digit, but empty enough that we have small growth possibilities. You're very likely to hit a subscriber, by design, by trying random numbers.
tptacek 4y ago
Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up contact lists altogether (at which point nobody would use the service), or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available to a state-level adversary.
- rt4mn 4y ago
  > It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. This makes sense for contact discovery, which is important for normal people who just want a chat app that works. But there are a very important segment of signal users, people with an elevated threat model, who I would be willing to bet a good portion of them would gladly sacrifice contact lists if it meant not having to share their phone number.
- Aachen 4y ago
  > or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available Why couldn't they just keep using the current system, alongside usernames, for phone number contact discovery? Of course for those who opt into it; imo that's what it should be.
- daneel_w 4y ago
  Users having to add their contacts each time they set Signal up on a new phone, should the app keep its own client-side contact book, doesn't sound like hassle. Could you please explain how Signal does not have a social network map, when 1) user accounts are equal to mobile phone numbers, and 2) Signal servers route messages between user accounts.

Who is dealing with the spam SMS messages I get all year round? Phone numbers do not stop spam, they are used to distribute it. I know I received no spam when I had Google Talk... It is a solvable problem that I guess benefits nobody in power to solve.

colinmhayes 4y ago
Spam is one of the major reasons people don’t use sms. “The product Were replacing sucks so our product can suck too”
- Aachen 4y ago
  I don't use SMS because I can't download an open source client to use on desktop, send pictures or other files, edit messages, encrypt conversations, share a live location, hold a poll, have group chats with some semblance of scale, it just doesn't work for more than receiving an occasional message as last resort. Spam via sms doesn't seem to really exist here, maybe two per year now, up from zero until three years ago.

soziawa 4y ago

Threema seems to manage just well. I guess payment is the natural limiter for spam there.

uoaei 4y ago
And accessibility.

ssizn 4y ago

rt4mn 4y ago

Give people the option to pay. I would gladly pay $100 one time fee if it meant I could avoid having a phone number associated. https://jmp.chat https://jmp.chat is a great work around but I would rather just have an email address or ideally nothing but a receipt directly associated with my signal account.

croes 4y ago
Isn't email even worse for security?
- rakoo 4y ago
  "security" is vast and means different things to different people. Email can absolutely be used for with e2e encryption keeping the content of exchanges from external eyes. Email can absolutely not be used for hiding metadata of who talks to who.
- lillecarl 4y ago
  Depends, if you're able to poison the DNS of the mailprovider / hack the recipient mailserver or do a phising attack. I just want to be able to communicate without sharing my phone number (since my phone number is bound to Swedish "Swish") meaning someone can get my ID from my phone number here. This is why drug dealers use Wickr, Threema and others, because they don't expose identity, not because they're "safer". I have a contact on Threema who I've met many times, but I have no idea how to contact him outside of Threema, because I don't know his identity and we'd both like to keep it that way.
- eitland 4y ago
  You can trivially create as many emails as you want, anonymously and for free. In many countries, registering phone numbers anonymously is illegal and/or impossible.
  - thaumasiotes 4y ago
    > You can trivially create as many emails as you want, anonymously and for free. Where? Gmail and hotmail both don't allow this.

capableweb 4y ago

One option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.

freedomben 4y ago
> Add in rate limiting so you can only have N open "invitations" and spamming should be very limited. That also sounds like a good way to limit adoption as well, at least for anyone with more the N contacts, particularly >= 2N as that means likely a minimum waiting period before you can transfer over "more" contacts since some people will never accept/reject the invite because they don't use the app much. If it were me and I had to wait on others to accept or reject my invite before I can continue transferring contacts, I'm gonna move on.
Aachen 4y ago
I don't see the difference between some Isabelle showing up as someone to accept or deny, or some Isabelle with a "I'm a hot single in your area, click this link" message so I'm sure it's spam. On Telegram this is rampant, on average probably one person per day. It shifted from e-gold scams to sex since a few months, but both are still present. People that aren't in big groups (where the spammers scrape user IDs) have zero problems, so the trick is revealing your random identifier only to those you want to contact you. Phone number identifiers are the antithesis to spam protection: we keep our ranges just full enough that we can't shorten it by a digit, but empty enough that we have small growth possibilities. You're very likely to hit a subscriber, by design, by trying random numbers.

tptacek 4y ago

Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up contact lists altogether (at which point nobody would use the service), or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available to a state-level adversary.

rt4mn 4y ago
> It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. This makes sense for contact discovery, which is important for normal people who just want a chat app that works. But there are a very important segment of signal users, people with an elevated threat model, who I would be willing to bet a good portion of them would gladly sacrifice contact lists if it meant not having to share their phone number.
Aachen 4y ago
> or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available Why couldn't they just keep using the current system, alongside usernames, for phone number contact discovery? Of course for those who opt into it; imo that's what it should be.
daneel_w 4y ago
Users having to add their contacts each time they set Signal up on a new phone, should the app keep its own client-side contact book, doesn't sound like hassle. Could you please explain how Signal does not have a social network map, when 1) user accounts are equal to mobile phone numbers, and 2) Signal servers route messages between user accounts.