Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for authorization (in case of 2 step auth) or for controlling the account (password reset, etc..).
However, already long ago was proven GSM technology to have the disclosed vulnerabilities:
- SSL7 vulenrability
- Unprotected A3/A5/A8 algorithms
- old GSM end-user encryption-less technology, unchanged since the day when it has been implemented
That leads us to the decision, that SMS-enabled services are really hackable (yes, it needs some money and resources, but as time goes, everything becomes cheaper). So, the matter is only:
How important figure you are, or
If attacker is just willing to spend the resources to attack you.
So I have 3 questions:
What is a foreseeable future - is it going to happen, that worldwide GSM providers will soon fix all the vulnerabilities and upgrade the technologies easily? And if they don't plan this, then what should we do?
What is a foreseeable future of internet? Will Google, banks, and all others tend to deprecate SMS authentication soon? Otherwise we will be always vulnerable with #1 issue. (btw, in Google you can disable SMS)
And as a last note, of course, in our reality, 2 step authorization (SMS based) increases security from most of hackers (i.e. in case our passwords are stolen), but the reality turns out to be that users who uses 2-step SMS authorization (or, doesn't use 2 step, but has entered own mobile number in his profile, as a recovery method) have increased security threat. For example, when hacker doesn't know your password, but is capable to hack SMS (as opposed to the first category of hackers, when you have increased security instead). Quite a problematic dilemma.