search

natsu90 / dial2verify-twilio

Phone verification at no cost (Deprecated)
https://github.com/natsu90/dial2verify-twilio-2
446 stars 18 forks source link

Spoofing Warning #1

Open namuol opened 8 years ago

namuol commented 8 years ago

Granted that nowhere in your README do you use the words "authentication", it's still probably a good idea to note in the README that this isn't meant to be a form of secure authentication, as it's trivially easy for Bad Guys to spoof caller ID.

alexslade commented 8 years ago

It also means any bad actors can verify phone numbers. Only way to prevent that is to place a call/text to them with a code or similar. This is still really cool, but +1 for a very clear warning about spoofing.

pandrewhk commented 8 years ago

With enough numbers (10k+), one could initiate a call from twilio and request user to enter the phone number or just return the call.

alexslade commented 8 years ago

That would cost thousands of dollars! This is tool is great as-is, it should just be used in the right way.

pandrewhk commented 8 years ago

Oh, scratch that. Spoof a number, leave a missed call, ask user to enter. Twilio does not officially support it, but maybe other services do and don't charge for making a missed call.

SpoofCard.com: «Timing on calls begins when your call is connected»

natsu90 commented 8 years ago

In Malaysia, customize caller ID is not allowed, telcos are forced to display the real number to receiver (usually in SMS, but not sure if it apply to phone call as well). Maybe this will do if Twilio provide phone number from Malaysia or other country which have similar regulation.

ctorresr commented 8 years ago

I think this is a great start, in the sense that at the least you got a phone number from the user and you are able to "verify" a call from that number was made. I will also implement a second step, send the user an sms with code so the user can confirm. Will be forking an playing around with some posibilities. But CID spoofing is very real, no matter what telco you have if you know what you are doing.