4 ms·

> Ticketmaster now requires text message phone number verification, but they can bypass this by buying “Mobile Virtual Network Operator” phone numbers in bulk f

> Ticketmaster now requires text message phone number verification, but they can bypass this by buying “Mobile Virtual Network Operator” phone numbers in bulk from eBay I’m surprised SMS verification is this ineffective at testing for “human-ness”.

thfuran 3y ago
SMS are plaintext that can be obtained via web API. It seems on the face of it to be just about the least effective possible means of verifying human-ness.
- AnthonyMouse 3y ago
  The reason SMS verification is popular isn't because it's effective against sybil attacks. It's not. You can get access to phone numbers in bulk for little money. It's because most honest users only have one phone number, which makes it a useful unique ID for tracking the honest users. Anyone using it should immediately be under suspicion of selling you out.
  - deleted 3y ago
    [deleted]
  - costco 3y ago
    Well, I mean there's no way I can prove this but I think it has more to do with the fact that compared to email verification ($0.002/hotmail address), CAPTCHA ($0.003/reCAPTCHA), it substantially raises account creation costs because real US/EU phone numbers will be at least a couple cents per verification.
    - AnthonyMouse 3y ago
      There are a bunch of services that put any SMS received by a bunch of phone numbers on a public website, and they change the phone numbers all the time. You can go to any one of them and use it to create an account for free. Of course, this is another reason why the practice is harmful -- legitimate users with a legitimate desire to be anonymous will do this, and then if you use the number provided for account recovery, someone can steal their account after the number gets recycled. (This also happens to normies when people change their phone number and don't update it with your service; don't use phone numbers for password recovery. The near-100% probability of being reissued is a disaster.) But what happens at scale, for actual wholesale-level spammers? They get a contact with a phone carrier who lets them use all their unissued numbers. They operate one of these public SMS websites, which not only doesn't cost them money but turns a small profit because of the ad revenue. They do the same thing, but privately, and sell the availability of thousands of phone numbers to other spammers. Then they resell the SIMs to recover the money because they never actually used any of the prepaid data. Which makes offering the service to other spammers cheap, which keeps the price low if you want to be a buyer instead of a seller. The more people who try to do this on their service, the better this scales, because the customer base increases. It's just not meant for this and the inconvenience and privacy invasion to legitimate users is unreasonable.
kmeisthax 3y ago
The problem is that we're not testing for human-ness, we're testing for uniqueness. What we want is a button that, when pressed by a particular person, gives them one ticket, and then stops giving them tickets. This requires positive identification of each person buying tickets, which means spending lots of money to prevent people from obtaining multiple identifications. I suspect verifying government IDs would be a viable uniqueness criterion, except the only thing those IDs can buy you is voting rights in a particular country, which are usually worthless, so these systems aren't attacked. Now imagine if we decided that Taylor Swift ticket purchases had to be verified with ID. You could see, say, a particular country in the global south deciding they're going to just invent people on paper to go buy Taylor Swift tickets specifically so they can scalp them on the open market. The underlying problem is that so long as a particular economic opportunity exists, whoever is trusted to stop that opportunity from being exploited has an incentive to stab you in the back. Mobile network operators were never intended to be a 2FA code delivery system or Sybil resistance system, so they will totally just let people SIM-swap you or sell numbers in bulk to spammers, because not doing so was never in their job description and their business is not built to defend against such things.
- danaris 3y ago
  At least in the US, a government-issued ID a) is not required to vote in many places (and pushing for that requirement is, in fact, one of the major methods of classist/racist voter suppression), and b) is required to do various other things, like purchase alcohol, drive, or buy plane tickets. Due to (b), there is already a thriving black market in fake IDs for various reasons, and of various qualities. Government-issued ID systems are absolutely attacked, fairly aggressively.
- carlosjobim 3y ago
  The ID is for showing when you enter the venue to enjoy the show. When purchasing you just need to give your name.
jsnell 3y ago
It depends on how much money there's to be made, just like every other counter-abuse measure. Proof of work is useful for protecting things worth like a thousandth of a cent per transaction. Captchas for something worth 1/10th of a cent. Phone number verification for something worth $0.1-$1. Real-world presence and real-world id checks for things worth $100. The amount of money you can make scalping tickets is way higher than that, so it's not a useful defense. Doubly so when the cost of the phone verification isn't even per-transaction, but once per account. For the ticketmaster case, I think what you'd want is some kind of proof of stable liveness at every transaction. It's easy enough to game proof of liveness, or proof of unique identity, at account creation time. Just the classic method of paying people at a parking lot $5 to pass a "wave to the webcam" captcha. But they can't get those same people back for another captcha every time they want to use that account for another ticket. (Though it's possible that deepfakes have rendered webcam captchas effectively worthless in the last year or two, I don't know where the state of the art on deepfake detection for this kind of usecase is.)
_lvbh 3y ago
I use smspool for non-voip numbers. Very effective.
hedora 3y ago
I'm pretty sure they do this so they can sell your personal information. I avoid them whenever possible, but I recently bought a ticket for an event weeks after they went on sale (there was essentially no activity on the map of available tickets that day). They "unknown error"'ed me at the end of the purchase flow (inside their reservation timeout window). 60 seconds later, the tickets I had tried to purchase were being resold by a scalper. So, whatever their API is, it allows scalpers to get a feed of tickets that are in the middle of being purchased, then to buy them in the reservation window and offer them for resale with super human speed. That company is clearly run by crooks. They've repeatedly been brought under investigation for exactly this behavior (for over a decade), so presumably, they are also good at paying out bribes.

thfuran 3y ago

SMS are plaintext that can be obtained via web API. It seems on the face of it to be just about the least effective possible means of verifying human-ness.

