4 ms·

If real, some people may basically face the death penalty in countries like Iran with the current situation. Anyone with anti-regime content and identifiable at

If real, some people may basically face the death penalty in countries like Iran with the current situation. Anyone with anti-regime content and identifiable attributes in the leaked database is very stressed now.

sacnoradhq 4y ago
True, also enabled by state actors apps/servers like Palantir. For recovery and nonrepudiation purposes, storing a salted hash of the phone number would be the wiser course. If using SMS for notification, services like Twitter should have API callbacks and delegate the problems of multi-platform notifications to a trusted third-party similar to credit card processing.
- guwop 4y ago
  Can you expand a bit on how apps like Palantir could be used for this?
- koolba 4y ago
  A salted hash of a phone number is both useless and pointless. You can easily brute force the narrow key space if you’re trying to verify if it’s “known”. And if you want to send an actual message you need the full value. Sounds more like you want to outsource user verification and receive an opaque token for future validation.
  - sacnoradhq 4y ago
    Can't brute or rainbow table a salted HMAC, even if the keyspace were 10^10-10^13 because 1. nonces and 2. sufficient number of iterations, mem/cpu/gpu/asic-hard, scrypt-style.
  - evan_ 4y ago
    You could turn the verification around. Instead of texting a value to a phone number and asking you to toe it in, you say “Text this number to 40404: 123456” Then, wait until someone texts that number in, and salt/hash the caller ID number and compare it to what you’ve got stored. If there’s a match, then you’re authenticated. Probably lots of issues with this from ux perspective…
    - sacnoradhq 4y ago
      It's not 2FA if a secret comes from the same channel as the login one.
    - _morgs_ 4y ago
      SMS shortcodes aren't international.
      - evan_ 4y ago
        You could give the user a list of phone numbers sorted by country.
    - kaba0 4y ago
      Why not just have the user enter their phone number? You only store a hash of it and only verify whether it is indeed the one they registered with, and use the real one only for the duration of sending an SMS. Not too secure, as phone numbers are easy to crack (possibly with randomized salt, that even twitter has to “brute force”?), but at least not every entry will be easily readable.
    - jlmb 4y ago
      I think the main problem is that SMS sender numbers can be easily spoofed (might depend on country, operator, …), so relying on “this message came from where it says it came from” is not really possible. It might not be an issue for some types of usage, but sounds risky if used for account security/recovery/etc.
      - evan_ 4y ago
        If you keep your number private it won’t matter. In fact you could spoof the number on purpose for an extra layer of security.
        jlmb 4y ago
        Phone number verification (of any kind) is supposed to make sure that the phone number provided belongs to the account owner. If the number is not actually validated in a secure (enough) manner, there's no point in using phone numbers at all.
- keewee7 4y ago
  >trusted third-party This is something Signal should look into if they're interested in an alternative revenue stream.
koolba 4y ago
Would users from those countries even be able to use their local phones for verification? I would have assumed any kind of banned interaction with the USA’s baddies list countries (e.g. Iran, Syria, or North Korea) would apply to allowing users to sign up with phone numbers as well. Though I guess there’s always cross referencing known contacts of expats and dissents.

sacnoradhq 4y ago

True, also enabled by state actors apps/servers like Palantir. For recovery and nonrepudiation purposes, storing a salted hash of the phone number would be the wiser course. If using SMS for notification, services like Twitter should have API callbacks and delegate the problems of multi-platform notifications to a trusted third-party similar to credit card processing.

guwop 4y ago
Can you expand a bit on how apps like Palantir could be used for this?
koolba 4y ago
A salted hash of a phone number is both useless and pointless. You can easily brute force the narrow key space if you’re trying to verify if it’s “known”. And if you want to send an actual message you need the full value. Sounds more like you want to outsource user verification and receive an opaque token for future validation.
- sacnoradhq 4y ago
  Can't brute or rainbow table a salted HMAC, even if the keyspace were 10^10-10^13 because 1. nonces and 2. sufficient number of iterations, mem/cpu/gpu/asic-hard, scrypt-style.
- evan_ 4y ago
  You could turn the verification around. Instead of texting a value to a phone number and asking you to toe it in, you say “Text this number to 40404: 123456” Then, wait until someone texts that number in, and salt/hash the caller ID number and compare it to what you’ve got stored. If there’s a match, then you’re authenticated. Probably lots of issues with this from ux perspective…
  - sacnoradhq 4y ago
    It's not 2FA if a secret comes from the same channel as the login one.
  - _morgs_ 4y ago
    SMS shortcodes aren't international.
    - evan_ 4y ago
      You could give the user a list of phone numbers sorted by country.
  - kaba0 4y ago
    Why not just have the user enter their phone number? You only store a hash of it and only verify whether it is indeed the one they registered with, and use the real one only for the duration of sending an SMS. Not too secure, as phone numbers are easy to crack (possibly with randomized salt, that even twitter has to “brute force”?), but at least not every entry will be easily readable.
  - jlmb 4y ago
    I think the main problem is that SMS sender numbers can be easily spoofed (might depend on country, operator, …), so relying on “this message came from where it says it came from” is not really possible. It might not be an issue for some types of usage, but sounds risky if used for account security/recovery/etc.
    - evan_ 4y ago
      If you keep your number private it won’t matter. In fact you could spoof the number on purpose for an extra layer of security.
      - jlmb 4y ago
        Phone number verification (of any kind) is supposed to make sure that the phone number provided belongs to the account owner. If the number is not actually validated in a secure (enough) manner, there's no point in using phone numbers at all.
keewee7 4y ago
>trusted third-party This is something Signal should look into if they're interested in an alternative revenue stream.

koolba 4y ago

Would users from those countries even be able to use their local phones for verification? I would have assumed any kind of banned interaction with the USA’s baddies list countries (e.g. Iran, Syria, or North Korea) would apply to allowing users to sign up with phone numbers as well. Though I guess there’s always cross referencing known contacts of expats and dissents.