4 ms·

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. Yes. This is wrong. I agr

So the complaint is that no one tells the world about the insecurity of text messages. And the blame is laid on a network provider. Yes. This is wrong. I agree ;) First of all I think it's a bad idea to jump on the (valid!) privacy complaint against O2 in the UK with this unrelated thing. Unrelated in terms of technical differences but not in terms of the broader trend which is this: UK networks do not care enough about their customers' privacy and security. The Leveson enquiry, the O2 issue and the existence of SMS spoofing all prove that. Second, as many pointed out already: This is not a problem of any carrier. If Apple were a carrier, would they let this happen to their customers? I do not think so. just as yahoo/google etc. cannot protect you from most spoofs in the mail world. Yahoo maybe, Google tries pretty hard. And - gasp! - you can do similar things with a call (ever noticed that Skype offers to call 'from your number'?). Requires verification. This is not relevant. If the article wouldn't hijack a real issue _and_ wouldn't blame the wrong target, then I think there's a valid point somewhere in there: We, the technical crowd, should find a way to educate people around us about inherent trust issues. But that should be a constructive project, not mud slinging. In my opinion the real issue is that the networks do not care enough to fix lots of problems.

darklajid 15y ago
The Apple reference is weird.. Regarding 'requiring verification': See my other post. I was certainly able to call using other people's number as source in the past. Can everyone and his mum? I - don't know. I highly doubt that Skype _needs_ (disregarding laws etc) to ask anyone. But let's get to the bottom: How do you even fix this? See, you got a friend. His name's Bob. He has a girlfriend called Alice.. (okay, just kidding): Friend is on vacation in Siberia. Wants to send a text message to his girlfriend. There's a valid scenario where a message travels from a remote (sorry to all people from Siberia) part of Europe to the UK - using a very simple protocol and (probably) going through a few hops. Now your friend isn't in Siberia. Why is this now obviously spoofed? Because he is currently connected to your carrier? A kind of 'drop text messages from somewhere else if connected here' kind of policy? What if you know that he turns his phone off during the night? Store the last point of network access per user? Text messages have a maximum life time (they are stored until either the time expires or the recipient receives and acks the messages). How would you make sure that this still works, looking at the use case above? I just think that 'They don't care' is not a healthy thing to believe. You said elsewhere that you have to admit that you're not too familiar with the tech involved (and - I certainly don't claim to speak with authority either), but you outright claim that it can be fixed (I hope you agree that we're talking about 'with reasonable effort _and_ without breaking texting as it works today').
- richardburton 15y ago
  Sorry for not explaining the Apple reference in more detail. What I meant was I love Apple because they really care about their customers. They seem to give a damn. The networks do not. Just look at this reply from the UK network Three: https://twitter.com/threeuksupport/status/162101700595957760 https://twitter.com/threeuksupport/status/162101700595957760 Does that not make your blood boil? I know that the loophole I found can be fixed. I am not prepared to explain it here because I want the networks to shut off the loopholes I do not know about, as well as the one I do.
  - darklajid 15y ago
    I fail to follow. This seems to be the response to the (flawed? I guess we have to agree to disagree at this point) complaint in your blog. Yes, there are sites that allow you to send text messages from other numbers, some trivial, some with an API. I claim it's a hard problem to "fix" this. What kind of response would you have liked to get? It was fast, open/honest and correct. The last part is probably hand waiving, but my blood doesn't boil. I'd have answered the same, given a small character restriction. This whole discussion gives longer explanations why this is the case in general. If you aren't talking about a specific loophole _in their service_ then I think we're still discussing the same thing or - well - fail to understand each other.
    - richardburton 15y ago
      We just fundamentally disagree on whether this is bad or not. All I can say is that if lots people got hold of my app it would be awful.

darklajid 15y ago

The Apple reference is weird.. Regarding 'requiring verification': See my other post. I was certainly able to call using other people's number as source in the past. Can everyone and his mum? I - don't know. I highly doubt that Skype _needs_ (disregarding laws etc) to ask anyone. But let's get to the bottom: How do you even fix this? See, you got a friend. His name's Bob. He has a girlfriend called Alice.. (okay, just kidding): Friend is on vacation in Siberia. Wants to send a text message to his girlfriend. There's a valid scenario where a message travels from a remote (sorry to all people from Siberia) part of Europe to the UK - using a very simple protocol and (probably) going through a few hops. Now your friend isn't in Siberia. Why is this now obviously spoofed? Because he is currently connected to your carrier? A kind of 'drop text messages from somewhere else if connected here' kind of policy? What if you know that he turns his phone off during the night? Store the last point of network access per user? Text messages have a maximum life time (they are stored until either the time expires or the recipient receives and acks the messages). How would you make sure that this still works, looking at the use case above? I just think that 'They don't care' is not a healthy thing to believe. You said elsewhere that you have to admit that you're not too familiar with the tech involved (and - I certainly don't claim to speak with authority either), but you outright claim that it can be fixed (I hope you agree that we're talking about 'with reasonable effort _and_ without breaking texting as it works today').

richardburton 15y ago
Sorry for not explaining the Apple reference in more detail. What I meant was I love Apple because they really care about their customers. They seem to give a damn. The networks do not. Just look at this reply from the UK network Three: https://twitter.com/threeuksupport/status/162101700595957760 https://twitter.com/threeuksupport/status/162101700595957760 Does that not make your blood boil? I know that the loophole I found can be fixed. I am not prepared to explain it here because I want the networks to shut off the loopholes I do not know about, as well as the one I do.
- darklajid 15y ago
  I fail to follow. This seems to be the response to the (flawed? I guess we have to agree to disagree at this point) complaint in your blog. Yes, there are sites that allow you to send text messages from other numbers, some trivial, some with an API. I claim it's a hard problem to "fix" this. What kind of response would you have liked to get? It was fast, open/honest and correct. The last part is probably hand waiving, but my blood doesn't boil. I'd have answered the same, given a small character restriction. This whole discussion gives longer explanations why this is the case in general. If you aren't talking about a specific loophole _in their service_ then I think we're still discussing the same thing or - well - fail to understand each other.
  - richardburton 15y ago
    We just fundamentally disagree on whether this is bad or not. All I can say is that if lots people got hold of my app it would be awful.