5 ms·
> other options available to her include > port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi That's g
by lxgr 1y ago
> other options available to her include
> port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi
That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do).
I really wish that were illegal. A phone number is a phone number.
> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through.
Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised.
- baby_souffle 1y ago> That's generally a great solution – unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons, or demand that the number is somehow "registered in her name" (which many smaller carriers apparently don't do). I really wish that were illegal. A phone number is a phone number. It pisses me off to no end. I use a few different banks and some are fine with google voice, others are not. One only allows customer service to send SMS tokens to google voice but not through the regular flow. In all but one case, they will happily robo call my google voice number and have a tts engine read me the same code that they didn’t want to SMS. Security policy by rng, ffs!
- jjice 1y agoIt really is absurd that the same companies that won’t allow 2FA with any other method outside of SMS are the same ones not sending to VoIP. Maybe they all go through a service for SMS that blocks it, but it still upsets me. It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps.
- unethical_ban 1y agoI absolutely cannot stand that no bank I have (US) supports generic TOTP, which is more secure and easier to recover from backup if my phone is broken or stolen. It's inexcusable.
- UncleMeat 1y agoTOTP is only marginally more secure. It defends against sim swaps but it still loses to phishing, which is far more common than sim swaps.
- unethical_ban 1y agoBut it is easier to backup and restore, is accessible without a phone, and can be used without cell service.
- UncleMeat 1y agoThose are usability benefits rather than security benefits and I really don't know if I'd use the word "inexcusable" for this difference. And for the vast majority of people, sms is much easier to backup and restore than totp because there is an infrastructure to help them do so.
- _bin_ 1y agoThis is probably compliance-related. For me, TOTP isn’t “something I have”, it’s another thing I toss into my password manager and sync to all devices. I really agree with it, but that’s probably their rationale.
- connicpu 1y agoI do the same, and it somewhat defeats the spirit of 2FA, but I still believe it's more secure. It's basically a second password where intercepting it in transit once isn't enough to be able to repeat the login in the future.
- unethical_ban 1y agoOne time password. Yes, a digital OTP generator is more susceptible in theory to theft or duplication than a hardware token. Yes, the benefits of digital OTP are great compared to password only, more secure than SMS, and trivial to implement.
- BenjiWiebe 1y agoI've been using Citi and Discover for years with a Google Voice number. Possibly I've been grandfathered in though?
- ravenstine 1y agoExecs at those companies probably think "Google = good".
- notyourwork 1y agoYet Facebook won’t let me sign into WhatsApp using my GV number alone.
- BenjiWiebe 1y agoThere must be something unique about my GV number. It's even allowed on WhatsApp (knock on wood). I registered it about 13 years ago. I didn't transfer it from a landline/cell phone, it was picked from a list of Google Voice numbers available in my area code. I've never had Fi.
- lxgr 1y agoI don't think SMS senders can actually tell the difference between Google Voice and other VoIP providers.
- quesera 1y agoTwilio has a lookup API, which returns the subscriber name and carrier. Here's an example response (subscriber name redacted): { "data": { "name": "LASTNAME, FIRSTNAME", "line_provider": "Google/Bandwidth.com (SVR)", "carrier": "Bandwidth.com", "line_type": "landline" } }
- lxgr 1y agoAh, I always assumed Google uses Bandwidth.com completely transparently – I wasn't aware there's a separate level of "line provider" look-up available. Thank you!
- connicpu 1y agoMay vary by institution, but both banks I have accounts with also support having a robot call my phone where I can confirm the login. That should at least work with WiFi calling.
- yfontana 1y ago> It’s insane to me that maybe every bank I use requires SMS 2FA, but random services I use support apps. It never ceases to surprise me how much American banks always seem to lag behind with regards to payment tech. My (european) bank started sending hardware TOTP tokens to whoever requested one like a decade ago. They've since switched to phone app MFA.
- jabzd 1y agoWe actually had it that way on accident in a few of our applications - we had a `#isTextable(e164)` function that would do a carrier lookup and voip carriers sometimes returned as landlines or as arbitrary values that didn't mean mobile. We eventually did some work to refine that function to be smarter and actually better represent if the number was textable. At least for us, it wasn't a conscious decision, it was a gate being aggressive in our SMS pipeline.
- BenjiWiebe 1y agoI use Wi-Fi calling on a phone only for 2FA SMS. Never had a problem with it. It was RedPocket (MVNO) with T-Mobile. Annual plan of 200MB, only a few dollars a month. No T-Mobile service here* so only SMS over Wi-Fi works. Only ever used for SMS 2FA. *The bands acquired with the Sprint merger have service, but the cheap used phone I bought was pre-Sprint-merger and lacked those bands.
