Three large internet services share the same SMS short code

2 points by biturd 10 years ago | 1 comment

I just noticed, as I add SMS 2-factor authentication to my contacts.app to keep them tidy, that 2-factor authentication, which I am using for Facebook ( only on the web, I was tired of their 300 pound app ) and Yahoo!, as well as eBay, all use the same SMS short code for 2-factor authenticating me.

Is this safe? This is a security feature, so I would assume you would not want other companies using your same short code, unless they were partners, or there was some shared authentication service they are using. Though I don't believe any of the SMS services out there are running low on short codes.

I am not aware of either of these 3 companies being in any form of an alliance. I have no idea who to contact about this, any suggestions?

If you are curious, the short code is 732-873, you may want to search your logs and see if that number shows up for even more companies that just the three I have located so far.

Thanks.

anexprogrammer 10 years ago |

Not uncommon at all.

Chances are the short code is the SMS aggregator or 2FA service they're using. Google turfs up some spam complaints for that number, so it's probably their aggregators standard US shared number. Twilio or whoever.

Most aggregators have a selection of short codes, internationally. Same goes for the more popular SMS enabled services - they'll have a short code shared for all their customers. Now in most countries that 2FA text will have a customer chosen text senderID eg "eBay Authorization" by the service, and short codes saved for when the service needs to handle incoming texts. USA and Canada insist on numeric sender ID so using a short code is more common. Outside the US you never get to know it's a shared aggregator or service, and probably can't reply to it.

Shared codes are common, mainly because of the cost and lack of availability. US is, from memory, somewhere around $1k a month for a random number, potentially quite a bit more if it's a 4 digit or word association. USA and Canada stand out as the difficult/expensive ones globally for SMS.