Vodafone: CallYa Toppings not redeemable

[SecUpwN]

Hi there TextSecure developers, @moxie0 and all you funky freaks of the GitHub community,
let me first say that I still love TextSecure and keep using it until encrypted SMS are vanishing.

Now to the Issue several friends of mine and I do have: For the ones that do not use CallYa Toppings, here is a short explanation: CallYa Toppings is a bonus program for prepaid users, which is offered by Vodafone when recharging the prepaid card. Selectable toppings: Free minutes, free SMS or free surf-flats. The longer a prepaid user is using the same prepaid card from Vodafone, the more Toppings this user will get.

The usual redeeming process is the following:

1. When recharging the card, Vodafone sends an SMS from number 22990 to show available Toppings.
2. (through sending the word AUSWAHL to 22990 a user can change the available Topping)
3. The Prepaid user has to claim the selected Topping with sending the word TOPPING to 22990.
4. Another SMS with a verification of successful claim is being sent to the user from number 22919.

The Issue: When sending TOPPING to 22990, my friends and I just get an SMS from number 22919 that the booking code is "wrong" and that we shall check it and try again. I've been in a huge fight with the Vodafone customer service, called them at least 10 times, have ruined their shops over here in Germany, wrote multiple heavy complaints to them and was really upset - until my girlfriend noticed that this Issue appeared since we've been using TextSecure. To verify this, I've used the standard SMS application - and there it works flawlessly. Through the standard SMS app, Vodafone recognizes the selection and grants it.

Questions: Does TextSecure add special characters to each SMS or modify normal SMS even though sending them unencrypted through the network? Or does Vodafone recognize that I'm using TextSecure and does not want to grant access to the Toppings for users where they can't spy on their SMS?

If there are things to test, data to collect or anything else to resolve this, please let me know.

[moxie0]

On 08/02/2014 10:43 AM, SecUpwN wrote:

Questions: Does TextSecure add special characters to each SMS or
modify normal SMS even though sending them unencrypted through the
network? Or does Vodafone recognize that I'm suing TextSecure and does
not want to grant access to the Toppings for users where they can't spy
on their SMS?

TextSecure adds 13 spaces to the end of every plaintext message. This
is a "whitespace tag" that it uses to advertise the ability to
communicate use encrypted SMS. Another annoying thing we have to do to
support encrypted SMS. =)

• moxie

http://www.thoughtcrime.org

[SecUpwN]

Thanks for chiming in directly, @moxie0. And congrats for hitting my wound spot. 😸
Why does TextSecure have to add 13 spaces to unencrypted SMS? Why no option to turn that off?

[jlund]

Because there's no other way to detect that someone else is a TextSecure user before an encrypted session has started. This whitespace tagging is how that signalling is done.

[SecUpwN]

Interesting. So when a TextSecure user sends out a normal SMS to another TextSecure user without having exchange keys, TextSecure recognizes the use of TextSecure on the other end through these 13 whitespaces. Did I get this right? If so, maybe you can add an option to (temporarily) turn off the signalling?

[bungabunga]

yes, but here is the "keep the settings minimal" rule. such thing is a typical "let's confuse the average user and bloat the menu" option.

[SecUpwN]

@bungabunga, I agree with your point that TextSecure already is a complex tool. But can't we just add a checkbox called "Expert-Mode" within the settings to enable such features as proposed here?

This Issue just states the particular case of my friends and me, but imagine someone who wants to confirm some important booking confirmation like a flight (which is probably very unlikely) or other stuff that has to be confirmed by a certain word or number. What about those cases? Shouldn't the use of TextSecure still provide all the basic SMS functionality? I already see the argument coming that this Issue with the circumstances and problems mentioned in it would be a "perfect reason" to erase the encrypted SMS functionality. But if you really think that way, you're on a wrong path.

In my eyes, an "Expert-Mode" within the settings would make much sense, because many things that are yet confusing to the average chump could be put into this place. When enabling "Expert-Mode", a small warning could be displayed to prompt the user to get familiar with these "dangerous" functions and know what he is doing in the first place. The overall settings of TextSecure could be "cleaned up" that way, too.

[jlund]

In my opinion this would be a colossal waste of time, talent, and energy that is better spent on implementing features that are already important in the present and absolutely critical for the future--features that this horribly outdated and terribly insecure transport layer cannot ever support.

[SecUpwN]

I have the slight feeling that everybody just want encrypted SMS to be gone and that nothing regarding this feature will be improved but rather labeled as a "waste of time". All I would like to do is have a convenient way of sending out certain SMS to confirm things without having to have the creepy standard SMS app.