- _bin_ 1y agoPhone numbers are used like this because in the Year of our Lord 2025, they’re the best way to semi-solve the Sybil problem even somewhat without having to literally do some kind of KYC
- zinekeller 1y ago> Interesting, I was under the impression that SMS over IMS was implemented transparently to external senders. But given what a hack the entire protocol is, I'm not really surprised. I can probably illuminate some things here. This is almost certainly the SMS API they're using. Your phone, and your network by extension, does not care if the phone is technically online - so those messages get received because they're literally sending in the blind (and if the recipient is offline, the message gets temporarily stored by the receiving carrier for around 3-7 days before it is discarded). These SMS OTP systems validate "reachability" (using APIs like https://developer.vonage.com/en/number-insight/technical-details https://developer.vonage.com/en/number-insight/technical-det... and https://www.twilio.com/docs/lookup/v2-api/line-status https://www.twilio.com/docs/lookup/v2-api/line-status) and will not send a message if a number is 'not' reachable. Unfortunately, as implied by the air quotes, these methods are not infallible. This is done to reduce the costs of sending the message (carriers charge a lot more for commercial customers) but this is definitely stupid for a already-validated number like in this case.
- insane_dreamer 1y ago> carriers charge a lot more for commercial customers I've been used to unlimited free SMS for so long now (though I remember the days when it was limited), I forgot that commercial customers get charged for these
- Marsymars 1y agoIf you port your cell number to a VOIP carrier, I don’t think senders have any way of telling that it’s not still a regular cell number? I have such a ported number and have no issues receiving SMS 2FA codes.
- franga2000 1y agoUnfortunately there are a lot of "is this number voip" services that use various tricks to detect voip numbers, or simply buy this data from the voip provider or someone else in the path. If nothing else, if a particular voip provider only does voip, you can just put them on a blacklist. You can get any number's provider from the number portability clearinghouse (this might be country dependent, where I live, there's only one, and anyone can query it).
- fasteo 1y ago>>> I really wish that were illegal. A phone number is a phone number. European speaking. For completeness: Financial directive PSD2[1] allows to use an SMS as a 2FA only because there is an KYC already done for that number (anon SIM are no longer allowed in the EU) Also note that the 2FA is not the OTP code you receive. This code is just a proxy for probing "something you have", with the "something" being the phone number which, again, is linked to a physical person/company. I have commented this several times, but as of today, SMS is the only 2FA method that can be easily deployed at scale (all demographics, all locations, compatible with all mobile devices) [1] https://en.wikipedia.org/wiki/Payment_Services_Directive https://en.wikipedia.org/wiki/Payment_Services_Directive
- lisper 1y ago> anon SIM are no longer allowed in the EU Ah. That explains why they asked for my life history when I tried to buy a local SIM in Italy.
- lxgr 1y agoIronically, this is only true for prepaid SIMs. As a result, in some EU countries it's easier to get a month-by-month postpaid plan – sometimes there's no KYC at all for these...
- watermelon0 1y agoAnon SIM cards are still allowed in some EU countries: https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country#Europe https://prepaid-data-sim-card.fandom.com/wiki/Registration_P...
- fasteo 1y ago>>> she turned on wifi calling on her phone. now she could receive SMS messages from friends and family, but 2FA codes still weren't coming through. Completely different beasts. One is P2P, the other is A2P
- caseyy 1y agoI was under the impression WiFi Calling was just regular phone service through WiFi. It seems to work that way for me, 2FA codes and all.
- lxgr 1y agoVoWiFi (as Wi-Fi calling is called in the 3GPP specs) is similar to VoLTE, but not all SMS go over VoLTE: Unlike for calls, where there's mandatory VoIP in 4G/LTE and beyond (there is no more circuit switching), there's still a fallback path for SMS that uses legacy signalling instead of IMS (which powers VoWiFi and VoLTE/VoNR). Maybe there are some SMS gateways that are somehow incompatible with some IMS message gateways? (Theoretically, the IM-SM-GW should be transparent to external networks, I believe, but practically I wouldn't be surprised if some weird things lurked in there, requiring a fallback to the signalling path, which is not available on VoWiFi.)
- tim333 1y agoWiFi calling seems to depend on your mobile service provider to provide the service. I guess different networks do it differently.
- exabrial 1y agoThe problem isn't discrimination of SMS number types, it's SMS itself should be illegal, period.
- lxgr 1y agoSMS itself is just fine, the problem is companies making me use it in ways I don't care for.
- hulitu 1y ago> SMS itself should be illegal, period. Why ? I still send SMS. Wifi is not available overall. The Google SMS app is not able to retry sending when connectivity is back and the UI is enshitified, but this is norm in modern software.
- rsync 1y ago"port her cellphone number to a VOIP provider that does support receiving SMS from shortcodes over wifi" ... "... unless the company she's dealing with is one of those that don't send SMS-OTP codes to VoIP numbers for seCuRiTy reasons ..." Correct. This is, in fact, a terrible idea because even if you do find a VOIP provider that can receive SMS from "short codes" (the weird little numbers your bank sends codes from) that is a temporary oversight and will get "fixed" eventually. Remember: None of this is for your security or to help you. All of these measures are just sand in the gears to slow down the relentless onslaught of scam/spam traffic. Your bona fide mobile phone number is a "proof of work" that these providers are relying on in absence of any real solution to this problem.
- lxgr 1y ago> Your bona fide mobile phone number is a "proof of work" that these providers are relying on in absence of any real solution to this problem. Exactly, and I simply refuse to do their work.
- quesera 1y ago... and they have decided to ignore you as a customer, because the risk of allowing VoIP numbers is greater than you are valuable. So, everybody wins. :(
- deleted 1y ago[deleted]