Hacker News new | ask | show | jobs
by Terr_ 952 days ago
Yeah, gotta consider multi-modal interactions... and also there's no good way to pre-validate ownership of a phone number.

So suppose Carol clicks "Contact Me Immediately Please" on a website and and enters her phone number... But--oops--there's a typo. Now Alice is going to get an "unsolicited" message even though literally everybody involved is operating in good faith.

Even if someone is maliciously pretending to be Alice, neither the website nor the phone-carrier has a better malice-detecting tool than simply sending it and seeing if the recipient replies "STOP".

2 comments

> Even if someone is maliciously pretending to be Alice, neither the website nor the phone-carrier has a better malice-detecting tool than simply sending it and seeing if the recipient replies "STOP".

I sometimes wonder how many people use the STOP function. I'm more inclined to ignore it (if it's a one-off) or use the spam reporting feature than I am to reply "STOP" if I don't recognize the sender/campaign because of how jaded I've gotten from email. If you hit the "unsubscribe" link on a spam email, you only get more spam because you just confirmed the inbox is a) active, b) monitored, and c) is checked by someone willing to open and interact with spam messages.

By the time SMS spam became common, I just assumed things would play out the same, and have probably reported plenty of legitimate mistypes to Verizon as spam. It just doesn't feel like it's worth the risk to directly respond.

Considering how many times phones get hacked just by viewing a text message it's probably best to delete any texts from an unknown number unread. If you've got an iphone you're probably screwed the moment it hits your device, but at least you can try to avoid interacting with what might be a "specially crafted text message" as much as possible.

2016 https://www.theguardian.com/technology/2016/jul/22/stagefrig...

2018 https://www.vice.com/en/article/qvakb3/inside-nso-group-spyw...

2019 https://www.wired.com/story/imessage-interactionless-hacks-g...

2020 https://macsecurity.net/view/458-imessage-zero-click-exploit...

2021 https://www.wired.com/story/apple-imessage-zero-click-hacks/

2023 https://www.forbes.com/sites/daveywinder/2023/06/02/warning-...

"phones get hacked just by viewing a text message.... iphone you're probably screwed the moment it hits your device"

IIRC, there was a ~recent (2023) iOS CVE that matched this description, and it got a TON of attention because it was such an anomaly. I'm not shilling for Apple, but want to understand your comment better.

I would settle for stronger sender authentication. Of course SS7 and all that...