The first thing I do after having flashed a fresh build of my beloved AOKP is to completely get rid of a bunch of stuff I don't need - including the standard SMS app. And if you tell me now "Hey, why don't you switch the SMS app just to send out this confirmation" I reassure you that this clearly is not the way TextSecure is meant to be. For me, it is my improved and much better replacement for the standard SMS app and I won't keep both. Isn't there some way of getting rid of the whitespace tag, @jlund?

[jlund]

Yes there is: eliminating encrypted SMS.

[moxie0]

@SecUpwN I recommend that you check out the CONTRIBUTING.md file, which outlines some of the ways we're thinking about this project. What you're asking for is in contradiction to rule no. 1, "the answer is not more options," and also rule no. 3 "there are no power users."

As an aside, you might not be able to get rid of the standard SMS app. I don't know about AOKP, but some ROMs require the system SMS app to be present for the system's outgoing SMS provider.

[SecUpwN]

Yes there is: eliminating encrypted SMS.

@jlund, if you want TextSecure to be like any other fucking messenger out there and people stop using it, do so. Let me ask you this: What makes TextSecure unique after erasing encrypted SMS? I don't get it.

@moxie0, thanks for pointing out how to contribute. I will follow along those lines from now on. But truly, not having a way of turning off the whitespace tagging is really a bummer. Wonder why noone complains, filed Issues about this before or contributed code to solve this problem (which is common in Germany).

[bungabunga]

hey, @SecUpwN, i am also very sad to see encrypted SMS feature getting phased out from TextSecure. i agree with most of the arguments why this is still a very important feature and i am using it on a daily basis.

on the other hand, i really respect TextSecure and it's philosophy that is so nicely put in the Development Ideology. i think this is what makes TextSecure standing out among most of the open source privacy apps and makes it usable for the general public. we really need tools for private communication for everybody!! and adding obscure settings that my mother wouldn't understand heads to a different direction. TS developers really need to be strict here. if encrypted SMS feature can't be made following those rules, than let it get phased out. :/

[SecUpwN]

@bungabunga and @moxie0, how about if I submitted a pull request for the discussed possibility of deleting the whitespace tag? Would it be accepted or can you honestly tell that it's "senseless"?

[eisenlaub]

how about detecting if the number is a service number? It's highly unlikely that a service number will process encrypted SMS. Maybe libphonenumber could be useful to detect this.

[SecUpwN]

@eisenlaub, herzlichen Dank für Deine Hilfe! 😺 I think those guys avoid all further work on SMS.

[kuba86]

Just decide if TextSecure is for experts or for average Joe. You refuse to add more advanced options arguing that average user will be confused. On the other hand you expect "average" user to know about whitespace tag and if they want to send service sms they should go to Settings->Wireless & Networks->Default SMS app-> choose stock sms app-> open that app, write, send, and change it all back to TextSecure EVERY time they want to send that special sms...
I really want to convince some friends to switch to TextSecure telling them it is more secure and in the long term decreases cost of sms and that it is a perfect WhatsApp / Facebook messanger / SMS replacement! except that you can't send some sms... My mom tried to send a message to top-up her prepaid card.... she end up taking out SIM card out and put it in her old Motorola RAZR V3 just to send that sms.... When she called me next morning and described her problem I couldn't stop laughing :-P She of course blamed Samsung for the glitch ;-)
Don't get me wrong, I will be using it no matter what, and I convinced my mom, and most of my friends that I frequently sms with (or chat on FB messanger and WhatsApp) but if you really want TextSecure to be used by experts and average Joe I think it is necessary to have options for both groups.
For users who could be confused by more advanced settings use default options and for the rest just have and option menu. It works everywhere else so why you think it will not work in TextSecure? Are Android phones only for experts? look how many options you can adjust! (incl Developer options). Facebook is another example. You don't need to be expert to use it but if you really want you can go to settings and spend there hours adjusting settings to fit your needs. Please do not assume your users are stupid and can't handle some more advanced settings.
I know that time to implement all these options is another issue but don't try to make an app that will be so perfect it will have no options at all... options are good, and users like to have a choice and if they make some changes in settings that will have negative consequences such as decreased privacy such as delivery reports on push messages or disable password to open the app then it is their choice. I am just afraid that TextSecure will end up as "Yo" app but with encryption... Lets face it - having an option to write an message to anyone in the world is extremely dangerous and can cause "average" user to really mess up some stuff ;-)

Solution for service SMS:
Just like you send encrypted messages/SMS to TextSecure users you can hold 'send' button and you get 3 options: TextSecure message, secure SMS, insecure SMS.
When you send SMS to non-TextSecure users and when you hold the 'send' button there could be additional option: Service SMS.
if we want more options then 'MMS message' could be added too since 1 SMS can have up to 160 characters but 1 MMS = no limit... for these users who like to write loooong messages.
Oh! and third option could be "send Yo!" :-P

Please, don't hate me... I really want to be liked.