AnthonyMouse 3y ago
The reason SMS verification is popular isn't because it's effective against sybil attacks. It's not. You can get access to phone numbers in bulk for little money. It's because most honest users only have one phone number, which makes it a useful unique ID for tracking the honest users. Anyone using it should immediately be under suspicion of selling you out.
- deleted 3y ago
  [deleted]
- costco 3y ago
  Well, I mean there's no way I can prove this but I think it has more to do with the fact that compared to email verification ($0.002/hotmail address), CAPTCHA ($0.003/reCAPTCHA), it substantially raises account creation costs because real US/EU phone numbers will be at least a couple cents per verification.
  - AnthonyMouse 3y ago
    There are a bunch of services that put any SMS received by a bunch of phone numbers on a public website, and they change the phone numbers all the time. You can go to any one of them and use it to create an account for free. Of course, this is another reason why the practice is harmful -- legitimate users with a legitimate desire to be anonymous will do this, and then if you use the number provided for account recovery, someone can steal their account after the number gets recycled. (This also happens to normies when people change their phone number and don't update it with your service; don't use phone numbers for password recovery. The near-100% probability of being reissued is a disaster.) But what happens at scale, for actual wholesale-level spammers? They get a contact with a phone carrier who lets them use all their unissued numbers. They operate one of these public SMS websites, which not only doesn't cost them money but turns a small profit because of the ad revenue. They do the same thing, but privately, and sell the availability of thousands of phone numbers to other spammers. Then they resell the SIMs to recover the money because they never actually used any of the prepaid data. Which makes offering the service to other spammers cheap, which keeps the price low if you want to be a buyer instead of a seller. The more people who try to do this on their service, the better this scales, because the customer base increases. It's just not meant for this and the inconvenience and privacy invasion to legitimate users is unreasonable.

kmeisthax 3y ago

The problem is that we're not testing for human-ness, we're testing for uniqueness. What we want is a button that, when pressed by a particular person, gives them one ticket, and then stops giving them tickets. This requires positive identification of each person buying tickets, which means spending lots of money to prevent people from obtaining multiple identifications. I suspect verifying government IDs would be a viable uniqueness criterion, except the only thing those IDs can buy you is voting rights in a particular country, which are usually worthless, so these systems aren't attacked. Now imagine if we decided that Taylor Swift ticket purchases had to be verified with ID. You could see, say, a particular country in the global south deciding they're going to just invent people on paper to go buy Taylor Swift tickets specifically so they can scalp them on the open market. The underlying problem is that so long as a particular economic opportunity exists, whoever is trusted to stop that opportunity from being exploited has an incentive to stab you in the back. Mobile network operators were never intended to be a 2FA code delivery system or Sybil resistance system, so they will totally just let people SIM-swap you or sell numbers in bulk to spammers, because not doing so was never in their job description and their business is not built to defend against such things.

danaris 3y ago
At least in the US, a government-issued ID a) is not required to vote in many places (and pushing for that requirement is, in fact, one of the major methods of classist/racist voter suppression), and b) is required to do various other things, like purchase alcohol, drive, or buy plane tickets. Due to (b), there is already a thriving black market in fake IDs for various reasons, and of various qualities. Government-issued ID systems are absolutely attacked, fairly aggressively.
carlosjobim 3y ago
The ID is for showing when you enter the venue to enjoy the show. When purchasing you just need to give your name.

jsnell 3y ago

It depends on how much money there's to be made, just like every other counter-abuse measure. Proof of work is useful for protecting things worth like a thousandth of a cent per transaction. Captchas for something worth 1/10th of a cent. Phone number verification for something worth $0.1-$1. Real-world presence and real-world id checks for things worth $100. The amount of money you can make scalping tickets is way higher than that, so it's not a useful defense. Doubly so when the cost of the phone verification isn't even per-transaction, but once per account. For the ticketmaster case, I think what you'd want is some kind of proof of stable liveness at every transaction. It's easy enough to game proof of liveness, or proof of unique identity, at account creation time. Just the classic method of paying people at a parking lot $5 to pass a "wave to the webcam" captcha. But they can't get those same people back for another captcha every time they want to use that account for another ticket. (Though it's possible that deepfakes have rendered webcam captchas effectively worthless in the last year or two, I don't know where the state of the art on deepfake detection for this kind of usecase is.)

_lvbh 3y ago

I use smspool for non-voip numbers. Very effective.

hedora 3y ago

I'm pretty sure they do this so they can sell your personal information. I avoid them whenever possible, but I recently bought a ticket for an event weeks after they went on sale (there was essentially no activity on the map of available tickets that day). They "unknown error"'ed me at the end of the purchase flow (inside their reservation timeout window). 60 seconds later, the tickets I had tried to purchase were being resold by a scalper. So, whatever their API is, it allows scalpers to get a feed of tickets that are in the middle of being purchased, then to buy them in the reservation window and offer them for resale with super human speed. That company is clearly run by crooks. They've repeatedly been brought under investigation for exactly this behavior (for over a decade), so presumably, they are also good at paying out bribes.