Skip to main content
182 votes

Received a set of SMS/MMS containing 2 photos, a voice message, and a text "I need help" with Google Maps link from a known contact. Is it spam?

This does not seem to be a virus. It is a panic function in some android phones, that allows to send these messages in case you are kidnapped or otherwise in danger by pressing the power button 3 ...
Peter Harmann's user avatar
108 votes
Accepted

Received a set of SMS/MMS containing 2 photos, a voice message, and a text "I need help" with Google Maps link from a known contact. Is it spam?

This is an exact description of the panic feature built into phones as Peter Harmann already said. Anecdotally I can tell you on my previous Samsung smartphone, I could trigger this exact feature by ...
Kallmanation's user avatar
  • 1,736
77 votes

Are there any security risks in replying to an SMS message?

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV ...
Serge Ballesta's user avatar
75 votes
Accepted

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified. That's why a lot of companies are recommending other ...
galoget's user avatar
  • 1,514
70 votes

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?

A few reasons: It's relatively easy (though getting harder, thankfully) for an attacker to hijack somebody's phone number; the attacker convinces the cell provider to either port the victim's number ...
CBHacking's user avatar
  • 49.2k
58 votes
Accepted

Is revealing the phone number during OTP verification process considered a vulnerability?

The primary attack method against text message OTP is to 'sim swap' and take over the target's phone number. If the site provided the full number in this scenario, they'd be giving the attacker ...
gowenfawr's user avatar
  • 72.9k
53 votes

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

SMS is not exactly plaintext. The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure. Over the air, it ...
fraxinus's user avatar
  • 3,568
49 votes
Accepted

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
Steffen Ullrich's user avatar
35 votes

Are there any security risks in replying to an SMS message?

One useful thing an attacker could gather is what your response time is at different times during the day and also things like your sleep schedule. If you leave your phone at home when you go jogging ...
Trey Blalock's user avatar
  • 14.2k
29 votes
Accepted

If you SMS text someone, how much more information will they know about you?

If you publish you mobile number in a directory such as Spokeo they can look you up If you use Telegram, the other person will be able to see your public name. Your last seen online time could be ...
Artem S. Tashkinov's user avatar
29 votes

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

SMS has significant advantages to the user: It's universal - every mobile phone can handle it, even the dumbest feature phone. Users may not be able to afford a smartphone and associated data plan, ...
Chris H's user avatar
  • 4,435
26 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

This is not about a "vulnerability". This is about personally identifiable information (PII). It's the same reason why credit cards numbers are not displayed in full on sites either. Anyone ...
schroeder's user avatar
  • 131k
22 votes
Accepted

Is there any alternative beside sending One-Time-Password via SMS?

Why can't you use TOTP or HOTP which is standard and supported by most authenticator apps? When people register for your service they need to enroll their authenticator app by scanning a QR code ...
André Borie's user avatar
  • 12.8k
21 votes

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

In addition to the issues with SS7, SMS is not meaningfully encrypted. Sometimes the last mile portion (between tower and device) is encrypted, but that encryption is weak and can be broken. Other ...
CBHacking's user avatar
  • 49.2k
19 votes
Accepted

is LastPass SMS Recovery a security risk?

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more ...
korsbakken's user avatar
17 votes
Accepted

SMS verification, is it secure?

I'm going to say no. While SMS is a generally accepted 2nd factor, there have been a number of cases where an attacker has used social engineering to break into a user's carrier account and pick up ...
Ryan Kelso's user avatar
  • 1,220
16 votes
Accepted

Which verification method should I choose: SMS or call?

Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot. Reading sms is ...
user2765654's user avatar
16 votes

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new ...
Damon's user avatar
  • 5,221
14 votes

Which verification method should I choose: SMS or call?

It really will depend on your threat model. SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better ...
CristianTM's user avatar
  • 2,580
14 votes

Is revealing the phone number during OTP verification process considered a vulnerability?

If the full number were listed then I could visit your account, request a new password, and know your phone number. The last two digits are a tradeoff that permit you to know its (likely) your number ...
Jeff Ferland's user avatar
  • 38.3k
13 votes

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

One aspect of SMS as 2FA authentication that I feel isn't as covered is the availability of the method itself; you don't need a wifi connection or a data plan to run a SMS 2FA setup, nor do you need a ...
Alexander The 1st's user avatar
12 votes

SMS verification, is it secure?

What you describe is absolutely not a secure approach. SMS messages are broadcast over the air without guarantee of encryption. They can be intercepted and recorded. In addition, your SMS ...
Antonius Bloch's user avatar
10 votes

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability ...
John Wu's user avatar
  • 9,321
10 votes

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

In an early draft of NIST SP 800-63-3, SMS was listed as a deprecated 2FA mechanism. When the final draft was released, this paragraph was removed, but examples remain in 800-63B of compromising SMS ...
user10489's user avatar
  • 2,043
10 votes
Accepted

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

I agree preventing SIM Jacking would be a step forward; still even if we fixed SIM Jacking/swapping, we still have to worry about Man-In-Middle (MITM) attacks like the SS7 attack https://www....
user8187's user avatar
  • 141
9 votes

Prevent against OTP abuse in app sign up flow

Email Verification First If your UX allows, you can require the user to first create an account based on their email address. Once the address is verified you can allow adding a phone number and then ...
Jens Ehrich's user avatar
8 votes

is LastPass SMS Recovery a security risk?

Note This answer discusses some important caveats to keep in mind for systems like this in general, but misses relevant details about the implementation of LastPass' recovery system. For more ...
Conor Mancone's user avatar
8 votes

Should I delete SMS messages containing one-time passwords?

As usual, let's start by defining the threat model: you're worried about someone getting a hold of your phone and looking through your SMS history. But you're not worried about the SMSes being ...
Mike Ounsworth's user avatar
8 votes
Accepted

SMS Verification Code vs. Response Message

Great question! I'll attempt to break down the security models. Is there anything inherently more secure about having users enter a 4/8 digit code online vs. sending a code or simple message from ...
Mike Ounsworth's user avatar
8 votes

2-step authorization (using SMS) is less secure than having 2-factor disabled at all!

Having multiple factors of authentication are always more secure than any one of those factors apart. A password and a token from an SMS message is harder for an attacker to circumvent than just a ...
Ghedipunk's user avatar
  • 6,050

Only top scored, non community-wiki answers of a minimum length are eligible