News for hackers. Stuff that matters.

A comment on Twitter API hacked, user database being sold online. Parent comment

Re:Twitter API hacked, user database being sold online by jlmb on Sunday December 25, 2022 @04:28PM (#34131512)
I think the main problem is that SMS sender numbers can be easily spoofed (might depend on country, operator, …), so relying on “this message came from where it says it came from” is not really possible.

It might not be an issue for some types of usage, but sounds risky if used for account security/recovery/etc.

[ Parent | on HN ]
Re:Twitter API hacked, user database being sold online by evan_ on Sunday December 25, 2022 @05:22PM (#34132095)
If you keep your number private it won’t matter. In fact you could spoof the number on purpose for an extra layer of security.
[ Parent | on HN ]
Re:Twitter API hacked, user database being sold online by jlmb on Tuesday December 27, 2022 @06:41AM (#34147822)
Phone number verification (of any kind) is supposed to make sure that the phone number provided belongs to the account owner.

If the number is not actually validated in a secure (enough) manner, there's no point in using phone numbers at all.

[ Parent | on HN ]