3 ms·
Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at th
by citizenpaul 1y ago
Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies".
Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.
Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.
- varenc 1y agoHijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)
- bayindirh 1y ago> Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative. In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available. Forget getting banking details and use another device without the user knowing, either. If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means. One of the banks can use FaceID as a secondary factor, too. So, other methods are possible. It's an "implementation detail" at this point.