[liberationtech] Receiving phone verification and 2-Step Verification codes through a 'number inside Iran'

[Bernard Tyers]

Geographical numbers (i.e. the number which an SMS is sent from) can be purchased by a telecoms company, e.g. an SMS gateway supplier, relatively easily.

It does not necessarily mean the message is sent from a company within Iran. 

Once the message is delivered to the Iranian telco, then thats a different matter.




> On 16 Jan 2015, at 17:44, Amin Sabeti <aminsabeti at gmail.com> wrote:
> 
> Google has sent its codes via SMS with Iranian number since 6 months ago.
> 
> On 16 January 2015 at 17:39, Collin Anderson <collin at averysmallbird.com> wrote:
> 
> On Fri, Jan 16, 2015 at 12:10 PM, elham gheytanchi <elhamucla at hotmail.com> wrote:
> I think it means the codes are generated by the state agencies.
> 
> They are not, the international companies would contract with an SMS gateway to send codes. That SMS gateway should be a more or less a dumb pipe that transmits whatever it is sent by the provider. It so happens that now the pipe is closer to the user but the source stays the same. The SMS gateway and telecommunications companies can certainly surveil or modify the content (the latter wouldn't be useful for 2FA), but it should not generate the codes.
> 
> 
> -- 
> Collin David Anderson
> averysmallbird.com | @cda | Washington, D.C.
> 
> --
> Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys at stanford.edu.
> 
> -- 
> Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys at stanford.edu.