Hacker News Reader

Comment by jh00ker | Hacker News Reader

TIL about SMS Delivery Reports and I Googled to learn how to enable them in the native SMS messaging app on my mobile device!

I didn't have time to read the whole doc. Did it say how many SMS Delivery Reports were needed to create the model? I saw this "We repeated the classification for every combination of locations in our dataset, with sample sizes varying from 100 to 500"

I think getting 100 messages from a (series of) unknown number(s) would be alarming, but after reading this, I now know that it's a sign that I need to ... get a new burner phone and increase the size of my security detail? :^)

View on HN

In all seriousness... I've been getting several SMS messages from unknown numbers every day, as well as several 0:02 second empty voicemails every day. I've had my phone number for 17 years, and it's tied to so many things that I don't want to change it. I'm a pretty low value target for someone to be stalking my location with such a sophisticated method. Should I be worried that this is more than just spam?

Just change it.

There are too many (bad) websites that have my number for 2FA, plus my lifelong network of contacts all have that number.

Consider porting the number to something like Google voice or jmp.chat and get a random number you don't care about for your SIM.

It seems that Google Voice numbers can't be used for some 2FA services.

That's possible, but those services most likely offer another form of 2FA. Getting away from using SMS 2FA everywhere you can is best.

I know, but it's not always under my control.

I believe they were silent messages though so I'm not sure you'd notice.

If something can send silent messages, it can probably send my gps location just as easily.

The silent message is sent to your device not from your device

https://en.m.wikipedia.org/wiki/SMS#Silent_SMS

Thank you, misunderstood completely!

If your phone receives a message with certain data fields properly set, the message will be discarded without becoming visible to the user, or the user visible indication may not be obvious (sending a SMS to indicate there are / are not voicemails). If the sender had requested a delivery report and the carrier (and all intermediaries) forwards the message with the delivery report request intact, and the device sends a delivery report in response, and the carrier forwards the delivery report back to the original sender, the sender may be able to infer something from when they receive the delivery report.

This is a feature the Netherlands police actually uses to track phone locations. It’s possible to send a “silent sms” to a handset and by doing so you can discover where the receiving handset is located. This is undetectable by the user of the handset unless they use a rooted device and monitor all incoming sms payloads.

I'm kind of surprised that rooting the device allows the user of the device to become aware. It seems like the sort of thing that the baseband layer would handle without passing anything at all to the main OS. At least for the messages designed for stealth. Obviously the messages meant to influence the UI (like voicemail status) need to make their way to the OS.

I assume from the point of view of the baseband processor these are all messages meant to influence the UI, and the silent messages sent by police are an "abuse" of the feature

Anybody can send corrupt messages that the device won't show; getting your phone to send its GPS coordinates is a part of the GSM standard, but only your operator can send that kind of request (or the cops if they stingray you).

There is a category of sms that won't show up in your inbox. Think of them as messages for your baseband/ system. But they will result in delivery messages. They used to be quite well used in the Nokia era.

I didn't know about Delivery Reports either. Does anyone know why they are not enabled by default (at least with the Google Messages app on Android)?

Because they are extremely unreliable and behave in bizarre and unexpected ways. Phone carriers do all kinds of broken and lazy stuff if they think they can get away with it without their subscribers noticing. Source: I used to work at Twilio, we sent a lot of text messages.

SMSes have confirmed delivery. If the SMSC does not get the confirmation (on lower protocol layer, nothing to with delivery reports) it will send the SMS again. So duplicate delivery is possible. Because there is no unique identfier, the phone cannot eliminate such duplicate.

Delivery reports are best effort. The phone just sends them, but if the reception fails they are lost.

I live in a country with excellent mobile coverage, worked in the GSM industry already in the 1990s and have seen double delivery or missing report only less than a handfull of times in 25 years.

When I travel abroad I'm shocked how bad the network is in some industry countries. Many bizarre things happen as the parent writes, but not only related to SMS.

Edit: Above explanation is shortened. Of course there are always at least 2 hops: Sender to SMSC, SMSC recipient. I guess both hops are either confirmed or best effort. But it's been 28 years since my GSM training...

Other comments suggest that these have nothing to do with settings you find in the app. If so, then my best guess is that a setting in your app by the name "delivery report" is actually just mislabeling some other thing such as "read receipts"...

Reply on news.ycombinator.com