Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[John Levine via mailop]

It appears that Jaroslaw Rafa via mailop  said:
>Dnia  8.01.2023 o godz. 22:29:01 John Levine via mailop pisze:
>> >- The sender can be spoofed. And you don't even have source ips to
>> >check its source.
>> 
>> No, SMS is not like VoIP. People in the phone biz tell me it is
>> extremely hard to fake the source number in SMS. Look at any of the
>> SMS gateway APIs and they all make you jump through hoops verifying
>> the source number before they let you send anything.
>
>Myself I don't know any of these services, but the cybersecurity guys told
>me multiple times that there are a lot of "shady" SMS gateways on the
>Internet that let you easily spoof the senders number, or even put any text
>(like "Google") instead of the senders number. They even demonstrated this
>to me a few times.

Oh, you're in Europe.  Spoofing is a lot harder in the U.S.  The networks
are different.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Graeme Fowler via mailop]

Hi folks

Happy New Year to everyone!

That said: can we, possibly, drag this thread back onto a mail-related topic? 
If anyone from Verizon can answer the OP's question and/or points, that'd be 
grand. If not, please let this one lie.

Thanks

Graeme
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Gellner, Oliver via mailop]

On 2023-01-09 11:19, Jaroslaw Rafa via mailop wrote:
> No, SMS is not like VoIP. People in the phone biz tell me it is
> extremely hard to fake the source number in SMS. Look at any of the
> SMS gateway APIs and they all make you jump through hoops verifying
> the source number before they let you send anything.

> the cybersecurity guys told me multiple times that there are a lot of
> "shady" SMS gateways on the Internet that let you easily spoof the
> senders number, or even put any text (like "Google") instead of the
> senders number. They even demonstrated this to me a few times.

The sender name of a text message can be set/faked similar to the From header 
of an email. Companies use this possibility all the time so that their text 
messages for example show the company name as sender instead of a phone number.
The major difference to emails is that mobile phones usually give you no way to 
see any metadata of text messages and to verify whether the displayed sender is 
genuine or not - short of asking the sender.

--
BR Oliver


dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Jaroslaw Rafa via mailop]

Dnia  8.01.2023 o godz. 22:29:01 John Levine via mailop pisze:
> >- The sender can be spoofed. And you don't even have source ips to
> >check its source.
> 
> No, SMS is not like VoIP. People in the phone biz tell me it is
> extremely hard to fake the source number in SMS. Look at any of the
> SMS gateway APIs and they all make you jump through hoops verifying
> the source number before they let you send anything.

Myself I don't know any of these services, but the cybersecurity guys told
me multiple times that there are a lot of "shady" SMS gateways on the
Internet that let you easily spoof the senders number, or even put any text
(like "Google") instead of the senders number. They even demonstrated this
to me a few times.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Philip Paeps via mailop]

On 2023-01-09 02:21:15 (+0800), Andrew C Aitchison via mailop wrote:

On Sun, 7 Jan 2023, John Levine via mailop wrote:

But more to the point, why do you care? The number of phones these
days that can get SMS but not email rounds to zero, so if someone
wants to send you mail, they can send you mail and don't need to fool
around with a flaky gateway.


At least one of the respondents works for a healthcare provider.
(In the UK) I get SMS reminders of hospital appointments.


This is common in other parts of the world too.  In addition to 
healthcare providers, banks and governments like to use SMS for all 
sorts of notifications.



A push-reminder of an appointment is better than one that drops
silently into my mailbox, and if it makes a noise in my pocket rather
rhan on my desk, also good.


Surely that depends on how many of these you get on a daily basis ... 
and on the fraction of those that are spam. :-)



Once upon a time SMS had a reputation for stronger security and
privacy than email. I don't know how much that reputation was
or is deserved.


The reputation for security is largely based on the belief that SS7 is 
more secure than the internet.


SMS is no more private than email.

Within a given regulatory domain, SMS may be more reliable than email.  
Globally though, not so much.


I think the key value proposition of SMS in 2023 is that it almost 
invariably results in a notification on a mobile handset.  Within a 
given operator (and possibly within a given regulatory domain) SMS is 
more or less instantaneous.  Moreover, unlike email, SMS does not need 
to be configured.  In fact, it usually takes effort to configure a 
mobile telephone to ignore SMS.


The only reason it doesn't get abused more is probably more to do with 
the limitations on content length, and formatting, than with the 
inherent security of the system.


Philip

--
Philip Paeps
Senior Reality Engineer
Alternative Enterprises
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[John Levine via mailop]

It appears that � ngel via mailop  said:
>On 2023-01-08 at 18:21 +, Andrew C Aitchison via mailop wrote:
>> Once upon a time SMS had a reputation for stronger security and
>> privacy than email. I don't know how much that reputation was
>> or is deserved.
>
>Well, a SMS:
>- Is not encrypted at any point
>- Could be dropped with no notification (bounce) to the sender

Right.

