3 ms·

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provi

by aksss 9y ago

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.

aidenn0 9y ago
SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"
- gruez 9y ago
  use a burner sim like: https://www.twilio.com/wireless/pricing https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]
  - my_first_acct 9y ago
    The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA. Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2] As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally. [1] https://support.twilio.com/hc/en-us/articles/223181668-Can-Twilio-numbers-receive-SMS-from-a-short-code- https://support.twilio.com/hc/en-us/articles/223181668-Can-T... [2] https://news.ycombinator.com/item?id=16773171 https://news.ycombinator.com/item?id=16773171
    - ossguy 9y ago
      You could use https://jmp.chat/ https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.

by aksss 9y ago

aidenn0 9y ago

SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"

gruez 9y ago
use a burner sim like: https://www.twilio.com/wireless/pricing https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]
- my_first_acct 9y ago
  The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA. Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2] As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally. [1] https://support.twilio.com/hc/en-us/articles/223181668-Can-Twilio-numbers-receive-SMS-from-a-short-code- https://support.twilio.com/hc/en-us/articles/223181668-Can-T... [2] https://news.ycombinator.com/item?id=16773171 https://news.ycombinator.com/item?id=16773171
  - ossguy 9y ago
    You could use https://jmp.chat/ https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.