Help Read SMS api : Is it a serious security threat ?

[Prasun001]

Dear all,

I was just wondering why android allows app to access the SMS inbox (read sms api) when no other mobile OS allows this due to security compromise issue.

Threat Example : Now a days there are lot of payment app available in the market. Now while making payment through those app ( This process is true for online PC based transaction also)

1. User has to give his user name and password.
2. Then for security measure (Two channel authentication) one "one time password" (OTP) is sent to user's mobile.
3. User has to enter this password in the screen to complete the transaction.

Since in android SMS read access is present, app itself can read the OTP & can complete the transaction. This is a huge security threat according to me because if the app is not intended for good purposem it may make harm to the user.

Once user makes 1st transaction, app will have his user name and password. After that any time the app can make the transaction even without any knowledge of the owner. So two channel authentication is being void in this case. Need attention from all android lover seeks immediate fix for this for sake of security.

Thanks

 

[Hadron]

The API exists because it has legitimate uses. It allows you to have alternative message apps to those provided by the manufacturer, and also allows some apps to use special SMS for particular purposes.

At least that's my take. Of course there are many privileges that can be abused, so you should always consider that possibility when installing any app. But if the payment app was malicious I suspect that your entering the code by hand vs it doing so directly is the least of your worries.

Note that this is an android user forum, and has no connection to the Android development team at Google. So if you want an official answer you will need to contact them (and consider yourself privileged if you get a reply ).