News for hackers. Stuff that matters.
Re:Sob story about dead grandma tricks Microsoft AI into sol... by AnthonyMouse on Monday October 02, 2023 @05:13PM (#37744472)
Phone verification wouldn't work at scale, the more services use it the more profitable and common it is to have sites that let people receive SMS to a random phone number over the internet etc.

It's also likely to lead to some kind of privacy laws in various countries (or may already violate some) because a primary reason services use it now is so they can snatch your phone number and use it to correlate you across different services. Which for the same reason makes honest users wary of it, especially as it becomes increasingly common knowledge why services ask for it.

A good solution might be some kind of anonymous payments system, so you can make a nominal refundable deposit to create an account which is forfeit for abuse, and then sites can fund more expensive or manual abuse-detection systems from the forfeited deposits in proportion to how much abuse they encounter.

Re:Sob story about dead grandma tricks Microsoft AI into sol... by mminer237 on Monday October 02, 2023 @05:38PM (#37744796)
I've never had a VoIP number work for phone verification. Providers seem very diligent in blocking such services to prevent their usefulness from degrading. Very large companies like Google, Meta, and Valve already are quite successful at requiring a phone number for verification at scale.
Re:Sob story about dead grandma tricks Microsoft AI into sol... by AnthonyMouse on Monday October 02, 2023 @06:29PM (#37745318)
The services don't have to use VoIP numbers. Nothing stops them from buying cheap prepaid SIM cards in bulk and putting them in a bank of devices connected to their servers.

Scale here is not the size of the service, it's the number of services that use this verification method. When you have 1000 phone numbers and one service requires this, you can use them to create 1000 accounts on that service. When you have 1000 phone numbers and 100 services do this, you can use them to create 1000 accounts on each of them, i.e. 100,000 accounts. So the value of each number increases but its cost stays the same.

There will no doubt be some cat and mouse game where they try to detect the numbers being used for this and block them, but that's not going to work too well since a prepaid SIM card is cheap and as soon as they're done it with it, it goes back to the carrier to be assigned to an ordinary customer.

Re:Sob story about dead grandma tricks Microsoft AI into sol... by BenjiWiebe on Tuesday October 03, 2023 @10:08AM (#37752206)
Chase Bank allows Google Voice numbers. In fact I'd say around 95% of the services I use which require SMS work with Google Voice.
Re:Sob story about dead grandma tricks Microsoft AI into sol... by EGreg on Monday October 02, 2023 @05:36PM (#37744756)
Can’t AI simply carry on a complete phone conversation in your voice, trained on all your emails and transcribed zoom calls?

Oh, we are trusting the corps won’t train in that and won’t fine tune on our personal data. Ok!

Things can get really wild when AIs can open lots of fake accounts all over the place.

Most banks ask me verification stuff that has probably been stolen many times by now.

Re:Sob story about dead grandma tricks Microsoft AI into sol... by AnthonyMouse on Monday October 02, 2023 @06:32PM (#37745350)
The point of the phone verification isn't that the AI can't impersonate you, it's that you have to give them a phone number. Which they mostly want so they can track you, but in theory phone numbers cost money and provide a rate limit.

The problem with this theory is that phone numbers are actually just bits in a phone company's computer and gaining access to them in bulk will become both cheaper and more common the more demand there is for it.