Tell HN: Idea to End TXT Scams | Hacker News Reader

Tell HN: Idea to End TXT Scams

1 pointdools1 comment

1) Don't ever send app notifications from alphanumeric senders, only ever send from numeric senders to which the recipient can reply

2) When someone creates a relationship with you, use a similar flow to the "double opt-in" for email subscriptions. You send them a welcome notification, and ask them to save the number in their contacts. ONLY ever send notifications from this number

3) Every TXT ends with "Suspicious message? reply REPEAT to re-send the last message we sent you". The user will get used to seeing those notifications from you.

4) The recipient can then reply REPEAT and your system will always re-send the most recent message. If a scammer spoofed a message with your sender ID (which is trivial) the REPEAT will go back to your number (it's much harder to fraudulently receive messages on a number, than it is to fraudulently send messages from a number) and your system replies with the most recent message. If it differs then the suspicious message can be ignored

I would rather SMS and phone numbers be deprecated. The technology is no longer fit for purpose. It's going to take decades before spoofing is actually fixed. Sim-swapping will exist as long as phone numbers keep being linked to financial accounts. The ephemeral nature of phone numbers is completely ignored by all institutions (this has been discussed on HN many times, it is a real problem homeless/disadvantaged people). And trying to receive calls/SMS while travelling is either annoying, expensive, or sometimes impossible. All of these problems are either partially or completely solved by other technologies. Email is better in every regard. SPF/DKIM solves virtually all spam/scam issues. My email account is a lot harder to take over. My email account is not ephemeral (although some are). I can send and receive emails from anywhere in the world, and my email address doesn't change depending on where I am in the world. Yet still I find myself having to constantly fiddle with my sim while travelling because virtually every institution I deal with wants to send me an OTP, in addition to a rising number of online accounts and apps (most recently BeReal and Artifact which only allow phone number signup).

Reply on news.ycombinator.com