3 ms·

Pfft, boring stuff. Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address!

goldenkey 9y ago
There was a thread here recently about how it costs 10 bucks to rent out a cellular tower in Malaysia and co-opt a cell phone number as roaming, in order to defeat SMS security 2FA. Experts on HN were saying that the trunk level protocols for cell phone numbers are pretty much worthless when it comes to security. Their conclusion was that: security in this world is so poor that you might as well live with the assumption that there is no real security for public services.
- lotsofpulp 9y ago
  It's ludicrous to me that many services, especially financial, go through the trouble of setting up SMS 2 factor, but not TOTP.
  - gm-conspiracy 9y ago
    I have a friend that was at the beach with her husband, and she had taken her phone with her, but her husband left his in the car. Thieves had used a jammer/replay device to unlock their car, remove her husband's phone from his Otterbox case, take his SIM card, reassemble the phone, and steal several credit cards from his wallet (also in the car). Within the hour, my friend began receiving fraud alerts. If she had not taken her phone with her, they would not have known for quite a few hours, at least.
- fyfy18 9y ago
  Do you have happen to have a link?
  - exikyut 9y ago
    https://hn.algolia.com/?query=tower%20malaysia&sort=byPopularity&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=tower%20malaysia&sort=byPopula...
  - goldenkey 9y ago
    I think this was it: https://news.ycombinator.com/item?id=16771649 https://news.ycombinator.com/item?id=16771649
BlackLotus89 9y ago
> Making matters worse, if you then pay the bill on someone else's account, the system prompts you to add yourself as an authorized user and requests the callers phone number, potentially granting them full access to your account. Uhm yeah sure boring stuff. Can I have your phone number?
amelius 9y ago
> Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address! IP address? Really?
- ryanlol 9y ago
  Yes, really. Of course they are nice enough to support multiple methods of searching for accounts, so you aren’t restricted to just looking up by IP addresses.
MobutuPehuenche 9y ago
That's not amenable to bulk, automated harvesting however, unless you've compromised their internal network.

goldenkey 9y ago

There was a thread here recently about how it costs 10 bucks to rent out a cellular tower in Malaysia and co-opt a cell phone number as roaming, in order to defeat SMS security 2FA. Experts on HN were saying that the trunk level protocols for cell phone numbers are pretty much worthless when it comes to security. Their conclusion was that: security in this world is so poor that you might as well live with the assumption that there is no real security for public services.

lotsofpulp 9y ago
It's ludicrous to me that many services, especially financial, go through the trouble of setting up SMS 2 factor, but not TOTP.
- gm-conspiracy 9y ago
  I have a friend that was at the beach with her husband, and she had taken her phone with her, but her husband left his in the car. Thieves had used a jammer/replay device to unlock their car, remove her husband's phone from his Otterbox case, take his SIM card, reassemble the phone, and steal several credit cards from his wallet (also in the car). Within the hour, my friend began receiving fraud alerts. If she had not taken her phone with her, they would not have known for quite a few hours, at least.
fyfy18 9y ago
Do you have happen to have a link?
- exikyut 9y ago
  https://hn.algolia.com/?query=tower%20malaysia&sort=byPopularity&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=tower%20malaysia&sort=byPopula...
- goldenkey 9y ago
  I think this was it: https://news.ycombinator.com/item?id=16771649 https://news.ycombinator.com/item?id=16771649

BlackLotus89 9y ago

> Making matters worse, if you then pay the bill on someone else's account, the system prompts you to add yourself as an authorized user and requests the callers phone number, potentially granting them full access to your account. Uhm yeah sure boring stuff. Can I have your phone number?

amelius 9y ago

> Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address! IP address? Really?

ryanlol 9y ago
Yes, really. Of course they are nice enough to support multiple methods of searching for accounts, so you aren’t restricted to just looking up by IP addresses.

MobutuPehuenche 9y ago

That's not amenable to bulk, automated harvesting however, unless you've compromised their internal network.