4 ms·

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

by easton 5y ago

gruez 5y ago
>SMS is also exploitable though, right it's less feature rich, so presumably there's less attack surface.
codetrotter 5y ago
> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.
- vxNsr 5y ago
  I know both TMobile and ATT frown upon this and have been known to shut down accounts that do this. Data only is for non-phone accounts in their eyes and anyone trying to circumvent that is committing some sorta fraud (in their eyes).
- p49k 5y ago
  Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.
  - hexa22 5y ago
    And you still need them because some services only provide sms verification.
    - hirako2000 5y ago
      And we don't need those services. We just want them for convenience. The data only plans is is good path to follow, it at least makes it more obvious each time a service clearly wants too much personal data.
      - lpghatguy 5y ago
        Okay then, let me just go close my bank account then. It's just a convenience. :P
        hirako2000 5y ago
        It is a convenience difficult to live without I can give you that. But so many other services we can't imagine living without require a cellular number. Accepting a flawed authentication mechanism and legal but abusive privacy breaches is what have kept them up and running. This threat demonstrates how difficult it is to keep us safe from hacks. We can keep our bank account and one day have to deal with fraud recovery, or we can ask them to stop, some banks 2fa activation via a voice call. Until banks cease to dominate and control our finances, we should at least do what we can protect ourselves from their incompetence.
        p49k 5y ago
        Banks can and do rollback fraud and theft in most cases; that’s the advantage of working in a system supported by law and regulation. The alternative is trusting that every component in your crypto tech stack has perfect security (which is impossible) or else risk losing all your money in a manner that can’t be reversed. I’ll choose banks, thanks.
        hirako2000 5y ago
        And that's fine, the majority of the current generation will stick to traditional banking out of fear. Maybe it is safer that way you are right. Let's not ignore the fact the crypto technology is actually safer as a whole, the method of transaction is order of magnitudes more hardened with private keys and signatures, and also more flexible. BTW cryptocurrencies and also smart contract networks does support rollback as shown in the Eth vulnerability that was exploited years ago. The irreversibility is a feature. We figured it is safer to adopt a push approach to transactions like when paying with cash rather than a pull approach used with debit/credit card, and that making the transaction not reversible leads to less fear from the creditor and promote fluidity. If reversibility is desired, multi sig and escrow exist. They are as rarely used as on eBay, because for most transactions we don't care. Nothing is perfectly safe you are right but humanity, despite stickiness to what is tolerable has always eventually adopted less understood but more enabling technologies when they prove to be superior in so many respects.
  - samstave 5y ago
    Also, in my experience in the US - Data Only SIMs tend to only be available if you have a primary 'regular' account with the carrier. I haven't had too much luck just being able to get a stand-alone data sim from Verizon, AT&T or TMobile...
- nerdawson 5y ago
  That seems like an awful lot of effort to go to for what really ought to be a settings toggle.
- Abishek_Muthian 5y ago
  > Caveat: I still need Norwegian BankID to work with my SIM though. Same in India, Banking & Payment apps need to verify that the SIM i.e. Phone number is indeed the one associated with the bank account and so they send SMS in the background at random intervals. I don't do real-time communication and so I had the lowest tier prepaid carrier plan just for this purpose, But the oligopolies decided to remove SMS from the low tier plans suddenly and all my payment apps are now deactivated! Meanwhile scammers continue to use phone numbers (SIM) bought dime a dozen with fake identity cards[1]. WhatsApp should never be forgiven for making phone number as a flawed identity of a living person, It's disappointing that Signal continued with it. [1] https://twitter.com/Abishek_Muthian/status/1406964960081571845 https://twitter.com/Abishek_Muthian/status/14069649600815718...

