<p>It looks good to me. By entering confirmation you prove it's your number and you can additionally protect your account with a password. </p>

<p>You should not let others access your phone. If you do, you should delete relevant messages to prevent them seeing your password.</p>

CC BY-SA 3.0
2011-09-01T11:48:18.920Z
2011-09-01T11:48:18.920Z
klemen
<p>I think it is probably adequate for its intended purpose but not adequate for managing large balances.</p>

<p>The biggest problem is the risk of compromise or theft of your phone or phone number. Anyone who obtains physical access to your phone while it's unlocked (or who is able to unlock it) can look through your text messages and can transfer your Bitcoins to themselves. The Bitcoins are effectively completely untraceable and permanently lost at this point.</p>

<p>The lack of a way to secure your account with PhoneCo.in without your phone is, in my opinion, a serious problem. What if I can't find my phone but might just have left it a friend's house? Am I supposed to disable my phone with my provider only to re-enable it in twenty minutes when I find it? Or am I supposed to have a 20 minute window in which someone can break into my phone and steal my Bitcoins? (Will a mobile company shut off your phone immediately even at 3AM?)</p>

<p>If your phone is lost or stolen, you have to have it disabled <strong>immediately</strong> -- even if it's locked, even if you might find it in a few minutes.</p>

<p>Another problem with the accounts only being associated with a phone number is that I have to trust my mobile provider. If I lose my mobile account for any reason, I lose my coins too. If my phone number is erroneously transferred to someone else, they get my Bitcoins or at the very least, I cannot get them. If my mobile provider suddenly decides I broke some rule and they cancel my contract "for security reasons", how can I prove to PhoneCo.in that it's my account?</p>

<p>So, the service is simple. It's convenient. And its security is about comparable to a physical wallet (that can also be lost or stolen).</p>

CC BY-SA 3.0
2011-09-01T12:04:16.927Z
2011-09-01T12:44:35.303Z
2011-09-01T12:44:35.303Z
David Schwartz
<p>@osmosis made me aware of <a href="http://PHONECO.IN" rel="nofollow noreferrer">PHONECO.IN</a>, which makes it possible to send Bitcoins via SMS. My question is whether their authentication system is adequate. From their <a href="http://phoneco.in/faqs.html" rel="nofollow noreferrer">website</a>:</p>
<blockquote>
<p>PhoneCo.in is designed to be easy to use and secure.  The server which processes your text message communicates with a separate server processing the bitcoin transaction.  The data from your text message is sent using AES-265 encryption and is signed using HMAC-SHA1.  This combination of security measures makes it very difficult to initiate a PhoneCo.in transaction in any way other than using a cell phone, as any requests to the bitcoin server must originate from the text message processing server.</p>
<p>We require you to reply with a 5 character confirmation code within 5 minutes when sending a payment.  This is necessary to verify that your phone has initiated the payment request (and that someone isn’t spoofing your phone number when contacting our server).  Spoofing another phone number is illegal in the United States and punishable with fines up to $10,000.  If you receive a confirmation code for a payment you didn’t initiate, contact us so we can help track the offender.</p>
</blockquote>

CC BY-SA 3.0
2012-04-13T09:28:00.707Z
the domain for that service is returning a "It has been reserved on gandi.net and parked as unused" at this time
barrymac
CC BY-SA 3.0
2012-04-13T09:42:17.550Z
@barrymac Should I delete the question?
David
CC BY-SA 3.0
2012-04-13T15:17:48.507Z
seems like the service is definitely history, but maybe you could re phrase the question , it's still useful information for developers of a replacement
barrymac
<transactions><security><mobile>
Is the authentication system of the Bitcoin <-> SMS service PHONECO.IN adequate?
David
# Is the authentication system of the Bitcoin <-> SMS service PHONECO.IN adequate?

(Asked by: username_0 on 2011-09-01)

@osmosis made me aware of [PHONECO.IN](http://PHONECO.IN), which makes it possible to send Bitcoins via SMS. My question is whether their authentication system is adequate. From their [website](http://phoneco.in/faqs.html):

> PhoneCo.in is designed to be easy to use and secure. The server which processes your text message communicates with a separate server processing the bitcoin transaction. The data from your text message is sent using AES-265 encryption and is signed using HMAC-SHA1. This combination of security measures makes it very difficult to initiate a PhoneCo.in transaction in any way other than using a cell phone, as any requests to the bitcoin server must originate from the text message processing server.
>
> We require you to reply with a 5 character confirmation code within 5 minutes when sending a payment. This is necessary to verify that your phone has initiated the payment request (and that someone isn’t spoofing your phone number when contacting our server). Spoofing another phone number is illegal in the United States and punishable with fines up to $10,000. If you receive a confirmation code for a payment you didn’t initiate, contact us so we can help track the offender.

**Tags:** transactions, security, mobile

> **Comments:**
> **username_1**: the domain for that service is returning a "It has been reserved on gandi.net and parked as unused" at this time  
> **username_0**: @username_1 Should I delete the question?  
> **username_1**: seems like the service is definitely history, but maybe you could re phrase the question , it's still useful information for developers of a replacement  

---

## 2 answers

### Answer by username_3 on 2011-09-01. Score: 5 | Accepted answer

I think it is probably adequate for its intended purpose but not adequate for managing large balances.

The biggest problem is the risk of compromise or theft of your phone or phone number. Anyone who obtains physical access to your phone while it's unlocked (or who is able to unlock it) can look through your text messages and can transfer your Bitcoins to themselves. The Bitcoins are effectively completely untraceable and permanently lost at this point.

The lack of a way to secure your account with PhoneCo.in without your phone is, in my opinion, a serious problem. What if I can't find my phone but might just have left it a friend's house? Am I supposed to disable my phone with my provider only to re-enable it in twenty minutes when I find it? Or am I supposed to have a 20 minute window in which someone can break into my phone and steal my Bitcoins? (Will a mobile company shut off your phone immediately even at 3AM?)

If your phone is lost or stolen, you have to have it disabled **immediately** -- even if it's locked, even if you might find it in a few minutes.

Another problem with the accounts only being associated with a phone number is that I have to trust my mobile provider. If I lose my mobile account for any reason, I lose my coins too. If my phone number is erroneously transferred to someone else, they get my Bitcoins or at the very least, I cannot get them. If my mobile provider suddenly decides I broke some rule and they cancel my contract "for security reasons", how can I prove to PhoneCo.in that it's my account?

So, the service is simple. It's convenient. And its security is about comparable to a physical wallet (that can also be lost or stolen).


---

### Answer by username_2 on 2011-09-01. Score: 3

It looks good to me. By entering confirmation you prove it's your number and you can additionally protect your account with a password.

You should not let others access your phone. If you do, you should delete relevant messages to prevent them seeing your password.


---