>- The sender can be spoofed. And you don't even have source ips to
>check its source.

No, SMS is not like VoIP. People in the phone biz tell me it is
extremely hard to fake the source number in SMS. Look at any of the
SMS gateway APIs and they all make you jump through hoops verifying
the source number before they let you send anything.

>On the other hand, email has drawbacks as well. ...

Uh, yeah, we know.

>I think the reason many providers use SMS reminders for appointments
>(other than inertia) is because that's a lower common denominator.

I think it's because an SMS is more likely to pop up an alert on your phone.

Other than a handful of edge cases, everyone who can get SMS has an email 
address.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Ángel via mailop]

On 2023-01-08 at 18:21 +, Andrew C Aitchison via mailop wrote:
> Once upon a time SMS had a reputation for stronger security and
> privacy than email. I don't know how much that reputation was
> or is deserved.


Well, a SMS:
- Is not encrypted at any point
- Could be dropped with no notification (bounce) to the sender
- The sender can be spoofed. And you don't even have source ips to
check its source.


On the other hand, email has drawbacks as well. It might be "more
secure and private" in case some anti-wiretapping law applies to sms
but not emails.
It might end up being more private in that perhaps your email provider
your reads your emails^W^W^W processes your emails for your benefit but
didn't read your SMS.
Being a separate type of network, it will use quite different systems,
for better or worse.

I think the reason many providers use SMS reminders for appointments
(other than inertia) is because that's a lower common denominator. If
you have a mobile phone, even a dumb one, you are able to receive SMS.
Which is quite different than saying that you will actually *read* them
or *able* to. There are many old people with no email but that have a
mobile phone. Often, they don't know how to read their received SMS,
either.




___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Andrew C Aitchison via mailop]

On Sun, 8 Jan 2023, Andrew C Aitchison via mailop wrote:


On Sun, 7 Jan 2023, John Levine via mailop wrote:


But more to the point, why do you care? The number of phones these
days that can get SMS but not email rounds to zero, so if someone
wants to send you mail, they can send you mail and don't need to fool
around with a flaky gateway.


At least one of the respondents works for a healthcare provider.

(In the UK) I get SMS reminders of hospital appointments.

A push-reminder of an appointment is better than one that drops
silently into my mailbox, and if it makes a noise in my pocket rather
rhan on my desk, also good.

Once upon a time SMS had a reputation for stronger security and
privacy than email. I don't know how much that reputation was
or is deserved.


Oh, and you don't need wifi coverage or have data enabled
to receive SMS messages on your phone.

--
Andrew C. Aitchison  Kendal, UK
   and...@aitchison.me.uk
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Andrew C Aitchison via mailop]

On Sun, 7 Jan 2023, John Levine via mailop wrote:


But more to the point, why do you care? The number of phones these
days that can get SMS but not email rounds to zero, so if someone
wants to send you mail, they can send you mail and don't need to fool
around with a flaky gateway.


At least one of the respondents works for a healthcare provider.

(In the UK) I get SMS reminders of hospital appointments.

A push-reminder of an appointment is better than one that drops
silently into my mailbox, and if it makes a noise in my pocket rather
rhan on my desk, also good.

Once upon a time SMS had a reputation for stronger security and
privacy than email. I don't know how much that reputation was
or is deserved.

--
Andrew C. Aitchison  Kendal, UK
   and...@aitchison.me.uk
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[John Levine via mailop]

It appears that Kevin A. McGrail via mailop  
said:
>I would just point out that the gateway I use is part of my cell service 
>so I don't consider it free but part of the service. ...

Huh? American telcos have offered mail->SMS gateways because, unlike
in the rest of the world, they charge for incoming SMS so it was a way
to do a little traffic pumping. I don't think any of the carriers ever
made any promises about how well it would work, and it should be
obvious to anyone that they always have needed heavy and not
particularly accurate filtering to keep the spam out.

But more to the point, why do you care? The number of phones these
days that can get SMS but not email rounds to zero, so if someone
wants to send you mail, they can send you mail and don't need to fool
around with a flaky gateway.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] [External] Re: verizon email-to-text gateway mail deferred evening and night

[Kevin A. McGrail via mailop]

On 1/6/2023 9:34 PM, John Levine via mailop wrote:

WHen you use someone else's free e-mail gateway, it shouldn't be
surprising that sometimes you only get what you paid for.
I would just point out that the gateway I use is part of my cell service 
so I don't consider it free but part of the service. A failure in that 
service is not something I take lightly and I open complaints with my 
cell provider.  Perhaps others with Verizon are in the same boat but 
haven't consider it that way. -KAM

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop