6 ms·
I love the absurdly simple way this works. That said, maybe there should be some form of (appropriately simple) authentication on each request, because what if
by alansammarone 12y ago
I love the absurdly simple way this works. That said, maybe there should be some form of (appropriately simple) authentication on each request, because what if my phone gets stolen/lost?
- bgvrofg 12y agoYou could do this: if you enable passcode confirmation, type your pass anywhere in the text message along with your text confirmation. If you forget, you get a request to do so.
- alansammarone 12y agothat may not be ideal. most people keep their sms history, so the person trying to use the service in my behalf could just scroll the screen. or do you mean some sort of one timer passcode? that could complicate things a bit, not sure how it could work
- bgvrofg 12y agoYou could call them and enter a few numbers I guess. This isn't stored, at least on my phone since you are in a call, and can be automated. ( Or just don't store that message. )
- alansammarone 12y agoye, that seems reasonable... it kinda complicates the process though
- MereInterest 12y agoExcept that text history is usually saved on the phone. If someone has access to sending texts, they will have access to that as well. It is probably better to go with phone locking, instead. That said, I like the passcode idea. I know that caller ID is easily spoofed, and so I would imagine that the source ID for text messages can be spoofed as well. Requiring the passcode would prevent this sort of attack.
- wongarsu 12y agoThe source of text messages is indeed easily spoofed. Most paid services enabling you to send SMS over the web allow you to set arbitrary sender IDs, so the cost of entry for spoofing is about $5. It's not hard to imagine this leading to trouble as soon as you get into the crosshairs of some internet troll who managed to get your mobile number.
- bgvrofg 12y agoPrediction, they will switch to a simple app soon.
- driverdan 12y agoIf your phone gets lost or stolen and thieves have enough access to use text messages this service should be the least of your worries.
- pbreit 12y agoDegrade the service for everyone to possibly defend against a theoretical problem?
- frakkingcylons 12y agoThe problem isn't theoretical, just sufficiently unlikely for them to take no action at this point. Consider the scenario where my phone is stolen and the thief transfers money out of my bank account with Venmo (which has no passcode or similar auth). It's unlikely, but not theoretical.
- pbreit 12y agoI think it's quite conceivable that both examples would never happen. And then if it did, is it that big a problem?
- alansammarone 12y agoI would think twice before using a service that makes no effort to protect me in case of thieves or wannabe hackers. Of course, degrading the service because of security is an old and very common problem, but maybe the sweet spot would be to degrade it minimally, so that everyone gets a lot more security for just a bit less of Magic®?
- pbreit 12y agoWell, with Magic there is almost always a geographic aspect to fulfillment which would ward off most/all theft attempts. The time to perform risk mitigation is when a strange, large request comes in.