News for hackers. Stuff that matters.
Re:NIST declares the age of SMS-based 2-factor authenticatio... by bigiain on Tuesday July 26, 2016 @01:15AM (#12163484)
The problem is - none of the Telcos have any profit motive to provide secure, validated SMS.

For _them_ easy phone number porting, customer service reps being able to "fix" a paying customers message problems, and making it as easy as possible to have their customers send and receive more SMS messages are all directly bottom-line positive things.

Making any of that _harder_ for their customers will only reduce their profits and increase their support costs - at zero benefit to the Telco.

Your bank or ISP or email provider's security is not the Telco's problem - and they can't be expected to invest effort into it on behalf of non-paying 3rd parties...

This is what my local Telco Alliance told the banking industry here in .au back int 2012 (and 've kept it bookmarked ever since for all these discussions...):

"Stanton told iTnews that the telcos have decided not to extend the security mechanism protecting the mobile number portability database for reasons of competition and database performance.

Apart from making the porting process more time-consuming and less convenient for hundreds of thousands of Australians every year, additional ‘security’ may be seen as a tool to lock in customers, hinder number portability and thus be deemed to be anti-competitive," he said"

http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...

Re:NIST declares the age of SMS-based 2-factor authenticatio... by tajen on Tuesday July 26, 2016 @03:25AM (#12163888)
If telcos can't do it, senders can switch to Whatsapp when possible. And everybody is able to understand Whatsapp (although the delivery isn't reliable). And that may even give them more information about the profile of the user, and that could be billed by Whatsapp as a service to senders.
Re:NIST declares the age of SMS-based 2-factor authenticatio... by bigiain on Tuesday July 26, 2016 @03:49AM (#12163972)
Sure, but at the loss of the ubiquity of people capable of receiving SMS - Googling suggests ~4.5billion mobile devices worldwide, but only ~1billion Whatsapp users (a number high enough to surprise me, but still under 20% of the total potential market for SMS 2FA...)

It also introduces yet another 3rd party reliance and avenue for attack - Brazil and Turkey have blocked Whatsapp recently, and India and the UK have discussed it as well. I doubt Id want to rely on my Whatsapp 2FA tokens arriving in China either...

Re:NIST declares the age of SMS-based 2-factor authenticatio... by TorKlingberg on Tuesday July 26, 2016 @05:11AM (#12164304)
Does WhatsApp have any kind of API for sending messages to their users?
Re:NIST declares the age of SMS-based 2-factor authenticatio... by kuschku on Tuesday July 26, 2016 @08:01AM (#12164965)
Yes, they do.

Almost all the newspapers in Germany have WhatsApp newsletters, and you can get TV news as video message every hour via whatsapp, and so on.

Re:NIST declares the age of SMS-based 2-factor authenticatio... by germanier on Tuesday July 26, 2016 @11:02AM (#12166107)
They all use third-party service to send those messages through actual WhatsApp clients with real SIM cards (I think each serves around 500 recipients). They also sometimes get blocked by WhatsApp for spamming, loosing customers subscribed to that number. Some examples are https://www.whatsservice.eu/ and https://www.whappodo.com/

WhatsApp announced some API for those use cases though.