Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is there a pure SMS based UI?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Ask HN: Is there a pure SMS based UI?

#11

Post by JNRowe »

Far from state of the art, but…

I used to have a cheap Huawei dongle connected to my desktop that I'd interact with via awful scripting against gnokii¹. If you're the type of person that likes hacking up your own solutions it can be quite fun to work with.

After a lot of trial and error^wimprovement I found it useful to use gnokii's SMS mailbox export, and run a job to iterate over the exported mailbox periodically. The simple reason being most scripting languages ship with mbox support out of the box, and there are heaps of tools for handling them from a shell script.

¹ http://gnokii.org

Re: Ask HN: Is there a pure SMS based UI?

#12

Post by Areibman »

judge2020 wrote: post #8

The main issue with SMS is that it's unencrypted and often intentionally being piped to third party firms for advertising and whatnot, so whatever you do it probably isn't advisable to send anything you wouldn't want people seeing (eg. I wouldn't suggest doing email via it). If you have even the smallest data cap, https://lite.cnn.com can be used for your news and https://mail.google.com/mail/u/0/h/ (/h/ at the end)…

If this is the case, why do so many apps use SMS for 2FA and sending unique links? Are MITM attacks over SMS common?

Re: Ask HN: Is there a pure SMS based UI?

#15

Post by 16 »

I have a second SIM card that T-Mobile gave me for free (no idea why). I have it installed in an Android phone running Tasker with a bunch of jobs I created to do various things. Android phone stays at home while my primary (flip phone) comes with me. I get specific Matrix (https://matrix.org) messages forwarded to my flip phone, I can query the weather, I have a couple RSS feeds forwarding, and I can enable/disable any of these tasker profiles by sending custom commands from the flip phone back to the android. Obviously this requires having a second SIM card, but you could probably find a super cheap talk/text (or text-only?) prepaid plan temporarily and set up something similar. Tasker is extremely powerful and could conceivably do most if not all of what you're asking.

Re: Ask HN: Is there a pure SMS based UI?

#16

Post by Robotbeat »

Areibman wrote: post #12
judge2020 wrote: post #8

The main issue with SMS is that it's unencrypted and often intentionally being piped to third party firms for advertising and whatnot, so whatever you do it probably isn't advisable to send anything you wouldn't want people seeing (eg. I wouldn't suggest doing email via it). If you have even the smallest data cap, https://lite.cnn.com can be used for your news and https://mail.google.com/mail/u/0/h/ (/h/ at the end)…

If this is the case, why do so many apps use SMS for 2FA and sending unique links? Are MITM attacks over SMS common?

Well… it’s not necessarily a good idea to do 2FA with SMS. Additionally, the codes sent by SMS are usually very time-sensitive, like 5 minutes.

And it means someone has to have compromised both your computer and your SMS in order to defeat the 2FA. Which doesn’t make it impossible. But it’s not trivial to coordinate those things.

Re: Ask HN: Is there a pure SMS based UI?

#18

Post by _wldu »

Areibman wrote: post #12
judge2020 wrote: post #8

The main issue with SMS is that it's unencrypted and often intentionally being piped to third party firms for advertising and whatnot, so whatever you do it probably isn't advisable to send anything you wouldn't want people seeing (eg. I wouldn't suggest doing email via it). If you have even the smallest data cap, https://lite.cnn.com can be used for your news and https://mail.google.com/mail/u/0/h/ (/h/ at the end)…

If this is the case, why do so many apps use SMS for 2FA and sending unique links? Are MITM attacks over SMS common?

End user convenience.

Re: Ask HN: Is there a pure SMS based UI?

#19

Post by beaconstudios »

16 wrote: post #15

I have a second SIM card that T-Mobile gave me for free (no idea why). I have it installed in an Android phone running Tasker with a bunch of jobs I created to do various things. Android phone stays at home while my primary (flip phone) comes with me. I get specific Matrix ( https://matrix.org ) messages forwarded to my flip phone, I can query the weather, I have a couple RSS feeds forwarding, and I can enable/disabl…

you could also use Twilio to build an SMS inbox API and do it without any hardware.

Re: Ask HN: Is there a pure SMS based UI?

#20

Post by robin_reala »

Areibman wrote: post #12
judge2020 wrote: post #8

The main issue with SMS is that it's unencrypted and often intentionally being piped to third party firms for advertising and whatnot, so whatever you do it probably isn't advisable to send anything you wouldn't want people seeing (eg. I wouldn't suggest doing email via it). If you have even the smallest data cap, https://lite.cnn.com can be used for your news and https://mail.google.com/mail/u/0/h/ (/h/ at the end)…

If this is the case, why do so many apps use SMS for 2FA and sending unique links? Are MITM attacks over SMS common?

MITM isn’t common, but the big problem with SMS for 2FA is that mobile numbers are portable. If your number gets ported without your consent then your 2FA codes gets sent to a device you don’t control.[1] NIST stopped recommending SMS 2FA half a decade ago for this reason.[2]

[1] https://en.wikipedia.org/wiki/SIM_swap_scam

[2] https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...

Post reply on HN