I could send any text message from Indian government IDs • Hacker News Board

Re: I could send any text message from Indian government IDs

#41

Post by garaetjjte » Wed, May 12, 2021, 8:11 PM UTC

>These Sender IDs are reserved by companies and government organisations. Receiving a message from these Sender IDs is meant to be authentic.

No, it's not. Caller ID is not authenticated and shouldn't be depended for anything sensitive.

Re: I could send any text message from Indian government IDs

#42

Post by jaytaylor » Wed, May 12, 2021, 10:31 PM UTC

Archive link, in case there is a takedown: https://archive.is/iKzjh

Re: I could send any text message from Indian government IDs

#43

Post by swiley » Wed, May 12, 2021, 10:54 PM UTC

asaddhamani wrote: post #40

swiley wrote: post #15

Shared secret authentication is pretty much always a bad idea. I'm continually shocked people still use it.

So what is the better option according to you?

Some kind of PKI, probably with an organization wide CA.

Re: I could send any text message from Indian government IDs

#44

Post by tinus_hn » Thu, May 13, 2021, 3:21 PM UTC

ceejayoz wrote: post #13

tinus_hn wrote: post #11

Earlier quoted context omitted.

Brave? Or dumb? Using someone else’s credentials is against the law in most jurisdictions.

Intent tends to matter. I once reported an exposed AWS access key (someone posted it to StackOverflow) to AWS support and they weren't quite sure what to do with it; gave me instructions on how to disable it in the Console, but it wasn't mine. I gave up after a couple rounds and just committed it to Github; their credential monitoring bot disabled it within seconds.

I’m not sure what that anecdote says about the legality of using these keys to authenticate as someone you’re not.

Re: I could send any text message from Indian government IDs

#45

Post by atatatat » Thu, May 13, 2021, 5:39 PM UTC

jaywalk wrote: post #39

atatatat wrote: post #33

Earlier quoted context omitted.

My sibling comment, that's how I've understood the situation to be for well over 20 years. Don't downvote because of some current political situation you think he's commenting on.

Regardless of the current political situation, it's not worth commenting on. That's why you're getting downvoted.

Comments all brought back. Some people disagree with you, there.

That's okay.

Re: I could send any text message from Indian government IDs

#46

Post by ceejayoz » Fri, May 14, 2021, 6:43 PM UTC

tinus_hn wrote: post #44

ceejayoz wrote: post #13

Earlier quoted context omitted.

Intent tends to matter. I once reported an exposed AWS access key (someone posted it to StackOverflow) to AWS support and they weren't quite sure what to do with it; gave me instructions on how to disable it in the Console, but it wasn't mine. I gave up after a couple rounds and just committed it to Github; their credential monitoring bot disabled it within seconds.

I’m not sure what that anecdote says about the legality of using these keys to authenticate as someone you’re not.

I misused someone's credentials with good intent. It's an example of why intent matters, and the CFAA (and lots of other laws) includes wording like "knowingly and with intent to x" in quite a few spots.