Hacker News Reader

Comment by alansammarone | Hacker News Reader

I love the absurdly simple way this works. That said, maybe there should be some form of (appropriately simple) authentication on each request, because what if my phone gets stolen/lost?

View on HN

If your phone gets lost or stolen and thieves have enough access to use text messages this service should be the least of your worries.

Degrade the service for everyone to possibly defend against a theoretical problem?

The problem isn't theoretical, just sufficiently unlikely for them to take no action at this point. Consider the scenario where my phone is stolen and the thief transfers money out of my bank account with Venmo (which has no passcode or similar auth). It's unlikely, but not theoretical.

I think it's quite conceivable that both examples would never happen. And then if it did, is it that big a problem?

I would think twice before using a service that makes no effort to protect me in case of thieves or wannabe hackers. Of course, degrading the service because of security is an old and very common problem, but maybe the sweet spot would be to degrade it minimally, so that everyone gets a lot more security for just a bit less of Magic®?

Well, with Magic there is almost always a geographic aspect to fulfillment which would ward off most/all theft attempts. The time to perform risk mitigation is when a strange, large request comes in.

You could do this: if you enable passcode confirmation, type your pass anywhere in the text message along with your text confirmation. If you forget, you get a request to do so.

Except that text history is usually saved on the phone. If someone has access to sending texts, they will have access to that as well. It is probably better to go with phone locking, instead.

That said, I like the passcode idea. I know that caller ID is easily spoofed, and so I would imagine that the source ID for text messages can be spoofed as well. Requiring the passcode would prevent this sort of attack.

The source of text messages is indeed easily spoofed. Most paid services enabling you to send SMS over the web allow you to set arbitrary sender IDs, so the cost of entry for spoofing is about $5.

It's not hard to imagine this leading to trouble as soon as you get into the crosshairs of some internet troll who managed to get your mobile number.

Prediction, they will switch to a simple app soon.

that may not be ideal. most people keep their sms history, so the person trying to use the service in my behalf could just scroll the screen. or do you mean some sort of one timer passcode? that could complicate things a bit, not sure how it could work

You could call them and enter a few numbers I guess. This isn't stored, at least on my phone since you are in a call, and can be automated. ( Or just don't store that message. )

ye, that seems reasonable... it kinda complicates the process though

Reply on news.ycombinator.com