US telco is adding VPN ads to Google's 2FA codes

Poignant reminder that SMS is unencrypted and not only readable but writable in between!

Also, it's ironic that they're advertising a VPN through this injected ad. A VPN would do absolutely nothing to help you in this case, since the SMS message would be passed from Google to the telco unencrypted; the VPN wouldn't change the SMS protocol to let Google send you the message directly.

Response from Google [1]:

"To close the loop, these are not Google ads and we do not condone this practice. We are working with the wireless carrier to understand why this happened and ensure it doesn't happen again.

Glad Google Messages flagged it as unsafe"

[1]: https://twitter.com/mrisher/status/1410017611018952704

Why isn't the carrier named? Definitely should be.

He has no problem naming and blaming (incorrectly) Google, but cites privacy reasons for not revealing the name of the carrier. What could be the privacy implications if he revealed the carrier?

If someone was to try and simjack his mobile, they'd immediately know which carrier to try

Depending on the carrier, his personal location could be narrowed down significantly.

Name and shame!

I find it highly ironic Google is complaining of ads injected by web infrastructure.