Hacker News Reader

Comment by lstamour | Hacker News Reader

It looks like Flash SMS is handled differently.

Here’s a post from 2020 on the differences within Android to handle flash SMS: https://github.com/moezbhatti/qksms/issues/1536#issuecomment...

Here’s an app, pre-4.3, for sending Flash SMS: https://github.com/romankh/gat-app

There appear to be a couple online services that will let you send Flash SMS (Type 0) but Twilio is not one of them.

Edit: The terminology is confusing! I wrote “type 0” above when in fact it’s a “class 0” sms. Type 0 means a silent SMS, Class 0 means an SMS that’s display-only and not stored. See also https://www.contextis.com/en/blog/binary-sms-the-old-backdoo... for a brief overview, though I’m sure there are other, better sources.

View on HN

What a nasty thing! Seems there's no other way but using dedicated hardware.

BankID also needs to be tied to a specific SIM, so I suspect that they somehow store and validate SIM ID and IMEI on the other side.

Could also be that they install an applet on the SIM. This might also explain why eSIMs don't work.

That's rather the point of BankID. It helps prevent things like SIM jacking. Much more secure than using ordinary texts for 2FA.

Wallet/Banking apps in India incl. Google Pay requires the mobile number on the phone to match the bank records due to central bank regulations, I assume IMEI verification happens behind the scenes with direct telecom API.

Wallet apps sends outgoing SMS randomly to verify this. Suddenly my wallet apps stopped functioning as SMS couldn't be sent and I presumed I had messed up with telephony services with some security settings and was searching radio logs to find the culprit where I found that SMS validity was nil.

Searching further I found that our telecom oligopoly (soon to be duopoly) decided to remove outgoing SMS from low-tier plans. I don't do real-time communication, telephony services are only useful to me for receiving the 2FA OTP and so I had low tier plans. Goodbye wallet apps.

Which online services were you able to find that allows changing class type?

I believe I have used some in the past. Possibly via http://fortytwo.com in an earlier incarnation (way before twilio existed). You can ask around for 'raw SMS PDU' support. You can safely claim it is for 'custom character set' (non UCS-2) usage. This is reasonable to use for developing markets where local pre-unicode character sets allow greater information density in a single message.

IIRC you can grab inbound Flash SMS from at least some devices using AT commands the same way you'd grab regular SMS. They won't show up in native messaging apps, however.

Yeah, unfortunately I haven't been able to find any current providers that allow sending raw PDU packets. I'd love to get away from using dedicated hardware + local SIM card.

Reply on news.ycombinator.com