…

Enjoy.

Pinger and Snapvine are highly INSECURE!!!!

What this means: I can break into your Pinger and Snapvine phone accounts. I can listen to your messages. I can send out messages as you.

How do I do this? Easy. I mask / spoof CALLER ID / ANI. Anyone can do this, amateur hacks, etc.

Well, there are others, but suffice to say that these companies are doing new things with social networking sites and phones that help to connect people.

The problem is that these companies have a scalability problem based on inbound calling.

You see, if you have hundreds of thousands or millions of users, you can’t give everyone a unique dial in phone number.

SECURITY PROBLEM

What these companies have done is based user identification on Caller ID / ANI – meaning that you call their service, and their systems recognize your phone via Caller ID.

The problem is that Caller ID is highly insecure and can be faked.

The problem that these “dial in” companies are trying to solve is one of scalability. They simply cannot have enough dial in numbers for each user.

Therefore, they have architected a way to recognize each caller by Caller ID and to base the entire user authentication system on this insecure method.

This can easily be hacked.

SOLUTION

The solution is funny – both Pinger and SnapVine make you enter in a PIN CODE when you dial in without validating your phone.

After you validate your phone, you no longer need to enter the PIN CODE.

So in effect, when you validate your phone, you make your account INSECURE.

What Pinger and SnapVine need to do is always require the PIN CODE.

I have also suggested that they allow for private threads of conversations as well. Since I host a Google Group for my extended family it would be great if we had this tool to gather insights from various members. This feature should also include the ability to tag messages for easier reference.

While they’re at it, they should throw in some advertising as well. I could live with an advert crawl along the bottom of the player or even a 20 second commercial for every 10 minutes of conversation. Seems fair, doesn’t it?

What you currently see is only the beginning. We decided to release this early (beta) version as soon as possible, with a minimal but functional feature set. More features are definitely on the way, including custom/group channels, blogger/podcaster/website tools (widgets), and an enhanced version of the voice recorder.

The comments about greater text options and integration are interesting. We’ve intentionally focused on audio-only, rather than mixing the two. There are already innumerable ways to connect with others via text, so we want to offer something new. We’ll give the idea some extra thought though (feedback is food!).

We believe Chinswing provides something new. We simply want to provide an easy way to get online at anytime and discuss personal interests and passions (no matter how obscure) with like-minded people. So far, we’ve never seen anything else do that one thing well, in a simple and user-friendly way. We’ll strive do it in the best way possible.

Anyway, great to see others thinking seriously about Chinswing! It’s a strange feeling finally having the cat out of the bag…

Cheers,
Dean Worth.

1. I like being able to type shit into message boards that is non-identifiable – voices are always identifiable.
2. Storage space size – i.e. a site like myspace would have big problems with voice comments – imagine 1 billion voice comments?
3. Its really not all that new, been tried before.

Either way, wish this company good luck

Can you imagine a voiceover, or singer message board with this technology.

They would have a ball.

Not to mention that voice isn’t as viable an option for many people while at work. Many folks who could get away with being involved in a text community all day on the company dime might start getting looks if they have to vocalize their various postings.

I can dig this either way, but adding the text option would improve the value of this site for a lot of folks, I’d imagine.