Google is adding and expanding a couple of security-focused features to its Android Messages app from today.
The first of these features is something called “verified SMS,” which involves Google working with “trustworthy” businesses to ensure that text messages they send to customers are clearly labeled as legitimate. This means that when an end user receives a critical communication from a company, such as a one-time password or appointment confirmation, they will know the message is definitely from the company — rather than from a bad actor who may be trying to phish the user or direct them to a spurious website.
Among the partner companies on board for the launch are Kayak, Payback, SoFi, Banco Bradeseco, and 1-800 Flowers, and Google has also opted two of its own services into the program: Google Identity Verification and Google Pay.
The underlying problem this is looking to solve is that when customers normally receive an SMS from a company, there is often nothing to indicate who has sent it, other than a name the company itself provides in the message. With verified SMS, Google essentially confirms that a business is who they say they are. When that business wants to send a customer a message, it creates what Google calls an “unreadable authenticity code,” or a message hash, and sends the code to Google. That code is unique to each message, and Google matches the code to the registered business and displays the business logo with a “verified” icon.
If the codes don’t match, it will trigger a “message could not be verified” alert.
It’s also worth noting that this feature requires an active data connection. So if your phone isn’t connected to mobile internet or Wi-Fi, the app will display the following message: “Waiting for connection to verify sender.”
Google has been working on verified SMS for some time, and the feature first started showing up a few weeks ago in a beta build of the app. From today, it will be rolling out gradually across nine countries: the U.S., the U.K., India, Mexico, Brazil, France, the Philippines, Spain, and Canada. More countries are expected in future.
Elsewhere, Google has launched a real-time spam detection feature in a handful of countries over the past year, and from today it’s landing widely across the U.S.
The feature works by detecting phone numbers that aren’t part of a user’s contacts and warns the user that the message could be spam or contain links to unsafe websites. The company also solicits feedback from the user by asking them to confirm whether a message is spam or not.
This feature could lead to some privacy concerns, given that Google said it temporarily stores the phone numbers of the people and businesses users are conversing with. This only applies when a number is not in a user’s contacts, however, and Google is quick to note that it doesn’t link any of this stored data with the user. And it doesn’t read message content. The FAQ page reads:
This data is not linked to you or to identifiers like your name or phone number, which means Google doesn’t know who you’re messaging. Your message content is not seen or stored by Google as part of this feature. Learn more about reporting spam or blocking a number.
It’s also worth noting that both verified SMS and spam protection are on by default, but the user can deactivate these features from within the app’s settings.
The case for SMS
While internet-based mobile messaging apps such as WhatsApp, Telegram, and iMessage are now generally more popular than SMS in many markets, the humble text message still holds key advantages over messaging apps. Indeed, SMS allows users to send messages to anyone who has a mobile phone number, without requiring a proprietary app, and it also works in areas where internet access may be patchy. According to Statista data, 1.5 trillion messages were sent by SMS in the U.S. alone in 2017.
And companies are continuing to invest in various SMS smarts, including Chinese smartphone company OnePlus, which recently upgraded its SMS app with AI that categorizes messages and displays content as visual cards.
As for Google, it has thrown resources at Rich Communication Services (RCS), a sort of next-gen SMS system that mimics most of the best features of internet-based messaging apps. Google has also sought to make its Messages app smarter via integrations with Google Assistant.
You can't solo security COVID-19 game security report: Learn the latest attack trends in gaming. Access here