A Hacker News 'Ask HN' post asks the community how they convinced non-technical family and friends to switch from SMS/WhatsApp to self-hosted XMPP or Matrix servers. The poster, a developer who tested self-hosting both protocols for a week, says the client UX felt worse than expected and found no app offering a simple SMS-like replacement. They note the main practical selling point is more consistent cross-platform messaging compared to SMS's degraded experience between iOS and Android users.
news.ycombinator.com
· 2026-11-07
Following the April 2026 arrest of three men in Canada for running a fake-tower 'SMS blaster' used to send phishing texts, BleepingComputer detailed how such devices and related IMSI catchers exploit phones' tendency to connect to the strongest signal before authentication occurs. This lets attackers capture a phone's IMSI (tied to the SIM) and IMEI (tied to the device), identifiers that largely remain constant and, on older 2G/3G and even initial 4G connections, can be transmitted in plaintext.
bleepingcomputer.com
· 2026-11-06
Security researcher Mark Blah released a working exploit for a zero-click Android vulnerability that lets attackers crash phones or disrupt cellular service by sending a single malformed eight-byte WAP Push message over SMS. The bug stems from unchecked header-length parsing in Android's WapPushOverSms.decodeWapPdu function, which triggers a crash in the com.android.phone process and can drop active calls, including emergency calls. Google patched the issue for Android 14 through 17 in its October 2026 update, though it wasn't listed in the public bulletin, leaving Android 12 and 13 devices unprotected.
bleepingcomputer.com
· 2026-10-31
Security researcher Mark Blaszczyk disclosed an Android vulnerability in which a specially crafted text message never appears in the inbox but crashes the phone's call-handling service, dropping active calls including those to emergency services. Repeated delivery of the message—around 20 texts, according to Blaszczyk—can push a device into a persistent reboot loop that even a factory reset may not fix if the carrier keeps resending it. Google reportedly developed a fix months before the public disclosure, but it is unclear when the patch will reach users.
androidauthority.com
· 2026-10-30
Telecom signaling protocols SS7 and Diameter, used for carrier-to-carrier routing since the 1970s and 1990s respectively, can be exploited to locate phones, intercept SMS two-factor codes, and impersonate numbers without malware or phishing. The report notes these flaws were reportedly used by Iranian-linked actors to locate US personnel during the Iran war, and were previously demonstrated publicly when YouTuber Veritasium hijacked a tech influencer's calls and texts using only his phone number.
bleepingcomputer.com
· 2026-10-30
A Reddit user says they installed Garmin Messenger on a second phone, entered their existing number, verified it via SMS, and saw their full conversation history reappear without entering a Garmin account password. The second device then began sending and receiving messages, with no apparent way to view or disconnect other active sessions. Garmin has reportedly been notified but has not confirmed any fix.
androidauthority.com
· 2026-10-29
Researcher Mark Blaszczyk disclosed a flaw in Android's telephony stack where a malformed WAP Push SMS causes an unchecked integer cast to produce a negative array size, triggering an uncaught exception that kills the com.android.phone process. The crash requires no interaction from the recipient and can terminate active calls, including emergency calls. Google classified the report as non-security and marked it won't fix, so no CVE was issued despite the 90-day disclosure window elapsing.
smsofdeath.com
· 2026-10-29
Microsoft has repeated its call for Entra ID administrators to move workforce tenant users off SMS and voice-based authentication before it discontinues Microsoft-provided versions of these methods on February 1, 2027. The change affects only Entra ID workforce tenants, not Azure AD B2C or Entra External ID customer scenarios, and admins can shift users to passkeys, QR code sign-in, FIDO2 keys or other supported options, or keep phone-based login by configuring a third-party telecom provider.
bleepingcomputer.com
· 2026-10-28
An Android Authority writer switched from Google Messages to QUIK, an open-source SMS app descended from the discontinued QKSMS, after growing frustrated with Google Messages' rigid spam filter. The writer says Google Messages often misflags legitimate texts from banks and carriers as spam while letting real scam messages through, with no settings to adjust the behavior. QUIK, available via F-Droid, is described as a basic but functional SMS-only app without RCS support.
androidauthority.com
· 2026-10-25
Code strings found in a new Google Messages beta build indicate the app will remove the ability to turn off RCS for individual conversations, forcing users back to SMS/MMS only on a conversation-by-conversation basis. The strings show an in-app banner warning that the 'Only send SMS & MMS messages' setting is going away, offering users the choice to switch to RCS now or have it switched automatically.
androidauthority.com
· 2026-10-06
Google has acknowledged a bug affecting a subset of Google Messages users that disrupts delivery of RCS messages, particularly media attachments like GIFs and photos. A company spokesperson told Android Authority that a fix is already being rolled out and will reach all affected users over the coming weeks.
androidauthority.com
· 2026-10-02
Microsoft has told IT administrators to move Entra ID users off SMS and voice-based first-factor sign-in before it shuts the option down in February 2027. Alternatives include passkeys, QR code authentication, and FIDO2 security keys, and the change applies even to organizations using their own telephony providers for multifactor authentication. The retirement covers only workforce tenant scenarios, not customer identity products like Entra External ID.
bleepingcomputer.com
· 2026-09-21
GoKawiil