DesktopInkbox: text, email & call
Who can reach your bot
How Inkbox allow-lists work, why they matter, which channels can be faked, and how to keep a bot that answers texts and email safe.
A bot with Inkbox can be reached from outside Machine, so it matters who can reach it. Inkbox in Machine is closed by default: only the people on the bot's lists get through.
The two lists
| List | Lets through | Format |
|---|---|---|
| Phone | iMessage, SMS and calls from these numbers | One number per line, with country code: +14155550100 |
| Email from these addresses or domains | dana@northwind.co, or a whole domain: @northwind.co |
- An empty list turns that channel off. Leave Email empty and the bot ignores all email.
- Anyone not on a list is ignored silently: their message never reaches the bot, and no reply is sent.
- Change the lists on the web app: Manage on the Inkbox row.
Treat the lists like access to the bot
Someone on the list can ask the bot to do anything you could ask it in Machine, using its connected apps, secrets and files. Only add people you'd trust with the bot itself.
Some channels can be faked
| Channel | How easy to fake | Use it for |
|---|---|---|
| iMessage | Hard | Anything, including sensitive requests. |
| SMS | Possible: sender numbers can be spoofed. | Everyday requests. |
| Phone calls | Possible: caller ID can be spoofed. | Everyday requests. |
| Possible: Inkbox doesn't tell Machine whether an email passed sender checks. | Everyday requests. |
To limit the risk:
- Prefer exact addresses over whole domains.
- Use iMessage for anything sensitive.
- The bot is told to treat email, SMS and calls as requests, never as authority: it won't send secrets or do anything destructive on them alone.
- Keep approvals on for risky actions.
What the bot will never do with Inkbox
- Buy phone numbers or lines, or release a number.
- Mark someone as opted in to SMS.
- Write passwords or secrets into its Inkbox notes.
Block someone
Ask the bot: "Block +14155550199 for texts and calls." It blocks the number for iMessage, SMS and calls at once. Or remove them from the list on the web.