Posts by Kelley Robinson

By Kelley Robinson 2021-11-29

Get started building push authentication with React Native and Twilio Verify

Verify Push is a powerful API and SDK that turns a mobile device into a secure key that can replace passwords or add two-factor authentication to web or mobile login. Push authentication is one of the most secure and user friendly forms of authentication and our React Native SDK makes it easy to write familiar JavaScript code for iOS, Android, or both!

This blog post will walk through how to get up and running with our React Native SDK and sample application to see Verify Push in action on your device or emulator. This is a great way to experience the functionality and get your development environment set up properly. It's also a good starting point for adding push authentication to your own application.

Prerequisites for building push authentication with React Native

To code along with this post you'll need:

A free Twilio account; sign into an existing account or …

By Kelley Robinson 2021-11-18

How to build TOTP support with the Verify API and Google Authenticator

While One-Time Passcodes (OTPs) delivered via SMS or email have a place, authenticator apps like Authy and Google Authenticator provide stronger authentication with time based one time passcodes (TOTP). Not only do TOTPs work offline, but they're based on a standardized algorithm so can be used without PII and with a variety of authenticator apps.

Learn more about what TOTP is and its benefits in our glossary.

Example TOTPs in the Google Authenticator app

The Twilio Verify API makes it easy to initiate and verify TOTPs, now available in public beta. Let's see how to get started with Verify TOTP in under 5 minutes.

Prerequisites for sending One-Time Passcodes

Before you can send an OTP you'll need:

A Twilio account - sign up or sign in
A Verify Service which you can create in the Twilio console. The service name will be used as the issuer and show up in the Authenticator app (e.g. Twilio …

By Kelley Robinson 2021-10-11

Build an SMS notification service with a verified sign up page

From ticket releases to product restocks, appointment availability to breaking news, SMS notifications and broadcasts are a handy tool to keep your customers engaged about the things they care about.

subscribe and broadcast screens in the example application

This tool allows users to sign up for SMS notifications with an easy form. Users are verified with Twilio's Verify API to both decrease fraud and ensure that you're only sending messages to people who want to see them. The application optionally supports tags, so you can segment notifications to different groups of people.

This blog post will walk you through how to launch your own SMS notification service with no code and how to edit the project for some common modifications.

Prerequisites for sending broadcast notifications to verified subscribers

Before you can send an SMS broadcast you'll need to:

Step 1: Sign up for or sign into your Twilio account - sign up or sign in.

Step 2: Search …

By Kelley Robinson 2021-10-08

Erstellen einer Sperrliste für Netzbetreiber mit Twilio Lookup

Hallo und Danke fürs Lesen! Dieser Blogpost ist eine Übersetzung von Build a carrier block list with Twilio Lookup. Während wir unsere Übersetzungsprozesse verbessern, würden wir uns über Dein Feedback an help@twilio.com freuen, solltest Du etwas bemerken, was falsch übersetzt wurde. Wir bedanken uns für hilfreiche Beiträge mit Twilio Swag :)

Betrüger können die Telefonverifizierung oder Zwei-Faktor-Authentisierung ins Visier nehmen, um den SMS-Verkehr künstlich zu erhöhen. Bestimmte Netzbetreiber lassen dies zu, wissentlich oder unwissentlich, und die Betrüger verdienen an diesem erhöhten Datenverkehr Geld. Dies könnte zu einem höheren als erwarteten Twilio-Datenverkehr führen.

Unsere Verify-API zum Senden einmaliger Sicherheitscodes beinhaltet umfassende Mechanismen zur Betrugsbekämpfung. Allerdings kann keine anbieterseitige Lösung eine absolute Wirksamkeit gegen ausgeklügelte Angreifer garantieren, weshalb wir zur Kundenbeteiligung bei der Verhinderung von Angriffen raten.

Glücklicherweise kann die Lookup-API von Twilio Netzbetreiber erkennen, und wir können damit bekannte Betrüger herausfiltern, bevor wir eine SMS-Verifizierung senden.

Hier ist ein kurzer …

By Kelley Robinson 2021-10-08

Best Practices für die Verwaltung von Logik für Wiederholungsversuche mit SMS 2FA

Hallo und Danke fürs Lesen! Dieser Blogpost ist eine Übersetzung von Best practices for managing retry logic with SMS 2FA. Während wir unsere Übersetzungsprozesse verbessern, würden wir uns über Dein Feedback an help@twilio.com freuen, solltest Du etwas bemerken, was falsch übersetzt wurde. Wir bedanken uns für hilfreiche Beiträge mit Twilio Swag :)

Menschen sind ungeduldige Wesen. In den meisten Teilen der Welt mögen SMS-Verifizierung oder Zwei-Faktor-Authentisierung (2FA) zwar schnell Anwendung finden, doch wir empfehlen immer, Wiederholungspuffer in Verifizierungs-Workflows zu integrieren. Dadurch wird Folgendes verhindert:

Versehentliches Spamming eines Benutzers mit wiederholten Textnachrichten
Erreichen von API-Ratenbegrenzungen
Gebührenbetrug oder unnötige Ausgaben

Die Best Practices in diesem Beitrag wurden zwar mit Blick auf die Twilio Verify-API verfasst, doch viele gelten unabhängig von deinem 2FA-Anbieter. In Kombination mit anderen Best Practices wie der Erstellung einer Zulassungsliste von Ländervorwahlen zur Verifizierung können diese Schritte dazu beitragen, dass dein Workflow für die Benutzerverifizierung so reibungslos wie …

By Kelley Robinson 2021-10-04

Twilio AuthyからVerifyへの移行 (SMSベースの二要素認証のケース)

