5 ms·

Cophone has virtual phone numbers. This is - one of - the reasons why some services like WhatsApp won't even sent you a text message, although it is possible to

by t1tech 3y ago

Cophone has virtual phone numbers. This is - one of - the reasons why some services like WhatsApp won't even sent you a text message, although it is possible to receive SMSes. Cophones are VMs with virtual stacks.

danpalmer 3y ago
Thanks for the clarification, this makes complete sense for what you're trying to do. It's a little sad that there isn't a good solution for this yet though.
- rsync 3y ago
  Here's the solution: https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/ (sorry about the bad SSL cert - I stopped caring after acme.sh blew up)
  - gottorf 3y ago
    > sorry about the bad SSL cert I'm curious, why not just serve plain HTTP at that point? It makes little difference to the viewer.
    - rsync 3y ago
      I think I may do that. Or buy a "real" SSL cert that I don't need to fiddle with every few months. I think there are some browsers that won't even connect to HTTP/80 without a warning ?
      - gottorf 3y ago
        I've used Namecheap/PositiveSSL[0] for stuff like that in the past; under $10/year, and never had any issues. [0]: https://www.namecheap.com/security/ssl-certificates/ https://www.namecheap.com/security/ssl-certificates/
        rsync 3y ago
        Bottom line: so pleased that I had acme.sh sandboxed in a jail to generate certs… what a shitshow that ended up being…
        __d 3y ago
        LetsEncrypt is free, and sure, you have to run the cron job to cycle the certs, but honestly, it's painless.
      - cvalka 3y ago
        Use Lego and Dagu
      - numpad0 3y ago
        if it's just(JUST) for the padlock icon, you can setup Cloudflare free plan with the proxying enabled
  - danpalmer 3y ago
    This solves 2FA codes, which was indeed part of our problem, but it doesn't solve incoming/outgoing calls that ideally needed to be on the same number as well for when we dealt with humans. This is probably possible to do, but probably hard to get right, and still requires having a device reliably available to receive calls, and has limited scale (what happens if there are multiple calls at the same time?). This is why it would have been great to be able to buy this as a service.
- JimDabell 3y ago
  This is a very painful problem to have. Receiving 2FA SMS programmatically is surprisingly difficult because of all the safeguards against scammers, even if your usage is legitimate. As you say, normal providers like Twilio are blacklisted so they are unreliable at best. https://clerk.chat https://clerk.chat offers the ability to receive SMS on genuine non-VOIP numbers. They are ridiculously bad at pretty much everything – terrible communication, terrible customer support, terrible reliability, terrible UX, etc. – but they can actually do this where other VOIP-based providers like Twilio can’t. They may be your least worst option. Another option that’s available is to set up an Android phone with https://ifttt.com https://ifttt.com and a genuine phone plan. Then get IFTTT to forward any SMS it receives to whatever service you need. There are open-source apps that do similar things as well – the sibling comment mentions a similar solution. It’s a pain to maintain though. I’d love it if there were a better solution out there, but I haven’t found one yet. Basically the only thing I need is a genuine phone number that will forward SMS on to a web hook.
  - Terretta 3y ago
    Thanks for this. We are hugely frustrated with providers insisting on SMS as a 2nd factor for commercial use because we value employee PII and feel they should not need to seed data brokers just do log into enterprise platforms. We are looking for a solution at scale for SMS 2FA that, according to the national number registry and KYC/anti-fraud checks, is a "real" mobile SMS number. We've found hardware devices that take from 4 to 32 SIM cards and are heading in that direction which seems ... nuts. But, we value employee privacy and these days when even your accounting firms' privacy policy say they're selling your contact info upstream, we want to give employees a way to log in without compromising themselves. Also, to anyone here running a B2B SaaS that offers TOTP instead of SMS, thank you.
    - sifar 3y ago
      Do you have a link for these hardware devices ?
      - Terretta 3y ago
baby_souffle 3y ago
> Cophones are VMs with virtual stacks How can this be determined? I'd imagine that only those with direct access to the "which number belongs to which provider" database could see that a given number belongs to $comapniesKnownToOfferTraditionalPhysicalService versus $comapnyKnownToOnlyDoVOIP can know this for sure? It it just that some companies with this access are selling a "we'll look that up for you" service? Or is it simpler and i'm just over thinking it?
- rsync 3y ago
  No, this is easy. Twilio API has a simple lookup function (call over curl) to see provider and type of number. Also shows subscribers name (usually). I have this in a shell script and look up numbers all the time: /usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name" -u $accountsid:$authtoken | /usr/local/bin/jq '.'
  - rahimnathwani 3y ago
    If the owner of the number is a customer of a different telco (not Twilio), by what mechanism can Twilio determine whether the it's a physical (sim/esim/landline) or virtual number? Sure, some operators operate only physical or only virtual, but others (like Google) operate both.
    - stqism 3y ago
      This isn’t something casually identified with flashy software solutions or APIs, it’s more of a relationships with carriers and other companies in the telco space sorta thing. It gets even more fun when you start looking in to MO and MT on the SMPP side of things.
      - oriettaxx 3y ago
        by the way, if you only need a validation of a number, no need for Twilio: this is a great lib https://github.com/giggsey/libphonenumber-for-php https://github.com/giggsey/libphonenumber-for-php

by t1tech 3y ago

danpalmer 3y ago

Thanks for the clarification, this makes complete sense for what you're trying to do. It's a little sad that there isn't a good solution for this yet though.

