3 ms·

SMS auth fraud, where malicious users aim to receive auth codes to premium rate numbers, is a huge problem. This pushes that problem on to users.

gruez 3y ago
Numbers used for toll fraud are concentrated in certain countries/prefixes. Without knowing exactly what measures telegram is using to avoid toll fraud, it's impossible to know whether they're actually "pushing that problem onto users" and to what extent. The charitable interpretation is that they're doing only routing known low risk numbers to be sent by users (eg. +1 numbers corresponding to Canada/US is probably safe), or are sending the codes indiscriminately.
- danpalmer 3y ago
  This is true, but their terms of service do say explicitly that they are not responsible for charges. Are they going to get it right in every region, in every number range? Is it even possible to distinguish between premium rate and regular rate in all parts of the world? It's really quite high risk for users.
- lxgr 3y ago
  > eg. +1 numbers corresponding to Canada/US is probably safe Probably, until you consider that the NANP also includes some smaller countries, often served by a single incumbent telco, whose area codes have been involved in call pumping schemes before. Are you absolutely sure your provider blocks these automatically and doesn't charge you horrendous sums per message there? If so, are you sure Telegram knows about the problem and has taken all the necessary precautions?
  - gruez 3y ago
    >Probably, until you consider that the NANP also includes some smaller countries, often served by a single incumbent telco, whose area codes have been involved in call pumping schemes before. It doesn't seem too hard to have a whitelist of 3 digit area codes known to be a "safe" jurisdiction. You can just reference https://en.wikipedia.org/wiki/List_of_North_American_Numbering_Plan_area_codes https://en.wikipedia.org/wiki/List_of_North_American_Numberi... and be done within an hour.

gruez 3y ago

Numbers used for toll fraud are concentrated in certain countries/prefixes. Without knowing exactly what measures telegram is using to avoid toll fraud, it's impossible to know whether they're actually "pushing that problem onto users" and to what extent. The charitable interpretation is that they're doing only routing known low risk numbers to be sent by users (eg. +1 numbers corresponding to Canada/US is probably safe), or are sending the codes indiscriminately.

danpalmer 3y ago
This is true, but their terms of service do say explicitly that they are not responsible for charges. Are they going to get it right in every region, in every number range? Is it even possible to distinguish between premium rate and regular rate in all parts of the world? It's really quite high risk for users.
lxgr 3y ago
> eg. +1 numbers corresponding to Canada/US is probably safe Probably, until you consider that the NANP also includes some smaller countries, often served by a single incumbent telco, whose area codes have been involved in call pumping schemes before. Are you absolutely sure your provider blocks these automatically and doesn't charge you horrendous sums per message there? If so, are you sure Telegram knows about the problem and has taken all the necessary precautions?
- gruez 3y ago
  >Probably, until you consider that the NANP also includes some smaller countries, often served by a single incumbent telco, whose area codes have been involved in call pumping schemes before. It doesn't seem too hard to have a whitelist of 3 digit area codes known to be a "safe" jurisdiction. You can just reference https://en.wikipedia.org/wiki/List_of_North_American_Numbering_Plan_area_codes https://en.wikipedia.org/wiki/List_of_North_American_Numberi... and be done within an hour.