Google (who isn’t at fault) is named like 5 times in the Twitter thread. At a glance it as though they are to blame even though further reading shows they aren’t. Despite this, the carrier is kept anonymous? Strange.
>Google is investigating and looking into responsible (Australian) carrier. We’ve also reached out to the company for more details and to confirm that it’s not adding “SMS ADs” into the verification code process.
This indicates nothing as to the security of Gmail itself.
It is however an -excellent- reminder that SMS is -not- secure.
Correct my logic, please.
Google do tell people that they should have a second factor. Mine are my FIDO Security Keys.
They are avoiding carrier termination fee, basically being cheap.
Google has power to by contract force third party to make deals directly with carriers.
If I charge my clients on my website with some shady CC processor and they are scammed, everyone would blame me.
Usually when you send bulk sms, it is changing many hands on the way. From your provider, to some aggregator, then to carrier in target country or some illegal termination with sim cards.
SMS is not a secure platform.
Here is an article about it:
https://www.gms-worldwide.com/blog/grey-routes-a2p-traffic-m...
That would depend on the size of the original texts. If Google's verication messages are shorter than most, they might have room for ads where some other service doesn't.
I agree that an intermediary adding something is likely. Maybe Google has enough scale to self-manage 100% direct routes, but in general it's hard to avoid aggregators, and it's hard to track message delivery. And if you need worldwide delivery, it's hard to avoid grey routes.
As I used to tell people who wondered why I built a system to pick from multiple aggregators: All the aggregators will tell you they've got worldwide coverage and that they're the best; but they're all full of bs.
I should also add that they'll tell you that they all say they have 100% direct routes and that they don't use aggregators. One of the most amusing things I remember was when aggregator X had a big outage, several hours of not accepting messages (let alone delivering them), aggregator Y's success dropped by about half. It was clear they were using that aggregator for a significant amount of traffic. But sometimes it costs less to pay Y to submit messages to X than to pay X directly. shrug
Also with direct carrier connections you have options like one-shot SMS. If it is not delivered it is not retried. (which is useful for delays)
Delay is a big problem when you have many middleman, imagine you are sending OTP code, let's say route is delayed somehow, user didn't get the message, he requested another one, then first one is delivering, but you've already invalidated that, user enters wrong code, requests again, until he locks out :)
There are US carriers which inject their own banners into websites. Why do you think carrier wouldn't do this?