Millions of people imperiled through sign-in links sent by SMS

According to Dan Goodin, millions of people are put at risk by sign-in links and codes sent via SMS, with research showing many services still use unencrypted, easily exploitable authentication methods. The study found more than 700 endpoints delivering such texts on behalf of more than 175 services, exposing sensitive data and enabling token guessing or brute-force access in some cases.

Researchers collected 332,000 unique SMS-delivered URLs from 33 million texts sent to over 30,000 phone numbers, noting that 701 endpoints across 177 services could reveal “critical personally identifiable information.” Of those, 125 allowed “mass enumeration of valid URLs due to low entropy,” letting attackers modify tokens to access other accounts. The paper’s authors emphasised that the true scale is likely higher than their limited view, given the information sources and test scope. The findings also highlight that at least 18 of 150 contacted service providers responded, with seven having fixed the vulnerability so far.