News for hackers. Stuff that matters.

A comment on Don't give away historic details about yourself. Parent comment

Re:Don't give away historic details about yourself by aksss on Tuesday April 10, 2018 @03:37PM (#16804474)
I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.
[ Parent | on HN ]
Re:Don't give away historic details about yourself by aidenn0 on Tuesday April 10, 2018 @05:03PM (#16805402)
SMS can also be captured by calling the customer service for your cell company and saying "I'm out of the country and lost my phone, can you forward texts to INSERT NUMBER HERE for me?"
[ Parent | on HN ]
Re:Don't give away historic details about yourself by gruez on Tuesday April 10, 2018 @05:27PM (#16805625)
use a burner sim like: https://www.twilio.com/wireless/pricing. presumably twillio is harder to social engineer than [big telecom]
[ Parent | on HN ]
Re:Don't give away historic details about yourself by my_first_acct on Tuesday April 10, 2018 @09:06PM (#16807210)
The Twilio SIM card is not as useful as you might expect. Unfortunately, Twilio cannot receive SMS messages from short codes [1], which are often used used by the kinds of places (banks etc) that rely on SMS for 2FA.

Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2]

As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally.

[1] https://support.twilio.com/hc/en-us/articles/223181668-Can-T...

[2] https://news.ycombinator.com/item?id=16773171

[ Parent | on HN ]
Re:Don't give away historic details about yourself by ossguy on Wednesday April 11, 2018 @01:37PM (#16813471)
You could use https://jmp.chat/ instead - JMP does support short codes, and you can use is anywhere you have Internet access, regardless of whether you have a SIM or not.
[ Parent | on HN ]