Hacker News Reader

Comment by cwoolfe | Hacker News Reader

"add number two to your backlog if you work on iOS or Android" I would...but as an iOS and Android developer, how do I know if it's a non-verified sender ID? The reason browsers can warn on these things is because of public key infrastructure, but that doesn't exist SMS phone numbers. Am I missing something?

View on HN

I believe the author means if you work at Apple or Google. So working ON iOS or Android, rather than working ON [top of] iOS or Android.

Correct.

No, you're not missing anything. The author of the article just suffers from a naive and simplistic misunderstanding of the SMPP protocol and the mobile grid.

Hello, author here.

What I ask is for iOS and Android to have the "this message was not verified" warning, as shown in the last screenshot, whenever the sender ID is displayed without any form of verification (such as, the aforementioned country-specific sender ID registries).

If browsers show "not secure" unless verified by SSL, apps should show "not verified" unless verified _somehow_.

The "how" may or may not be possible at this moment, but in any case, warn by default.

Is that naive?

Yes. The _somehow_ is unfathomably more complex for SMS than it is for certificates. These two ecosystems don't even begin to compare the slightest, whether from technical perspective or from regulatory perspective. Warning by default would be completely pointless until there's a way to also achieve the opposite; a verification and "approval". It would just do more harm, and it would upend a tremendous number of legitimate businesses and use cases.

Reply on news.ycombinator.com