Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven long ago to have vulnerabilities:
- SS7 vulenrability
- Unprotected A3/A5/A8 algorithms
- old GSM end-user encryption-less technology, unchanged since the day when it has been implemented
- NIST updates
- SMS-C vunlerability
- SMS verification, is it secure?
- Worst way
- Does the average Joe need to be worried about SMS interception?
A) That surely tells the world that SMS-enabled services are really hackable (yes, it needs some money and resources, but as time goes, everything becomes cheaper). So, if you are an important figure, or even if a hacker targets you specifically, or even some bulk-hacker software might be written (who intercepts all SMS within radius), then your SMS can be intercepted easily.
B) That also means, that in some cases, having 2FA using SMS can be worse than being without 2FA at all.
So I have 3 questions:
What is the foreseeable future? Will worldwide GSM providers fix all the vulnerabilities and upgrade the technologies easily?
Who can force the major technology giants (Google, Twitter, Facebook, eBay, Amazon, etc...) to allow us to use 2FA without SMS? (At this moment, only Google and FB allow users to remove their phone number as 2FA, if you remove the phone number entries from all places in your account, but such critical services, as LastPass, Authy, etc... do not allow this yet)
Before GSM providers or websites will upgrade technologies, what steps can we do to avoid our SMS being intercepted? Can we have some "protected SIM number" or program that will prevent auto-switching or detecting interception, or blocking it or whatever?