6 ms·

Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’

by tyleo 5y ago

Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’t. Despite this, the carrier is kept anonymous? Strange.

ajsnigrutin 5y ago
Yep.. naming and shaming the carried should be the first thing in the article. They'll probably disable this feature, apologize, and act as if they did nothing wrong.
- newnamenewface 5y ago
  The carrier hasn't been shared with the reporting website so far as I can tell.
  - gruez 5y ago
    Looks it has. >Google is investigating and looking into responsible (Australian) carrier. We’ve also reached out to the company for more details and to confirm that it’s not adding “SMS ADs” into the verification code process.
    - newnamenewface 5y ago
      Aw, my mistake, I missed that.
bluesign 5y ago
Google is to blame though. They are sending sms over a 3rd party which is probably using some shady service on that country for sms termination. They are avoiding carrier termination fee, basically being cheap. Google has power to by contract force third party to make deals directly with carriers. If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.
- rtpg 5y ago
  is this known? It kinda sounds like the carrier might be the one doing this
  - bluesign 5y ago
    I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. Usually when you send bulk sms, it is changing many hands on the way. From your provider, to some aggregator, then to carrier in target country or some illegal termination with sim cards. SMS is not a secure platform. Here is an article about it: https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-monetisation/ https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-m...
    - izacus 5y ago
      > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. There are US carriers which inject their own banners into websites. Why do you think carrier wouldn't do this?
      - bluesign 5y ago
        Injecting your own vs someone else's is big liability difference. Especially on Twitter it was mentioned that link is pretty shady. Also why only on google SMS, I am sure he is also getting a lot of SMS from other companies.
    - toast0 5y ago
      > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. That would depend on the size of the original texts. If Google's verication messages are shorter than most, they might have room for ads where some other service doesn't. I agree that an intermediary adding something is likely. Maybe Google has enough scale to self-manage 100% direct routes, but in general it's hard to avoid aggregators, and it's hard to track message delivery. And if you need worldwide delivery, it's hard to avoid grey routes. As I used to tell people who wondered why I built a system to pick from multiple aggregators: All the aggregators will tell you they've got worldwide coverage and that they're the best; but they're all full of bs. I should also add that they'll tell you that they all say they have 100% direct routes and that they don't use aggregators. One of the most amusing things I remember was when aggregator X had a big outage, several hours of not accepting messages (let alone delivering them), aggregator Y's success dropped by about half. It was clear they were using that aggregator for a significant amount of traffic. But sometimes it costs less to pay Y to submit messages to X than to pay X directly. shrug
downrightmike 5y ago
Seems like a smear campaign. Like the carrier figured out they could and are using it to make google look bad for some reason.
- iNane9000 5y ago
  It’s a canary. Gmail isn’t secure. People need to know that.
  - deleted 5y ago
    [deleted]
  - qwertox 5y ago
    What a ridiculous conclusion.
  - to11mtm 5y ago
    > Gmail isn’t secure. This indicates nothing as to the security of Gmail itself. It is however an -excellent- reminder that SMS is -not- secure.
    - iNane9000 5y ago
      Gmail tells its users to use sms. So if it’s true what you say, sms is not secure, and it’s true that Gmail pushes users to use it, then it’s must therefore be true that Gmail isn’t secure. Correct my logic, please.
      - meowster 5y ago
        If Gmail uses an insecure method (SMS) to do password resets, then I think I would have to agree with you.
      - tialaramex 5y ago
        Gmail has never mentioned SMS to me, or even suggested it could make sense, presumably because it doesn't. Google do tell people that they should have a second factor. Mine are my FIDO Security Keys.

by tyleo 5y ago

ajsnigrutin 5y ago

Yep.. naming and shaming the carried should be the first thing in the article. They'll probably disable this feature, apologize, and act as if they did nothing wrong.

newnamenewface 5y ago
The carrier hasn't been shared with the reporting website so far as I can tell.
- gruez 5y ago
  Looks it has. >Google is investigating and looking into responsible (Australian) carrier. We’ve also reached out to the company for more details and to confirm that it’s not adding “SMS ADs” into the verification code process.
  - newnamenewface 5y ago
    Aw, my mistake, I missed that.

bluesign 5y ago

Google is to blame though. They are sending sms over a 3rd party which is probably using some shady service on that country for sms termination. They are avoiding carrier termination fee, basically being cheap. Google has power to by contract force third party to make deals directly with carriers. If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.

rtpg 5y ago
is this known? It kinda sounds like the carrier might be the one doing this
- bluesign 5y ago
  I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. Usually when you send bulk sms, it is changing many hands on the way. From your provider, to some aggregator, then to carrier in target country or some illegal termination with sim cards. SMS is not a secure platform. Here is an article about it: https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-monetisation/ https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-m...
  - izacus 5y ago
    > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. There are US carriers which inject their own banners into websites. Why do you think carrier wouldn't do this?
    - bluesign 5y ago
      Injecting your own vs someone else's is big liability difference. Especially on Twitter it was mentioned that link is pretty shady. Also why only on google SMS, I am sure he is also getting a lot of SMS from other companies.
  - toast0 5y ago
    > I don’t think carrier would do this, otherwise guy reported this would see this a lot in other service sms’s too. That would depend on the size of the original texts. If Google's verication messages are shorter than most, they might have room for ads where some other service doesn't. I agree that an intermediary adding something is likely. Maybe Google has enough scale to self-manage 100% direct routes, but in general it's hard to avoid aggregators, and it's hard to track message delivery. And if you need worldwide delivery, it's hard to avoid grey routes. As I used to tell people who wondered why I built a system to pick from multiple aggregators: All the aggregators will tell you they've got worldwide coverage and that they're the best; but they're all full of bs. I should also add that they'll tell you that they all say they have 100% direct routes and that they don't use aggregators. One of the most amusing things I remember was when aggregator X had a big outage, several hours of not accepting messages (let alone delivering them), aggregator Y's success dropped by about half. It was clear they were using that aggregator for a significant amount of traffic. But sometimes it costs less to pay Y to submit messages to X than to pay X directly. shrug

downrightmike 5y ago

Seems like a smear campaign. Like the carrier figured out they could and are using it to make google look bad for some reason.

iNane9000 5y ago
It’s a canary. Gmail isn’t secure. People need to know that.
- deleted 5y ago
  [deleted]
- qwertox 5y ago
  What a ridiculous conclusion.
- to11mtm 5y ago
  > Gmail isn’t secure. This indicates nothing as to the security of Gmail itself. It is however an -excellent- reminder that SMS is -not- secure.
  - iNane9000 5y ago
    Gmail tells its users to use sms. So if it’s true what you say, sms is not secure, and it’s true that Gmail pushes users to use it, then it’s must therefore be true that Gmail isn’t secure. Correct my logic, please.
    - meowster 5y ago
      If Gmail uses an insecure method (SMS) to do password resets, then I think I would have to agree with you.
    - tialaramex 5y ago
      Gmail has never mentioned SMS to me, or even suggested it could make sense, presumably because it doesn't. Google do tell people that they should have a second factor. Mine are my FIDO Security Keys.