rsync 3y ago
Here's the solution: https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/ (sorry about the bad SSL cert - I stopped caring after acme.sh blew up)
- gottorf 3y ago
  > sorry about the bad SSL cert I'm curious, why not just serve plain HTTP at that point? It makes little difference to the viewer.
  - rsync 3y ago
    I think I may do that. Or buy a "real" SSL cert that I don't need to fiddle with every few months. I think there are some browsers that won't even connect to HTTP/80 without a warning ?
    - gottorf 3y ago
      I've used Namecheap/PositiveSSL[0] for stuff like that in the past; under $10/year, and never had any issues. [0]: https://www.namecheap.com/security/ssl-certificates/ https://www.namecheap.com/security/ssl-certificates/
      - rsync 3y ago
        Bottom line: so pleased that I had acme.sh sandboxed in a jail to generate certs… what a shitshow that ended up being…
      - __d 3y ago
        LetsEncrypt is free, and sure, you have to run the cron job to cycle the certs, but honestly, it's painless.
    - cvalka 3y ago
      Use Lego and Dagu
    - numpad0 3y ago
      if it's just(JUST) for the padlock icon, you can setup Cloudflare free plan with the proxying enabled
- danpalmer 3y ago
  This solves 2FA codes, which was indeed part of our problem, but it doesn't solve incoming/outgoing calls that ideally needed to be on the same number as well for when we dealt with humans. This is probably possible to do, but probably hard to get right, and still requires having a device reliably available to receive calls, and has limited scale (what happens if there are multiple calls at the same time?). This is why it would have been great to be able to buy this as a service.
JimDabell 3y ago
This is a very painful problem to have. Receiving 2FA SMS programmatically is surprisingly difficult because of all the safeguards against scammers, even if your usage is legitimate. As you say, normal providers like Twilio are blacklisted so they are unreliable at best. https://clerk.chat https://clerk.chat offers the ability to receive SMS on genuine non-VOIP numbers. They are ridiculously bad at pretty much everything – terrible communication, terrible customer support, terrible reliability, terrible UX, etc. – but they can actually do this where other VOIP-based providers like Twilio can’t. They may be your least worst option. Another option that’s available is to set up an Android phone with https://ifttt.com https://ifttt.com and a genuine phone plan. Then get IFTTT to forward any SMS it receives to whatever service you need. There are open-source apps that do similar things as well – the sibling comment mentions a similar solution. It’s a pain to maintain though. I’d love it if there were a better solution out there, but I haven’t found one yet. Basically the only thing I need is a genuine phone number that will forward SMS on to a web hook.
- Terretta 3y ago
  Thanks for this. We are hugely frustrated with providers insisting on SMS as a 2nd factor for commercial use because we value employee PII and feel they should not need to seed data brokers just do log into enterprise platforms. We are looking for a solution at scale for SMS 2FA that, according to the national number registry and KYC/anti-fraud checks, is a "real" mobile SMS number. We've found hardware devices that take from 4 to 32 SIM cards and are heading in that direction which seems ... nuts. But, we value employee privacy and these days when even your accounting firms' privacy policy say they're selling your contact info upstream, we want to give employees a way to log in without compromising themselves. Also, to anyone here running a B2B SaaS that offers TOTP instead of SMS, thank you.
  - sifar 3y ago
    Do you have a link for these hardware devices ?
    - Terretta 3y ago

baby_souffle 3y ago

> Cophones are VMs with virtual stacks How can this be determined? I'd imagine that only those with direct access to the "which number belongs to which provider" database could see that a given number belongs to $comapniesKnownToOfferTraditionalPhysicalService versus $comapnyKnownToOnlyDoVOIP can know this for sure? It it just that some companies with this access are selling a "we'll look that up for you" service? Or is it simpler and i'm just over thinking it?

rsync 3y ago
No, this is easy. Twilio API has a simple lookup function (call over curl) to see provider and type of number. Also shows subscribers name (usually). I have this in a shell script and look up numbers all the time: /usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name" -u $accountsid:$authtoken | /usr/local/bin/jq '.'
- rahimnathwani 3y ago
  If the owner of the number is a customer of a different telco (not Twilio), by what mechanism can Twilio determine whether the it's a physical (sim/esim/landline) or virtual number? Sure, some operators operate only physical or only virtual, but others (like Google) operate both.
  - stqism 3y ago
    This isn’t something casually identified with flashy software solutions or APIs, it’s more of a relationships with carriers and other companies in the telco space sorta thing. It gets even more fun when you start looking in to MO and MT on the SMPP side of things.
    - oriettaxx 3y ago
      by the way, if you only need a validation of a number, no need for Twilio: this is a great lib https://github.com/giggsey/libphonenumber-for-php https://github.com/giggsey/libphonenumber-for-php