4 ms·

This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come

by d4mi3n 4y ago

This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes. The elephant in the room here is that SMS is not a medium where integrity or authenticity of a message can be guaranteed—which is one of the big reasons it’s such a popular medium for phishing.

mr-wendel 4y ago
Me thinks your gut is leading you correctly. Generally speaking, there are short codes, and long codes. Sometimes alphanumerics are allowed, but the rules vary regionally. Long codes resemble traditional phone numbers and tend to be treated as more disposable, low volume, and person-to-person. As such, they are typically easier to spoof with. Short codes tend to be more like car license plates: short random/vanity codes that require a more in-depth process to get access to. They are easier to verify ownership, suited for higher volume messaging, and tend to be backed by automation systems that respond to a set of automated commands like "HELP". These qualities make them less likely to be used for nefarious purposes. It's definitely a topic I'd love to understand more. Any corrections/additions are very much welcome!
mdp2021 4y ago
> This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes And what do those which come from scammers look like? In some areas, they are identical to those from the «large companies».
- d4mi3n 4y ago
  I believe we’re making the same point from different angles: I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity. You (correct me if I’m wrong) are stating that bad actors will craft messages that look like legitimate ones. In either case, we end up in a place where I would be unable to determine if a message is legitimate barring further out of band confirmation.

by d4mi3n 4y ago

mr-wendel 4y ago

Me thinks your gut is leading you correctly. Generally speaking, there are short codes, and long codes. Sometimes alphanumerics are allowed, but the rules vary regionally. Long codes resemble traditional phone numbers and tend to be treated as more disposable, low volume, and person-to-person. As such, they are typically easier to spoof with. Short codes tend to be more like car license plates: short random/vanity codes that require a more in-depth process to get access to. They are easier to verify ownership, suited for higher volume messaging, and tend to be backed by automation systems that respond to a set of automated commands like "HELP". These qualities make them less likely to be used for nefarious purposes. It's definitely a topic I'd love to understand more. Any corrections/additions are very much welcome!

mdp2021 4y ago

> This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes And what do those which come from scammers look like? In some areas, they are identical to those from the «large companies».

d4mi3n 4y ago
I believe we’re making the same point from different angles: I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity. You (correct me if I’m wrong) are stating that bad actors will craft messages that look like legitimate ones. In either case, we end up in a place where I would be unable to determine if a message is legitimate barring further out of band confirmation.