Twilio Verify and Heretic: what a successful challenge proves

An approved SMS verification demonstrates access to the code sent to a phone number. An application resisting automated signups may also need evidence about the browser and connection making the request.

Heretic supplies those measurements before the application decides whether to challenge the visitor. A reported proxy or VPN is a signal for the customer's policy. The customer can accept that traffic or offer a mobile challenge instead of rejecting the visitor immediately.

The two-stage flow requires an attacker to satisfy the relevant network and browser measurements, then complete a challenge bound to the same attempt. Obtaining a code from an SMS inbox does not supply that second proof.

This article compares Heretic with Twilio Verify's SMS channel. Twilio also offers passkeys, Silent Network Authentication, Push and other verification methods. They have different properties and deserve separate comparisons. Twilio Verify API.

Keep the signal and offer a challenge

Consider an application that receives a network-concealment indicator during signup. It has a choice at that point. A company that accepts VPN visitors can continue according to its policy. Another company may ask the visitor to complete Heretic's mobile ceremony.

Browser measurement
        |
        v
Findings returned to the application
        |
        v
Customer policy chooses whether to offer a mobile challenge
        |
        v
Required connection and device measurements
        +
Assertion bound to the issued challenge and recorded evidence
        |
        v
Verified outcome returned to the customer's backend

The application should keep the initial assessment available when deciding what to do with the final outcome.

Heretic's ceremony has its own proof requirements. It checks the required measurement legs, including the desktop leg in a desktop-to-phone handoff. If a required path carries a concealment indicator, an otherwise passing ceremony is held for a path retry. A phone with a clear result does not automatically clear a concealed desktop path. The customer chose to request this ceremony; an ordinary probe does not impose a blanket rejection policy on everyone using a proxy or VPN.

The network half observes an actual connection

TCP fingerprints describe the stack that produced the received connection. QUIC observations describe whether the required transport exchange happened and what arrived. Neither is changed merely by editing a browser's reported operating system or timezone.

Those observations need an identified endpoint. A TCP-terminating proxy originates its own connection to the sensor. A packet-forwarding VPN may preserve the client's TCP endpoint while changing the address and path. The earlier packet experiment shows why the distinction matters to a measured round trip.

The requirement is a path that satisfies the measurements and the chosen ceremony's checks. Saying this forces every visitor onto an IP uniquely owned by them would go beyond the evidence. Household, mobile and corporate connections can share addresses. QUIC can also be carried through UDP-capable proxies; observing HTTP/3 is not proof that no intermediary exists. RFC 9298, UDP proxying.

An attacker can change infrastructure to change the observed connection. That is materially different from changing browser properties. The result still depends on the actual findings; Heretic does not claim that every possible proxy configuration is detectable.

The mobile half binds evidence to an assertion

With an SMS OTP flow, the application sends a code through Verify and checks the code the visitor returns. A correct check can produce an approved result. Access to the receiving number is therefore an asset an attacker may try to obtain or delegate. Twilio Verification Check.

Heretic's mobile ceremony records the required interaction and device measurements, then commits those results to the challenge sent to WebAuthn. The current encoding hashes the ceremony ID, the measurement request ID and the raw 32-byte results digest, prefixed by a domain marker. The separator is the single byte 0x1f:

material = (
    b"heretic-ceremony-v1\x1f"
    + challenge_id.encode() + b"\x1f"
    + request_id.encode() + b"\x1f"
    + bytes.fromhex(results_hash)
)
challenge = hashlib.sha256(material).digest()

We checked an independently written Python implementation against the current challenge-byte function. Four synthetic vectors changed one input at a time. The table shows the first 16 hex characters of each derived challenge:

The complete inputs, 32-byte outputs and executable example are included in the evidence download below. These are encoding examples, not valid ritual records or credential assertions. The results digest in a real ceremony covers its recorded canonical payload.

The server checks those recorded results against the issued commitment and verifies the credential response for the expected origin, relying party and user verification requirement. Reusing an assertion while changing one of the committed inputs no longer supplies the expected challenge. Asking for a fresh challenge requires a fresh response under that issuance; it does not make the old assertion valid for new evidence.

A service that only retrieves text from an SMS inbox cannot return this proof. It would need to participate in the different protocol, supply acceptable measurements and produce the required credential assertion. This is the second part of the pincer: satisfying one requirement leaves the other requirement in place.

