Hacker News Reader

Comment by gruez | Hacker News Reader

use a third party service for sms like google voice, or jmp.chat. yes, it just shifts the problem from your telecom company to a third party, but at least those providers have stronger authentication (google has totp/u2f, and jmp.chat has whatever your xmpp server provides) than what telecoms have.

View on HN

That solves nothing - the SMS is still subject to all of the same potential issues as one tied directly to a cell phone.

specifically what? i already stated google voice and jmp.chat both have better authentication and 2 factor options than most cell carriers, are they're probably harder to social engineer. since they're internet based, they aren't vulnerable to SS7 exploits. I'm sure if you tried hard enough, you could hack them as well, but at least it raises the difficulty from anyone who read a social engineering guide to nation state or an APT.

> since they're internet based, they aren't vulnerable to SS7 exploits.

I think the problem with SS7 is that there's no authentication between providers. At least as far as I know.

afaik the ss7 exploits essentially involve a rogue carrier saying "hey verizon, your client 212-555-1234 is roaming on my network, plz send all his calls/texts to me". i don't think this attack applies to non-mobile providers because there's no roaming. and unlike the internet, there's no bgp-like system[1] for "announcing" phone numbers. it's all centralized, which should reduce your attack surface from every telecom in the world, to the originating telecom, whoever's in charge of the numbering database, and your carrier.

[1] https://en.wikipedia.org/wiki/Local_number_portability#Porta...

Reply on news.ycombinator.com