Hacker News Reader

Comment by aksss | Hacker News Reader

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.

View on HN

SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"

use a burner sim like: https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]

The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA.

Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2]

As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally.

[1] https://support.twilio.com/hc/en-us/articles/223181668-Can-T...

[2] https://news.ycombinator.com/item?id=16773171

You could use https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.

Reply on news.ycombinator.com