6

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, when you're unable (or unwilling) to provide your phone number for that SMS. Instead, you enter a phone number provided by that site and then use that site to view your authentication SMS.

Obviously, this decreases security, because it basically turns the two-factor authentication back to one-factor (because that phone number is not “something you own”). But apart from that, is such site safe to use? Could they somehow use the received SMS to get access to my account, or for some other nefarious purpose?

For the record, the site I'm talking about is http://receive-sms-online.org/.

Improve this question
2
  • 3
    I tried every one of these "free" SMS receiving sites but they never receive the actual text I sent them from any service or phone. It seems like those messages are auto-generated and fake. were you able to get them to actually receive the messages?
    – pete
    Commented Jan 20, 2017 at 19:48
  • 1
    @pete, I have had good success multiple times. but you'd likely need to try 10 or likely more times each time.
    – Pacerier
    Commented Jan 31 at 22:44

2 Answers 2

Reset to default
10

The service makes all SMS they receive available to any internet user. That means any confidential information you receive via SMS is compromised.

Many websites which use two-factor authentication via SMS also use SMS to communicate other confidential information to you. This information isn't confidential anymore in this case. They might, for example, also use SMS for password recovery. That means it might be possible to hijack your account by clicking on "forgot password" which might offer a "send new password to my cellphone" option. The attacker could then monitor the online sms service for the new password.

Looking at the SMS one of their numbers received in the last hours, most of the messages allow to guess the website they came from, but they lack the context necessary to find out to which account they belong. To abuse the information one would have to link them to some account somewhere. However, you can not know what the service you want to register on sends you. When the message includes a username, the account is pretty much compromised.

You asked about what the sms service could do should they be evil. The website you registered to using their number believes that their number is your number, so they might regard some commands they receive from that number as authentic. What options this gives them depends on the website.

Improve this answer
0
4

I have used them in the past to create accounts that I did not want traced back to me (hesitant to give out my phone number). Most of the SMS messages contain just a very small snippet of information and do not contain anything else. Nor do you need to put in any details to use the service, as such there is no way to track back to what account the SMS was linked to.

I would not use this for anything important, but for use in one time account creation and verification they are pretty safe.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .