3 ms·
Why is sms such a crappy protocol that this is even possible?
by tiku 2y ago
Why is sms such a crappy protocol that this is even possible?
- sunbum 2y agoSMS isn't a protocol. Attacks like these are done via 2G. Which is really why most people should disable it if they can.
- dotancohen 2y agoBecause it dates to a time when such attacks were infeasible. GPS is very similar in that regard. Even HTTPS was uncommon back when I was in university. NASA spacecraft still communicate over unencrypted channels. Mindsets were different then.
- fragmede 2y agonot just mindsets, but the computing power available. These days, my smartphone is millions of times more powerful and the computation to do TLS encryption on every website I visit is trivial for a computer that fits in the palm of my hand. Way back when, the 1 or 2 kilobytes or so a modern RSA private key (PEM format) would take up on disk was meaningful when you only had 4 megabytes of RAM and CPUs ran in the megahertz range.
- oldgradstudent 2y ago> GPS is very similar in that regard. GPS originated as a military protocol and has some level of encryption and authentication, but this is not available to the general public.
- GJim 2y agoGPS *had* no encryption or authentication; indeed, such security is only a recent addition to the L2 frequency. USK: Galileo also has authentication available on its civilian frequencies.
- lxgr 2y ago> such security is only a recent addition to the L2 frequency Is that already available? I thought GPS L2C didn't include authentication yet.
- oldgradstudent 2y ago> GPS had no encryption or authentication; indeed, such security is only a recent addition to the L2 frequency. This was a long time ago, but I distinctly remember the encrypted P(Y)-code and anti-spoofing being operative in the mid 1990s.
- nanna 2y agoAlso to a dumb phone it doesn't matter whether an SMS contains a phishing link because it has no way of accessing it. Until the advent of smart phones SMS phishing was a non-issue.
- est 2y agoencryption was expensive in GSM days. People seem to forget that dedicated TLS acceleration hardware was a thing not long ago.
- robaato 2y agoIt was a hack to use "unused" control/signalling paths - see https://en.wikipedia.org/wiki/SMS https://en.wikipedia.org/wiki/SMS Effectively came "for free" for mobile operators...
- lxgr 2y agoThat’s a common misconception. The signaling channels used aren’t “unused” – they’re literally set up and torn down to deliver SMS!
- aidenn0 2y agoI think you meant to end that with "phone calls" rather than "to deliver SMS?" SS7 was used for that, but had a significant amount of idle time since most phone calls are much longer than the time needed to setup the connection.
- lxgr 2y agoI do indeed mean SMS, but I was focusing more on the air interface. There, SMS definitely consume resources in the same way that calls do (although of course at a very different rate: SDCCH uses 0.8 kbit/s, as opposed to 13 kbps for full rate voice/CSD traffic channels).
- aidenn0 2y agoBut the signaling channels weren't used to send SMS before SMS existed (which the original statement of "unused" implied).