Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for authorization (in case of 2 step auth) or for controlling the account (password reset, etc..). However, already long ago was proven GSM technology to have the disclosed vulnerabilities:
- SSL7 vulenrability
- Unprotected A3/A5/A8 algorithms
- old GSM end-user encryption-less technology, unchanged since the day when it has been implemented
- NIST updates.
- SMS-C vunlerability
- SMS verification, is it secure?
- Worst way
- Does average Joe need to be worried about SMS interception?
A) That surely tells the world, that SMS-enabled services are really hackable (yes, it needs some money and resources, but as time goes, everything becomes cheaper). So, depending if you are important figure, or even if hacker targets you specifically, or even some bulk-hacker software might be written (who intercepts all SMS within radius), so your SMS can be interpreted easily.
B) That also means, that in some cases, having 2-FA (using SMS) can be WORSE, then being without 2-FA at all.
So I have 3 questions:
What is a foreseeable future - will worldwide GSM providers soon fix all the vulnerabilities and upgrade the technologies easily?
Who can force the major technology giants (Google,Twitter,FB,EBAY,AMAZON...) etc to allow us using 2-FA without SMS ? (At this moment, only Google and FB allow to remove phone-number as 2-FA, if you remove the phonenumber-entries from all places in your account, but such critical services, as LastPass, Authy, etc... doesn't yet allow)
Before GSM providers or websites will upgrade technologies, what steps can we do to avoid our SMS being intercepted? Can we have some "protected-sim-number" or program who will avoid autoswitching or detecting interception, or blocking it or whatever?