Migrating from Authy to Verify for SMS 2FA JP

この記事は、デベロッパーエバンジェリストのKelly Robinsonが、こちら(英語)で執筆した記事を日本語化したものです。

Twilio Verify API は、Authy API を進化させたもので、SMS、音声通話、Eメールによるワンタイム・パスコード (OTP) の送信・検証を引き続きサポートし、開発者の使い勝手を向上させ、さらに新機能を追加しています。Authy APIは今後もサポートされますが、主要な機能強化はVerify APIを対象に行われることにご留意ください。

Verify APIの特徴を以下に記載いたします。

JavaScript、Java、C#、Python、Ruby、PHPのTwilioヘルパーライブラリ
モバイルアプリに埋め込み可能なプッシュ認証用SDK
カスタマイズ可能なレートリミット
コードの送信や検証等に関する可視性と知見の提供
今後の機能強化が期待できます!(例: WhatsAppチャネルへの対応)

このブログ記事の主眼はAuthy API、およびそのVerify APIへの移行についてです。なお、Twilio Authyにはモバイル版アプリもありますが、Authyアプリの提供終了は予定しておりません。Authyアプリは、ログインや金融決済の際の二要素認証処理を支援するエンドユーザ向けアプリとして、またVerify APIを補完するものとして、引き続き成長・開発・サポートしていきます。なお、「(Authy) アプリ vs (Authy/Verify) API」に主眼を置くブログ記事について別途準備 …

By Kelley Robinson 2021-09-01

Build a carrier block list with Twilio Lookup

Bad actors can target phone verification or two-factor authentication flows to artificially inflate SMS traffic. Certain carriers, knowingly or not, allow this to happen and the fraudsters make money off of this inflated traffic. This could lead to higher than expected Twilio traffic for you.

Our Verify API for sending one-time passcodes includes comprehensive fraud mitigation mechanisms. However, no provider-side solution can guarantee 100% effectiveness against sophisticated attackers, which is why we encourage customer participation in preventing attacks.

Fortunately, Twilio's Lookup API can detect carriers and we can use this to filter out known bad actors before sending an SMS verification.

Here's a quick snippet of an example block list:

const accountSid = process.env.TWILIO_ACCOUNT_SID;
const authToken = process.env.TWILIO_AUTH_TOKEN;
const client = require("twilio")(accountSid, authToken);

// hard coded for demo purposes only
const block = ["12301", "12302"];

client.lookups
 .phoneNumbers("+15108675310")
 .fetch({type: ["carrier"]})
 .then((resp) => {
   const mccmnc = resp.carrier.mobile_country_code + resp.carrier.mobile_network_code
   if (block.includes(mccmnc)) …

By Kelley Robinson 2021-08-19

2要素認証の運用ニーズに対してTwilio Verifyサービスをご提案可能です!

Blog header: Migrate from Programmable SMS to Verify JP

この記事は、デベロッパーエバンジェリストのKelley Robinsonが、こちら(英語)で執筆した記事を日本語化したものです。

Twilio Verifyは、ワンタイムパスコード(OTP)をSMS/電話/メール/プッシュ/TOTP(Time-based One-Time Password)を介して送信・検証し、ユーザーID認証を行う専用ソリューションです。企業が独自のOTPソリューションを構築する際に、Twilioが提供するProgrammable Messaging APIを、その基盤部分で利用できますが、社内でOTPソリューションを維持管理することは複雑で、多くのリソースを必要とします。特に、メッセージングの市況やコンプライアンス要件が変化し続ける中では、その複雑性はなおさらです。こういった中、多くの企業がTwilio Verifyに移行している背景として、Programmable Messagingと変わらないグローバルな信頼性や、圧倒的な大規模配信性に加えて、以下のような利点があるものと考えています。

規制やコンプライアンス管理: 例 - 米国のA2P 10DLC (application-to-person 10 digit long codeの略)
Twilio Verifyの一環として確保済みの送信電話番号プールがサービスに含まれていること (ショートコード、ロングコード、フリーダイヤル、グローバルな英数字の送信者ID*など)
Twilio Verifyの一環として最適化されたワールドワイドな配信 (送信元種別やコンプライアンスなどへ …

By Kelley Robinson 2021-08-12

Best practices for phone number validation during new user enrollment

You have a new user! Great! Twilio provides a set of tools for quickly validating and verifying a user's phone number, perfect for quick and seamless onboarding. Let's look at some best practices for how to get a user registered for your service and on their way while ensuring accuracy and reducing fraudulent sign ups.

This blog post will cover recommendations and best practices for seamless user registration that uses a phone number. Similar recommendations apply to existing user accounts that are providing their phone number for the first time, even if the user account already exists.

You'll want to focus on three areas when enrolling a new user:

Phone number input, collecting the phone number from the user.
Phone number validation, ensuring the phone number is legitimate.
Phone number verification, ensuring that the user has access to the phone number.

Best practices for phone number input …

By Kelley Robinson 2021-07-27

Best practices for managing retry logic with SMS 2FA

Humans are impatient creatures, so while SMS verification or two-factor authentication (2FA) codes may come through quickly in most parts of the world, we always recommend building retry buffers into verification workflows. This helps prevent:

Accidentally spamming a user with repeated text messages
Hitting API rate limits
Toll fraud or unnecessary spend

While the best practices in this post are written with the Twilio Verify API in mind, many apply regardless of your 2FA provider. Combined with other best practices like building an allow list of country codes to verify, these steps can help make sure your user verification workflow is as seamless as possible.

Launch a demo application with SMS retry best practices

This project is also available to Quick Deploy on the Twilio Code Exchange -- no code required!

I built an application that shows off the best practices outlined in this post. The application is quick to …

Newer

Older