Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, when you're unable (or unwilling) to provide your phone number for that SMS. Instead, you enter a phone number provided by that site and then use that site to view your authentication SMS.

Obviously, this decreases security, because it basically turns the two-factor authentication back to one-factor (because that phone number is not “something you own”). But apart from that, is such site safe to use? Could they somehow use the received SMS to get access to my account, or for some other nefarious purpose?

For the record, the site I'm talking about is http://receive-sms-online.org/.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

The service makes all SMS they receive available to any internet user. That means any confidential information you receive via SMS is compromised.

Many websites which use two-factor authentication via SMS also use SMS to communicate other confidential information to you. This information isn't confidential anymore in this case. They might, for example, also use SMS for password recovery. That means it might be possible to hijack your account by clicking on "forgot password" which might offer a "send new password to my cellphone" option. The attacker could then monitor the online sms service for the new password.

Looking at the SMS one of their numbers received in the last hours, most of the messages allow to guess the website they came from, but they lack the context necessary to find out to which account they belong. To abuse the information one would have to link them to some account somewhere. However, you can not know what the service you want to register on sends you. When the message includes a username, the account is pretty much compromised.

You asked about what the sms service could do should they be evil. The website you registered to using their number believes that their number is your number, so they might regard some commands they receive from that number as authentic. What options this gives them depends on the website.

share|improve this answer

I have used them in the past to create accounts that I did not want traced back to me (hesitant to give out my phone number). Most of the SMS messages contain just a very small snippet of information and do not contain anything else. Nor do you need to put in any details to use the service, as such there is no way to track back to what account the SMS was linked to.

I would not use this for anything important, but for use in one time account creation and verification they are pretty safe.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.