Questions tagged [sms]
Short message (or messaging) service, a system that enables cellular phone users to send and receive text messages.
0
votes
2answers
139 views
Is sending only password (not username) by sms secure? [duplicate]
Is it secure to send only password and not sending with username by sms?
Is there any risk?
9
votes
3answers
251 views
What is future of SMS 2-step authentication?
Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for authorization (in case of 2 step auth) or for controlling the account (password reset,...
3
votes
3answers
121 views
When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?
I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS.
Since many people already know your phone number, or it may be listed ...
2
votes
1answer
76 views
Problems with this 2 factor authentication implementation
I'm implementing my own 2 factor authentication using SMS.
We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
0
votes
0answers
132 views
Emulate a phone number to receive SMS?
I would like to perform some registrations on a website sending SMS code to verify identity on each registration process. Free SMS sites are flagged.
Is there any way to choose a random phone number ...
0
votes
1answer
53 views
Send a form with sensitive information via SMS attachment
A prospective business associate wants me to send an image of an application with some of my important self-identifying information via SMS as an attachment, e.g. image or PDF of the form. This doesn'...
0
votes
1answer
165 views
Is telegram SMS login secure?
TL;DR: Can
1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or
2) A "telegram ...
3
votes
3answers
162 views
Is receiving an OTP via email any more secure than receiving it via SMS?
I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS?
(Assuming the email - ...
5
votes
2answers
125 views
SMS Verification Code vs. Response Message [duplicate]
I need to verify each user's phone number in an enterprise SaaS system. Instead of using the common "Enter the 4/8 digit code in this form", I'd prefer to have the user respond with an SMS message ...
1
vote
2answers
109 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
8
votes
3answers
237 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
2
votes
2answers
175 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
0
votes
1answer
115 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
8
votes
3answers
367 views
Should I delete SMS messages containing one-time passwords?
I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset.
Should I delete those SMS messages after the one-time ...
0
votes
1answer
29 views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
11
votes
2answers
613 views
is LastPass SMS Recovery a security risk?
According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords.
LastPass encrypts your Vault before it goes to the server using
256-bit AES encryption. Since the ...
-3
votes
1answer
527 views
How To detect Fake mobile number for SMS verification [closed]
I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info
How to detect the number is ...
-1
votes
3answers
123 views
Is it Unrestricted file upload vulnerability?
I am using a messenger app that's similar to WhatsApp.
This app allows me to send any type of files, like Html, Php, SWF etc. via text messages.
Is this a vulnerability?
3
votes
1answer
255 views
SMS based 2FA intercepts
Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
-1
votes
1answer
63 views
Unable to utilise curl commands on website [closed]
There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
2
votes
1answer
123 views
Phone Number Appears to Have Been Temporarily Hijacked
What Happened:
At 8:40am Telegram sends me a login code via the Telegram desktop app.
At 8:44am Telegram informs me that someone has logged into my
account via ip address #1 (appears to be PIA vpn)
I ...
3
votes
1answer
67 views
Call and Unsolicited One Time Passwords
Context:
I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
1
vote
1answer
126 views
SMS OTP as 2FA - should there be sms session id in sms for user's verification?
Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
1
vote
0answers
45 views
Is it possible for old text messages to be used in an SMS spoofing attempt?
Background
The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email.
The Issue
...
2
votes
0answers
459 views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
2
votes
1answer
117 views
What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information?
There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to ...
139
votes
2answers
26k views
Received a set of SMS/MMS containing 2 photos, a voice message, and a text “I need help” with Google Maps link from a known contact. Is it spam?
My girlfriend (let's call her Jane) just got a set of SMS or MMS messages coming from a friend of her (let's call her Hellen). These messages contain:
Two photos of Hellen
A voice message
A text that ...
2
votes
0answers
100 views
“Reply T to unsubscribe” in SMS spam messages, ignore or reply “T”? [duplicate]
I'm in China and I occasionally get spam SMS messages. Most of them ends in a sentence that says this or something else alike.
Reply T to unsubscribe.
(T is the leading letter in Chinese word "...