• Kuba

[SecUpwN]

@kuba86, I very much enjoyed reading your comment - but I'm afraid the internal discussion on how @moxie0 and the other developers are going to throw out SMS in the long run is already decided. I must admit that I very much support your point in adding those menus that pop up when holding the send-button. And if anything like that will ever get added, expeect me to contribute code to TextSecure!

Overall, I like you. You seem to be a smart person - just like we need in our very own security-related project (yes, I'm going to cross-advertise here since no developers seem to be interested of solving this Issue and will most likely just silently close it): The Android IMSI-Catcher Detector - feel free to join us!

[tinloaf]

Not that I have anything to say or was involved with that decision, but throwing out encrypted SMS (not SMS at all) will actually solve this issue: The whitespace-tagging is then not needed anymore and will probably cease to exist. Only one of a truckload of reasons why encrypted SMS is PITA. ;)

[SecUpwN]

@tinloaf, with your above reasoning, TextSecure becomes senseless for me (and most likely others).

[kuba86]

@SecUpwN It's their app and they should do what they want with it. If someone wants to have more options and know how to code they can fork it (maybe some day I will have the skills and time to do it and convince some people to join me) In my opinion throwing SMS support out will cause most users to forget that TextSecure exist and most people will not even install it. It will be used by geeks and people involved in the project.
What I liked about TextSecure is that when you try to convince someone to use it you install it for them, and say to use it just like regular SMS app and that's it! (that is how I convinced most of my friends) they like it and use it! otherwise they just get rid of it after some time or don't use at all.
There are many apps that you can use for secure internet messages but TextSecure is the only one that has many users and can work like iMessage on Apple products.
In my opinion if Apple would release iMessage without SMS integration then it would be as successful as Samsung ChatON... and that what TextSecure will be without SMS support - Another WhatsApp wannabe.
There are only two people that I really need to be sure I can contact securely over internet messages and they are using TextSecure, surespot and ChatSecure with OTR. I can use any of these apps but choose to use TextSecure since I can use it with other people too and not just via push messages but encrypted SMS too since they don't have data plan or are not always online.
From average user point of view when you are looking for secure messenger (no SMS support necessary) which one do you choose? you will probably get votes on all the 3 with advantages and disadvantages on each one. But right now with TextSecure you get something no one else can bring to the table: SMS support!
Are there any good alternatives for encrypted SMS out there? This is the best thing about TextSecure! you get encrypted SMS and push messages!

Example scenario: a lot of people turn off data and WIFI when their battery is low and then they are forced to communicate via SMS. Right now TextSecure is the ONLY solution (that I know of) that gives secure and transparent solution for secure communication via push and SMS in one app. Once you get rid off in-app SMS communication these users are left with no communication or insecure SMS. @moxie0 I hope the SMS support will stay since it is the best feature of TextSecure. Or that CM will release their SMS app in Play Store so other people can use it without CM installed.

[tinloaf]

In my opinion throwing SMS support out will cause most users to forget that TextSecure exist

This will not happen. Encrypted SMS are on their way out.

What I liked about TextSecure is that when you try to convince someone to use it you install it for them, and say to use it just like regular SMS app and that's it!

And you will be able to still do that in the future (if plans don't change). Only that SMS will not be encrypted anymore betwees TS users. Only Push-Messages will be encrypted. Sending unencrypted SMS (i.e. using TS as your SMS app) is not (that I know of) being thrown out. sigh This feels like the 100th time writing this, and this is not what this issue is about, just trying to counter the alarmist "everything is going to be useless" claims..

[kuba86]

@tinloaf Then what is the point to keep unencrypted SMS? oh never mind :-) It's their baby, they know what is best for it. I know they need to get focus on push messages and can't fight with SMS issues. It probably halts app/server/protocol/iOS/RedPhone development. They have a lot on their plates. Hopefully someone will come along and create an app that supports encrypted SMS and push messages all accomplished with TextSecure messaging protocol.
Since I have the opportunity I would like to say thank you to all the people involved in the development of all WhisperSystems projects! great job!!!

[SecUpwN]

@tinloaf, I'm digging this up again since it is still present in the current version of TextSecure. I wonder if there wouldn't be a convenient way to detect if the number the SMS is sent to is actually a service number? I mean, TextSecure is able to warn about the "possible costs" of that SMS, why not take away the spacing at the same time when that detection happens?

[agrajaghh]

This should be fixed soon, since sending encrypted sms will not be possible anymore in the next release

[SecUpwN]

@agrajaghh, awesome! So what was the purpose of TextSecure again? :(
Dudes, I tell ya: You're moving into the wrong direction with that one..

[jeremymasters]

Locked in 3...2...1...