Comment by psanford | Hacker News Reader

Comment by psanford | Hacker News Reader

Hey Twilio, maybe now you'll implement webauthn for both your internal systems and for your customers?

Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and companies like twilio simply have not prioritized it yet. Replacing SMS and Push based 2fa with webauthn is the best bang for your buck security upgrade available to companies right now.

EDIT a bit later:

> We have reemphasized our security training to ensure employees are on high alert for social engineering attacks, and have issued security advisories on the specific tactics being utilized by malicious actors since they first started to appear several weeks ago. We have also instituted additional mandatory awareness training on social engineering attacks in recent weeks. Separately, we are examining additional technical precautions as the investigation progresses.

Security training is ineffective against phishing attacks like this. Please stop wasting your money and your employees time; implement the technical solution that nullifies the attack.

"Its pretty frustrating that there's a well known technical solution that prevents this type of attack from being feasible and companies like twilio simply have not prioritized it yet."

I understand your frustration but you are missing the point.

2FA with a valid (non-VOIP) SIM card is not for your security. They tell you it is, and they dress up the process as if it is, but they are lying to you.

Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago.

Instead, they do what they can: throw sand in the gears and slow down the bad actors with ridiculous, obviously absurd (put in any phone number we have never seen before to prove that it's you) mechanisms and hope the real customer base doesn't balk.

They can require a phone number for signup while still supporting WebAuthn.

"Twilio, et. al, have a brutal, unrelenting scam/spam problem and they have no solution for it. They have nothing. If they had a solution they would have deployed it long ago."

That's an interesting point I hadn't heard that before. Don't banks essentially do some form of this with KYC checks?

Would expect being smart about bringing in some components of that process would reduce spam while not introducing too much user friction.

Bank KYC is different because all the banks have to do it, so you can't really avoid it (although maybe some are worse than others). Also, banking usually has more switching costs; people don't usually sign up for a bank, run a couple transactions and leave for another. Twilio is one of a large number of players in this market, spending a lot of effort on KYC likely turns off some customers and may be overinvesting for tire kickers.

I have worked in this space - aside from WebAuthN, the spam/scam problem is tough for a SaaS Telco company because anti-spam/scam is directly at odds with a low-friction self-serve experience.

You also have to realize that Twilio is not a Telco, they ride on top of big Telco company infrastructure and ultimately has to answer to big Telco, and big Telco is very risk averse and generally has to answer to regulators. So Twilio doesn't want spammers either because they get dinged, blocked, or marked as spam by the Telcos.

Ultimately there's probably more that the underlying Telco infrastructure could do more to support anti-spam measures but these companies are dinosaurs that move very slowly. It's easy to deride them from the position of enlightened SaaS company employees, but they're the ones in the capital-intensive business of maintaining worldwide networks of copper wires in the ground, physical switches, systems designed in the 1980s or the 1950s and complying with incredibly complex and outdated regulatory structures. It's the "legacy system" of a developer's nightmare to the 100th power.

Having a good flow for self-serve customers to sign up and get going is the cheapest way to get new business, and developers will not even look twice at you if it's hard to get going in a self-service manner on you platform.

However, it's exactly that low friction that gets spammers going easily.

So what do you do?

You try to come up with heuristics and even ML models to identify bad actors early. It's an ongoing constant battle, a game of whack-a-mole where the moles have basically zero cost overhead, no legal entity associated with them, and can just keep popping up over and over and over forever.

So you're staffing a fraud detection team of engineers, you have lawyers and finance people on this, you have customer service for customers who get caught as a false positive - it's all an extremely expensive pain in the ass.

Isn’t SMS based 2FA responsible for a lot of Twilio’s revenue?

I guess dogfooding isn't a great idea if the kibble is rancid.

SMS campaigns, both target and blanket, simply must dwarf any 2fa usage. In just one role I saw Sms-shots with 10s of thousands of recipients. SMS is also fairly heavily used for non-secure notifications (you bill is due / payment received / your password changed, etc.) quite heavily IME.

I wonder how often SMS 2FA serves as the entry point for more business. Like, devs choosing Twilio to try it out for low volume work before expanding into large campaigns.

It's kind of both. SMS 2FA is more likely to serve as an onramp for "good customers" who are developers actually building real applications using your services, rather than people who are mass-blasting borderline spammy marketing texts.

Traffic that gets identified as marketing traffic as opposed to traffic that will involve a human responding (like a chat bot to schedule with your doctor's office) actually costs Twilio much more to send because the Telco carriers charge more because they have to put more into mitigating the risk of getting blocked and sued for spamming.

So the "good customers" are lower volume but higher margin, and generally more likely to grow at a sustainable pace and not disappear off the map, as the have a lot of code around using your APIs, not just "Send a kajillion messages". Those "marketing" customers will jump off your platform in a blink of an eye if someone offers them cheaper prices and less oversight on their spammy practices.

> Security training is ineffective against phishing attacks like this.

I wouldn’t say that. There’s a significant effect of training on the number of people that click. The big problem is that the attackers have to only get it right the one time.

Unless security training takes the click rate to zero it is ineffective in protecting your organization from phishing attacks.

Nothing can take the risk to zero. The goal is to take steps to minimize that risk. The average “click rate” for phishing emails is something like 18% (don’t quote me on that exactly) and if you can institute training that brings it lower then you are working to minimize risk. You should do other things as well to further reduce risk, but training is one tool in the toolbox to help.

That is incorrect. Mandatory WebAuthN eliminates this risk. Stop wasting your time with inferior alternatives.

How much communication would shift to informal methods if the barrier to communicating over approved channels got too big?

I think that's exactly the grandparent's point: any mitigation that relies on making 100% of people 100% perfect, 100% of the time, is not going to be effective.

It's important to note that Twilio can't sell WebAuthn as a service, at least not until they try to compete with Auth0 or Okta B2C directly. If they provide it on their own accounts instead of dogfooding their 2fa products, it probably doesn't inspire their customers with confidence in Twilio's product.

Reply on news.ycombinator.com