Hacker News Reader

Comment by voltagex_ | Hacker News Reader

Instant PhoneCheck USD 0.030

Active SIMCheck USD 0.090

Strong SubscriberCheck USD 0.200

I haven‘t tried it, but I‘m willing to bet that at least one of these would claim that my primary phone number "is not a mobile phone number" (but I use it on a phone), "is not registered in my name" (it is, and how do you claim to know?), or "is a VoIP number, which is insecure and therefore not allowed".

Phone numbers are neither good user identifiers nor viable authentication factors.

We do not verify any of your personal information. We neither have access to that nor store any of it on our system. Our PhoneCheck product simply returns a true or false. Is your phone number tied to this SIM Card. This is information the MNO already has, they know your phone number and your SIM Card. The request is made over a cellular data connection from your device to the MNO

What's the difference between these three tiers of authentication, then? And what makes it different from SMS-OTP (leaving aside SS7 security concerns and focusing on SIM swapping, which I believe is responsible for the majority of successful attacks so far)?

This pricing is outrageous!

It's actually comparable to SMS OTP delivery in most countries. (Only the US and a few other "shared cost" countries offer inbound SMS delivery for sub-cent amounts; in the EU and other "sender pays" countries, mid-single cent amounts are the norm.)

That still doesn't make using a phone number a good authentication or identification value, though.

No, it's not. If you use Twilio, maybe, but there are many other options today, one of them being SignalWire [0]. Another being Plivo [1].

[0]: https://signalwire.com/pricing/messaging

[1]: https://www.plivo.com/pricing/

Note that I wrote "most countries other than the US".

Your first reference seems to be US only; the second one lists around 2-10 cent per message to most non-US destinations.

Since this is based on what phone networks charge these service providers and other networks for inbound SMS, anything much cheaper than that is usually using unreliable SIM farms or even more dubious means of message delivery (like hijacked Android smartphones on unlimited messaging plans used without the owner's explicit consent).

Viewed globally, cheap and reliable outbound SMS are a US-specific anomaly.

For thouse countries, typically with lower standards of living, their pricing will be even more prohibitive! There are tricks like callbacks, etc. to deal with expensive texting and many services use those already!

Let's not get into the debate about standards of living in the EU vs. the US, but doesn't all of this outline my original point, i.e. 3-9 cents per authentication being pretty on par with what companies seem to already be willing to pay for two-factor authentication (via SMS-OTP) globally?

In other words, it's an abusive copycat pricing model (if others are thieves, we should be, too). Except there's a lot more infrastructure and personnel behind a text message, so, tru.ID are bigger thieves! Also, the vast difference is that tru.ID requieres an app and SMS does not, so, you should not compare apples to oranges! If you really want your customers to install yet another app, then good luck! In fact, their app is a bit finicky as I installed it and starts with a Java error and then a endless spinner on a blank screen! Not to mention, they have 2 QR codes next to each other for download on their web pages, way too close to each other, and not sure why they don't have a simple device-based redirect with a single QR code, or use another abusive service to do this trivial job if they are not up to the challenge themselves.

Reply on news.ycombinator.com