top | item 38142283

(no title)

DerekBickerton | 2 years ago

SMS is a dated technology and I despise services that use SMS, especially for OTP / PINs used to sign in. SIM cards can be 'swapped' by bad actors all too easily. I understand you want to stop abuse, but there's other ways to do this like CAPTCHAs or putting your site on Cloudflare and filtering out rogue/malicious IPs like VPNs/Tor, or doing things like rate-limiting.

discuss

order

colomofo|2 years ago

Yeah, I'd never use SMS for 2FA in 2023. Mine is not a security sensitive use-case.

I'm currently planning to use Twilio or Plivo with their Lookup APIs to filter out VOIP-type phone numbers and to send messages.

The lookups seem to basically double the cost (for U.S. numbers) but is still relatively affordable.

Somewhat worried about A2P 10DLC since I've never dealt with it and don't know how much of a blocker or delayer it is.

I'd really just like a cheaper (but reliable) service that combines texts to exclusively personal mobile numbers.