Email or username:

Password:

Forgot your password?
dansup

We could eliminate most fediverse spam with sms registration at the expense of early adopters who disproportionately despise it.

Do we sacrifice growth for "UX" or take advantage of established anti-spam measures?

This is the million dollar question for every #activityPub project. What do you think? #fediverse #spam

21 comments
lars

@dansup How does SMS registration help when anybody can run their own fediverse server?

WelshPixie, ShadowFigure

@dansup I think that:

a) People have easier access to email addresses than cell phones and the fediverse shouldn't be gatekeeped behind technology that's harder to access

b) A phone number is a far more personal thing to put into a site than an e-mail address and people generally don't like giving their numbers to sites to register with.

Sure, that makes spam more likely, but I'm fine with that trade-off.

@francks

@dansup i read, don't remember where, that in #fédiverse, software should not be designed to limit accessibility nor interactions between people but to help them having behaviours as it could be in a mature relationship.

Alex

@dansup I don't think a phone number is the way to go. There are a lot of security issues around this and more people are moving away from them in, in my opinion.

Maybe requiring 2FA for a while to curb any spam as that also sets users up for good security practices as well?

🍵 holly 🌿

@dansup I’m on a server of three people, and I’m really curious about this fediverse spam thing.. what is it and can you not just block the instance it’s coming from? I do not get spam on mastodon. Occasionally there’s a toxic user, but I just block them or their instance, depending, and it’s rare enough that it’s a surprise when it happens.

Григорий Клюшников

SMS costs money per message and this alone means it's a non-starter. Besides, phone numbers have other issues:
- The security, and the continued existence, of your phone number is wholly dependent on your carrier. You can't take it into your own hands.
- Phone numbers are tied to countries. This is a problem for people who travel.
- You can't self-host a phone number.
- In many countries around the world, a government-issued ID is required to buy a sim card, which means no anonymity whatsoever.

  jaz 🏴󠁧󠁢󠁷󠁬󠁳󠁿

@grishka @dansup all th eabove is true, however, if it were -optional- users could choose to register on a server that does not have this as a requirement. There are thousands of servers,most of which may not need or want these options. That doesn't mean no-one wants these options.

  Григорий Клюшников

Jaz, and if only some servers implement SMS authentication, how that would help curb spam? How would that phone number confirmation federate, anyway? Are we going to trust a central authority of some sort?

  jaz 🏴󠁧󠁢󠁷󠁬󠁳󠁿

@grishka this is not about spam content being federated, it's about spam registrations. it's about curbing the actual registrations on some servers that want to curb registrations.

this is not about sms, it's about options that include sms, captcha, others

  jaz 🏴󠁧󠁢󠁷󠁬󠁳󠁿

@grishka @dansup

>How would that phone number confirmation federate, anyway?

There is no need for it to do so. This is about stopping spammers gaining access to the service, a single server can choose to implement an additional step for registration to help slow down unwanted spam registrations.

Nothing needs to be federated, nothing needs to be kept on file. This is only about registration.

  Григорий Клюшников

Jaz, okay. I assumed it was about spamming other people with unwanted content. Then... whatever, I guess? It's a choice each server admin makes independently. I've already seen Mastodon servers with captchas.

  Ricardo

Your post made think & remember of this.. invisv.com/pgpp/
I'm not saying it's a solution but it's interesting to regarding part of the phone number/sim/imei issue centralization. #pgpp

LPS

@dansup SMS is the worst, it de-anonymizes users, which in my opinion is the last thing in the world we want on the fediverse. As others have mentioned, there are other non-invasive ways of doing this social.tchncs.de/@pixelcode/10

LPS
Solinvictus :verified:

@dansup as seen in the latest Twitter data leak SMS is not secure, and there were plenty of examples to back this argument.

I’d rather enforce enabling 2FA with Authenticator app during registration.

infinite love ⴳ

@dansup this wouldn't even eliminate spam it would just exclude people without phone numbers

the way to eliminate spam is human approval of registrations and federation

  Григорий Клюшников

infinite love ⴳ, people without phone numbers? I'm sure curious how they get by without all those services that require a phone number, often one capable of receiving SMS, so not a landline either.

An online store? You need a phone number. Taxi? You need a phone number. A bank account? You need a phone number. Government services? You also need a phone number if you don't want to spend literal days in queues. How does one even get an internet connection in the first place without a phone number?

  infinite love ⴳ

@grishka yes. i would assume it's even more common for minors. services need to recognize that not everyone has a phone number.

on the other hand, it's not as bad as you think it is. not every store requires a phone number, not everyone rides a taxi (and i've never heard of one that *requires* a phone number), government services are a crapshoot on whether phones are optional or required. and internet is available either through your family's home connection or through public wifi.

Technical Issues

@dansup I’m against utilizing SMS. It’s not secure, exposes phone numbers necessarily, and excludes anyone without a phone.

DELETED

@dansup The next logical step will be SMS-based password recovery, because it always happens after that, which will be used by governments to fuck social accounts of any person they don't like. Nice plan :shrug_akko:

Go Up