The signature has a precise scope. Heretic currently requests no authenticator attestation. It verifies credential possession and the bound challenge, rather than authenticating the physical origin of every sensor sample. Synced credentials, software authenticators, fabricated but coherent client evidence and remote phone participation remain relevant capabilities when evaluating an attacker. WebAuthn permits multi-device credentials; a valid assertion alone is not a unique-device or unique-person certificate. WebAuthn credential backup state.

What the combined checks retain

We exercised the current path rule with controlled inputs. Except for the stated change, both supplied legs have no concealment indicators. These cases test the decision logic after indicators have been supplied; they do not measure the detector's ability to discover a real VPN.

A clear path is one prerequisite for completing the ceremony, not the final outcome. The separate assertion and finalization tests check the rest of the binding. A modified measurement digest, an assertion from the wrong key or an assertion for the wrong origin cannot stand in for the expected proof. A contradiction on a required assessment leg remains a contradiction even when the credential response is valid.

The relevant local suite passed 64 protocol tests when preparing this comparison. Those tests use controlled records and test credentials. They establish the exercised code paths, not physical-phone authenticity, live attack success rates or comparative conversion rates.

Twilio's Verify Fraud Guard is enabled by default and analyzes traffic for SMS pumping. Lookup and other Twilio channels address additional phone and authentication questions. A customer can combine these services with application controls; an SMS-code check is one part of that system. Verify Fraud Guard.

Compare the merchant's bill with explicit units

Prices checked on 13 September 2026, in US dollars. Twilio lists US SMS through Verify at $0.05 per successful verification plus $0.0083 per SMS. For V successful verifications and M messages:

Twilio Verify SMS = 0.05 × V + 0.0083 × M

Destination pricing, discounts and additional services change this calculation. Twilio Verify pricing.

Heretic's public Signal plan is $50 per month, including 25,000 probes and 5,000 challenges. Overage is $0.0008 per probe and $0.004 per challenge. With P billed probes and C created ceremonies:

Heretic Signal = 50
  + 0.0008 × max(P − 25,000, 0)
  + 0.004  × max(C − 5,000, 0)

These units count measurement sessions when opened and ceremonies when created, including those a visitor abandons. Extra measurements or new ceremonies must be included in P and C. Ordinary API reads are not a new measurement. Enterprise pricing and required Enterprise agreements are separate. Heretic pricing.

These scenarios assume C = V = M: every created ceremony completes, and each successful SMS verification uses one message. They are arithmetic examples, not traffic or effectiveness measurements. P is the total billed Heretic probe count.

The second row represents measuring a larger set of attempts while challenging a subset. The table excludes taxes, negotiated pricing, additional Twilio services and the customer's application costs. The services return different evidence, so equal counts do not make the outcomes interchangeable.

Retries change the denominator. At 100,000 Heretic probes and 10,000 created ceremonies, the Signal calculation remains $130 even if only 8,000 ceremonies complete. For 8,000 successful SMS checks and 15,000 US messages, the Verify calculation is $524.50. This hypothetical case shows why a comparison must record starts, sends, retries and successful outcomes separately.

What effectiveness means for this decision

The merchant's verification bill is not the attacker's cost of acquiring a receiving number. We have not measured a universal price for rented OTP access or a dollar cost to bypass Heretic. Quoting either would hide the capabilities and operating conditions that determine it.

For an attacker limited to automated access to an SMS inbox, retrieving a code addresses the SMS requirement. It does not satisfy Heretic's required measurement records and bound assertion. An attacker with controlled devices, usable credentials and suitable network paths has different capabilities. Those capabilities need testing against the complete application flow, including the customer's policy and action binding.

If the business needs a reachable phone number, retain a phone-number verification method for that requirement. Heretic's mobile challenge does not verify ownership of a telephone number. If the business needs to investigate the connection and browser behind an attempt, network findings can inform an optional challenge and the eventual action decision.

An evaluation should record allowed abuse, legitimate completion, retries, completion time and total billed units for the same labelled scenarios. No comparative detection or conversion rate has been measured for this article. The defensible claim is the additional set of requirements and their preserved binding, alongside the stated cost model.

Download the price calculator, commitment examples and evidence records. Both Python examples run with the standard library; the README explains their inputs and scope.