3 ms·
From your video, I noticed that on a smart phone, you authenticate user by sending a code through text. Isn't that redundant? Whoever has that phone will get th
by kailuowang 13y ago
From your video, I noticed that on a smart phone, you authenticate user by sending a code through text. Isn't that redundant? Whoever has that phone will get that text..
- lnanek2 13y agoWhatever API they are using the get the phone number without the user entering it on mobile is probably easy to spoof. It may not even work on all platforms and the user may have to type a phone number in that case. Would you trust a phone number handed to you by a PhoneGap JavaScript method, for example? It would be pretty easy to tweak to return whatever is needed.
- ricardobeat 13y agoThe mobile number is entered by the user on his first purchase, not retrieved from the device itself. I don't think any device exposes phone numbers to browser APIs at all.
- ricardobeat 13y agoThat's exactly the goal. Only the registered phone can be used for purchases using your saved CC data.
- ceejayoz 13y ago> Whoever has that phone will get that text. Not someone who stole the remember-me cookie off the phone, though.