In Iran, your SMS 2FA code isn't a secret from the state.
Every SIM there is bound to a national ID through the Shahkar system before it can be activated. Citizen Lab's 2022 report on Iran's mobile "legal intercept" system describes the regulator wanting direct access to operators, including historical voice, SMS and data records. Since July this year, per Filterwatch, even international access on domestic servers has been gated on Shahkar identity checks.
So when a Farsi speaker sets up "two-factor" on an exchange, email or Telegram with an SMS code, the second factor runs through the same pipe the state reads. Even outside Iran, CISA ranks SMS codes as the weakest form of MFA and tells people to turn SMS off once something better is enrolled.
Today's Farsi tweet on X is just that one line: SMS is the weakest 2FA, use an authenticator app, then switch SMS off.
Question for Nostr: what's the simplest path you'd teach someone on a throttled connection with an Android phone and no Google Play? Aegis (open source) from F-Droid? A FIDO key, if they can even get one shipped? And how do you explain recovery codes to someone who has never seen one, without them screenshotting it into their gallery?
As an Iranian living in El Salvador, I'm building these lessons in Farsi one at a time. Ideas welcome.
Sources: citizenlab.ca/research/uncovering-irans-mobile-legal-intercept-system ; filter.watch (Oct 14, 2026 network report) ; CISA mobile communications best practices (Dec 2024)
zamanibitcoin / زمانی در بیتکوین | Zamani in Bitcoin
npub164…slcny
2026-11-09 06:42:41 UTC
Author Public Key
npub164j6wfwg88m8kha2ksw6xzdjq63zyma8ngnuyl9mqh2za9u2dldqlslcnySeen on
wss://relay.damus.ioPublished at
2026-11-09 06:42:41 UTCEvent JSON
{
"id": "96b8dcf7235563296cbc038bd2cfb02b0b7cc8ccd74b3df0435755d4f8c80694",
"pubkey": "d565a725c839f67b5faab41da309b206a2226fa79a27c27cbb05d42e978a6fda",
"created_at": 1794206561,
"kind": 1,
"tags": [
[
"t",
"iran"
],
[
"t",
"privacy"
],
[
"t",
"bitcoin"
],
[
"t",
"2fa"
]
],
"content": "In Iran, your SMS 2FA code isn't a secret from the state.\n\nEvery SIM there is bound to a national ID through the Shahkar system before it can be activated. Citizen Lab's 2022 report on Iran's mobile \"legal intercept\" system describes the regulator wanting direct access to operators, including historical voice, SMS and data records. Since July this year, per Filterwatch, even international access on domestic servers has been gated on Shahkar identity checks.\n\nSo when a Farsi speaker sets up \"two-factor\" on an exchange, email or Telegram with an SMS code, the second factor runs through the same pipe the state reads. Even outside Iran, CISA ranks SMS codes as the weakest form of MFA and tells people to turn SMS off once something better is enrolled.\n\nToday's Farsi tweet on X is just that one line: SMS is the weakest 2FA, use an authenticator app, then switch SMS off.\n\nQuestion for Nostr: what's the simplest path you'd teach someone on a throttled connection with an Android phone and no Google Play? Aegis (open source) from F-Droid? A FIDO key, if they can even get one shipped? And how do you explain recovery codes to someone who has never seen one, without them screenshotting it into their gallery?\n\nAs an Iranian living in El Salvador, I'm building these lessons in Farsi one at a time. Ideas welcome.\n\nSources: citizenlab.ca/research/uncovering-irans-mobile-legal-intercept-system ; filter.watch (Oct 14, 2026 network report) ; CISA mobile communications best practices (Dec 2024)",
"sig": "831934087cf5a512995c908c3af1c0db30be21bf82b2f867bb878bb422dfd3aef4d3eca532151f7aa79e14a2c2b5f9c08a93a2645626bb182d26eaa01ab5919a"
}