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

by easton 5y ago

SMS is also exploitable though, right (Both types of messages go through Messages.app)? And you can't disable SMS entirely I don't think.

gruez 5y ago

>SMS is also exploitable though, right it's less feature rich, so presumably there's less attack surface.

codetrotter 5y ago

> you can't disable SMS entirely I don't think Buy a data-only subscription, and use Google Voice or some sort of PBX powered app to still be able to receive regular phone calls. Preferably I’d want a really basic voice only, open source PBX powered app for iOS that I could use. Then I could get me a data-only plan and SIM. Caveat: I still need Norwegian BankID to work with my SIM though. I dunno if any of the data-only plans available in Norway support BankID, or if you need a regular subscription like I have now in order to use that.

vxNsr 5y ago
I know both TMobile and ATT frown upon this and have been known to shut down accounts that do this. Data only is for non-phone accounts in their eyes and anyone trying to circumvent that is committing some sorta fraud (in their eyes).
p49k 5y ago
Data-only subscriptions can still receive SMS messages in my experience, you just can't send them.
- hexa22 5y ago
  And you still need them because some services only provide sms verification.
  - hirako2000 5y ago
    And we don't need those services. We just want them for convenience. The data only plans is is good path to follow, it at least makes it more obvious each time a service clearly wants too much personal data.
    - lpghatguy 5y ago
      Okay then, let me just go close my bank account then. It's just a convenience. :P
      - hirako2000 5y ago
        It is a convenience difficult to live without I can give you that. But so many other services we can't imagine living without require a cellular number. Accepting a flawed authentication mechanism and legal but abusive privacy breaches is what have kept them up and running. This threat demonstrates how difficult it is to keep us safe from hacks. We can keep our bank account and one day have to deal with fraud recovery, or we can ask them to stop, some banks 2fa activation via a voice call. Until banks cease to dominate and control our finances, we should at least do what we can protect ourselves from their incompetence.
        p49k 5y ago
        Banks can and do rollback fraud and theft in most cases; that’s the advantage of working in a system supported by law and regulation. The alternative is trusting that every component in your crypto tech stack has perfect security (which is impossible) or else risk losing all your money in a manner that can’t be reversed. I’ll choose banks, thanks.
        hirako2000 5y ago
        And that's fine, the majority of the current generation will stick to traditional banking out of fear. Maybe it is safer that way you are right. Let's not ignore the fact the crypto technology is actually safer as a whole, the method of transaction is order of magnitudes more hardened with private keys and signatures, and also more flexible. BTW cryptocurrencies and also smart contract networks does support rollback as shown in the Eth vulnerability that was exploited years ago. The irreversibility is a feature. We figured it is safer to adopt a push approach to transactions like when paying with cash rather than a pull approach used with debit/credit card, and that making the transaction not reversible leads to less fear from the creditor and promote fluidity. If reversibility is desired, multi sig and escrow exist. They are as rarely used as on eBay, because for most transactions we don't care. Nothing is perfectly safe you are right but humanity, despite stickiness to what is tolerable has always eventually adopted less understood but more enabling technologies when they prove to be superior in so many respects.
- samstave 5y ago
  Also, in my experience in the US - Data Only SIMs tend to only be available if you have a primary 'regular' account with the carrier. I haven't had too much luck just being able to get a stand-alone data sim from Verizon, AT&T or TMobile...
nerdawson 5y ago
That seems like an awful lot of effort to go to for what really ought to be a settings toggle.
Abishek_Muthian 5y ago
> Caveat: I still need Norwegian BankID to work with my SIM though. Same in India, Banking & Payment apps need to verify that the SIM i.e. Phone number is indeed the one associated with the bank account and so they send SMS in the background at random intervals. I don't do real-time communication and so I had the lowest tier prepaid carrier plan just for this purpose, But the oligopolies decided to remove SMS from the low tier plans suddenly and all my payment apps are now deactivated! Meanwhile scammers continue to use phone numbers (SIM) bought dime a dozen with fake identity cards[1]. WhatsApp should never be forgiven for making phone number as a flawed identity of a living person, It's disappointing that Signal continued with it. [1] https://twitter.com/Abishek_Muthian/status/1406964960081571845 https://twitter.com/Abishek_Muthian/status/14069649600815718...