1
vote
1answer
175 views
Can SMS messages be traced when they come from a computer?
From Amazon SNS, I can send SMS messages to any mobile phone.
To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to.
I receive quite a few phishing ...
-1
votes
1answer
540 views
How to avoid silent SMS attack?
I am worried about silent SMS being used incorrectly by people. What are the ways on which it can be avoided on Android and iOS?
1
vote
1answer
217 views
Received SMS/MMS with suspicious link - what to do now?
I today received a personalized sms on my android phone which:
addresses me by my first name
is labeled sms/mms
claims to be from a contact with a first name which I do not have in my contact list, ...
3
votes
1answer
45 views
Providing a SMS recovery feature without compromising the security of an account
I'm designing a system so that it encrypts a user's profiles. The only way of accessing the information stored in it is by either:
Providing the password for the account
Resetting the password using ...
1
vote
1answer
3k views
Reply to a spoofed SMS message
If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both?
EDIT: The concern is that the spoof prompts Alice to disclose ...
1
vote
1answer
78 views
Secure forwarding of 2FA SMS codes [closed]
Do solutions exist for forwarding SMS messages whereby:
the service provider stores no logs of messages
login protection with google authenticator or comparable
2
votes
1answer
233 views
Is it normal to receive working SMS verification code from strange number?
Here is a sample SMS that usually I trust:
The sender is in a text format and there is an information saying the sender does not support replies.
When I tried to login, I received verification code ...
4
votes
1answer
423 views
Password Reset Chatbot with Authentication through text message
I just saw a design for a chatbot that resets a password for a locked out user after failed logins. It authenticates the user by sending a text message to the user's phone.
How practically safe is ...
5
votes
1answer
238 views
Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)
In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
3
votes
1answer
160 views
Does SMS flood cause denial of service even when “blocked”?
Imagine a SMS flood using a few phone numbers. The client blocks the phone numbers using the build in mechanism of the smart phone, and thus does not receive any notifications. Even though the user ...
1
vote
0answers
153 views
How difficult are SS7 hacks? [duplicate]
Out of band communication via SMS has recently been shunned due to SS7 hacks. How likely are these to become more prevalent? I saw this question:
Should 2FA over SMS be considered insecure in the ...
6
votes
1answer
184 views
Alternatives to SMS as a out-of-band channel
I am looking at password reset functionality for a project I am working on. Looking at OWASP guidelines, it suggests using SMS as an out-of-band channel for this. ( https://www.owasp.org/index.php/...
1
vote
1answer
49 views
How secure it is to identify a user by an sms's caller id?
I need to verify a user based on its phone number. I am thinking that instead of me sending him an sms, it would be cheaper if he sends me the sms and I verify he's phone number based on his caller ID....
2
votes
2answers
7k views
Got a paypal confirmation code when I don't even have an account? [closed]
Basically just right now I got a text on my phone giving me a code that expires in 5 minutes. The scary thing is that I've never used paypal ever in my life. Is this just someone mistyping his phone ...
2
votes
1answer
13k views
Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?
A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
2
votes
0answers
63 views
How can I go about securing services that require SMS tokens as backups?
I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
1
vote
4answers
176 views
Is a SIM card secure against governments?
Let's say I live in Russia and I use Gmail. My Gmail has my phone number for recovery in case I lost my Gmail password.
Obviously if Russian police want to access my Gmail account then they can ...
0
votes
1answer
302 views
What action plan a hacker can do to enter an iPhone [closed]
I am interested by mobile protection for general public, we have all information saved on our phone. I am thinking what action plan a hacker can do with Kali or other to enter an iPhone and read SMS, ...
2
votes
0answers
79 views
Could an attacker delete messages using an MMS exploit?
My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON.
...
1
vote
1answer
92 views
Someone is bothering me by messaging through websites message services [closed]
Someone is sending me sms from last few weeks through 'SMS sending websites' who don't publish the sender name in the message. Sometimes it shows ' sent through websms' in the message. Please help if ...
2
votes
1answer
89 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
2
votes
1answer
113 views
How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers?
I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.
My goal was to have a dedicated DID/number which I don't ...
