Hacker News Reader

Comment by adyus | Hacker News Reader

In effect, Google computer vision got so good that they made their own system obsolete. This is a good thing.

I still think the only reliable way to confirm identity (or humanity) online is an email or SMS verification. Recently, receiving a 2-factor SMS code took less time than the page refresh prompting me to enter it.

View on HN

That confirms identity, but it doesn't confirm humanity. Robots just need to have a SIM card!

I think it would annoy many human users as well.

It makes it much harder to flood a given site with a large number of actions. For instance, if you require SMS verification for account signup, and you don't allow the same phone number to be used for more than, say, two signups per month, then you make it hard to create a large number of bogus accounts.

Yes, it will annoy some real users, so it's not a no-brainer. But it will put a major brake on many kinds of abuse.

Your underlying hypothesis here is that phone numbers are hard to get. But Twilio only charges $1/month per number, and presumably gets them for a lot less than that. If you use them for multiple nefarious purposes at once, your cost-per-evil could be pretty low.

And that's assuming that you just don't steal them outright. Suppose you boost somebody's Android game, repackage it, and add a little code that intercepts and replies to certain text messages. It'd basically be a SMS botnet.

SMS verification would make certain kinds of casual abuse harder, but I don't think it'd be a big barrier for well-organized assholes. E.g., the "Rachel from Cardholder Services" people that have been using the murkiness of the telephone network to sneak billions of illegal calls past the FTC.

We should just throw a standard turing test at them.

"How was your day?"

What you actually do if the verification is important enough (not often) is ask for a phone number, and have a human being call them. Some e-commerce sites do that, presumably ones exposed to frequent fraud, for example http://www.shatteredcrystal.com/, a game code reseller.

Requiring SMS or email creates problems for users that wish to remain anonymous. SMS is essentially not an option and the number of free email providers that accept registrations sans-SMS via tor continues to shrink.

Provide incentive to hack phones, discriminate against people who don't have phones or want to create new accounts.

Wouldn't it be trivial to code up a Twilio-powered bot to defeat the SMS verification?

Reply on news.ycombinator.com