6 ms·

I hope he wins, mainly so cell operators will perhaps take security more seriously. Not long ago, I was with T-Mobile. My username was my phone number, and the

by axaxs 8y ago

I hope he wins, mainly so cell operators will perhaps take security more seriously. Not long ago, I was with T-Mobile. My username was my phone number, and the password, you could request and they'd send it to you in an email. With the climb of social media, our phone numbers are more a part of our identity than ever before, and carriers lack of security is being thrust into the spotlight.

codegeek 8y ago
Are you saying that they will send the password to ANY email if you just provide the phone number ?
- thaumaturgy 8y ago
  I read that as him saying that T-Mobile belongs on http://plaintextoffenders.com/ http://plaintextoffenders.com/
- axaxs 8y ago
  Other poster is correct, sorry if it wasn't clear. Essentially, they were storing passwords either in plaintext or a reversable encryption scheme. Now, this was a few years ago, so I don't know the current setup, but not so far back that not storing plaintext passwords wasn't common knowledge...
wild_preference 8y ago
Exactly. I was able to get into my Verizon account at the store by showing the sales guy my number on my phone. I was moving my number to my non-work billing account. When I was surprised that this is all the authn they needed, the sales guy joked with the rhetorical question “well, you are <my name>, right?” i.e. “well, it ain’t a problem at the moment, right?”
tantalor 8y ago
I hope he loses, so financial services will stop supporting 2FA over SMS. Is that more or less likely than SMS providers fixing their security?
- rubatuga 8y ago
  How about he wins, and then we slowly wean off a more secure SMS system for everybody?
  - aeternus 8y ago
    There are plenty of secure messaging services out there. Making one that works for everyone is not a trivial problem. Suppose you own a coffee shop and offer free wifi, should you be held responsible if someone logs into a bank without SSL and gets their credentials sniffed? Should you be responsible for designing a wifi protocol that uniquely encrypts the traffic of each user, without shared keys, to prevent sniffing?
- ghouse 8y ago
  2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
  - LyndsySimon 8y ago
    SMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
    - tinco 8y ago
      sms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.
slg 8y ago
In my opinion "take security more seriously" is too nebulous to be constructive here. What do we want these companies to do? Security is an incredibly hard problem. It is only exacerbated when we go years without speaking with one of these companies. Anything that you have to remember in that time whether it is a password, pin code, or "who was your childhood hero" type security questions can all be forgotten. How else is this company supposed to identify you over the phone, without something that can be forgotten, without referencing easy to find public information, and without using a secondary verified contact method like email?
- mikeash 8y ago
  Is there an absolute requirement to be able to demonstrate your identity over the phone even if you have no secret information with which to confirm it? How about, if you forget your password and can’t get into your account, you need to visit a store in person to show your ID, or mail in a notarized copy, or something like that?
  - slg 8y ago
    Requiring customers to come to a store would basically exclude anyone from accessing their account outside the retail footprint of the company. That isn't realistic for companies that are trying to provide you a global service like most telecoms. It also introduces plenty of other problems. For example, if you are mugged on the street and lose your phone and wallet are you just frozen out of your mobile account until you can get to the DMV and wait the month until you get a new ID? It is a hard problem that can't just be fixed by "taking it seriously".
    - mikeash 8y ago
      Physical presence wouldn’t be required unless you forgot your credentials. If you are mugged and forgot your password, then you’d be screwed. I’m not sure how reasonable it is to try to make that particular situation better though.
- kodablah 8y ago
redm 8y ago
There are of course two sides to every coin. The flip side is, cell carriers never signed up to be a secure identification mechanism. SMS wasn't designed for security, and there's little financial incentive for them to invest in those changes, i.e., they don't charge you more for secure authorization of 3rd party platforms. I think its very akin to the US Social Security Number being used as a 'secure' identification in many cases. I imagine a world where you go into the cell store, and they demand three forms of identification including a utility bill to talk to you. I can already hear the complaints from a much larger portion of their customer base.
- sdkmvx 8y ago
  I just want a world where you go into a cell store, and they don't tell you they've got a great idea, just make your PIN your birthdate. If they actually took part that seriously, most identification could be done with a PIN or a password or whatever and the serious identification could be reserved for people who've actually forgotten.
- ghaff 8y ago
  Exactly. You can always debate specific security practices. But there's definitely a tradeoff between resistance to social engineering and related attacks on the one hand and convenience on the other hand. You give one example. It also applies when people lose the password for an account, no longer have access to their original or backup email, etc. The most secure thing to do is probably to tell the customer "tough." But that won't go over very well so account recovery practices get put in place that are probably susceptible to social engineering attacks.
  - tonyztan 8y ago
    What if carriers created an "enhanced security mode," which users can opt-in to if they want more security and are okay with sacrificing convenience in case of account recovery? It would be similar to the account recovery aspect of Google's Advanced Protection Program: "A common way that hackers try to access your account is by impersonating you and pretending they have been locked out of your account. To give you the strongest protection against this type of fraudulent account access, Advanced Protection adds extra steps to verify your identity during the account recovery process. If you ever lose access to your account and both of your Security Keys, these added verification requirements will take a few days to restore access to your account."[1] [1] https://landing.google.com/advancedprotection https://landing.google.com/advancedprotection
wowzerz 8y ago
our phone numbers are more a part of our identity than ever before Okay, great idea: phone numbers are the new social security number. Oh but wait, not really. Not when I can set up a prepaid phone for $30. Or three for $90. Or what about office phones and VOIP services that accept text messages on office desktop phones. Or virtual services like twilio, and on and on. Yeah, not really. Phones aren’t quite anyone’s identity at all. Don’t pretend like the world is so beholden to some AOL homepage instagram vanity account, signed up with a free email address.

by axaxs 8y ago

codegeek 8y ago

Are you saying that they will send the password to ANY email if you just provide the phone number ?

thaumaturgy 8y ago
I read that as him saying that T-Mobile belongs on http://plaintextoffenders.com/ http://plaintextoffenders.com/
axaxs 8y ago
Other poster is correct, sorry if it wasn't clear. Essentially, they were storing passwords either in plaintext or a reversable encryption scheme. Now, this was a few years ago, so I don't know the current setup, but not so far back that not storing plaintext passwords wasn't common knowledge...

wild_preference 8y ago

Exactly. I was able to get into my Verizon account at the store by showing the sales guy my number on my phone. I was moving my number to my non-work billing account. When I was surprised that this is all the authn they needed, the sales guy joked with the rhetorical question “well, you are <my name>, right?” i.e. “well, it ain’t a problem at the moment, right?”

tantalor 8y ago

I hope he loses, so financial services will stop supporting 2FA over SMS. Is that more or less likely than SMS providers fixing their security?

rubatuga 8y ago
How about he wins, and then we slowly wean off a more secure SMS system for everybody?
- aeternus 8y ago
  There are plenty of secure messaging services out there. Making one that works for everyone is not a trivial problem. Suppose you own a coffee shop and offer free wifi, should you be held responsible if someone logs into a bank without SSL and gets their credentials sniffed? Should you be responsible for designing a wifi protocol that uniquely encrypts the traffic of each user, without shared keys, to prevent sniffing?
ghouse 8y ago
2FA isn't _this_ problem. It's password resets via SMS that are the problem here.
- LyndsySimon 8y ago
  SMS is 2FA. I'm sure you mean TOTP, but it's an important distinction to make. All 2FA isn't created equal.
  - tinco 8y ago
    sms password resets are not 2fa. 2fa means you have two factors of authentication. If the only thing you need to authenticate is control over a phone number, then that's just one factor. Two factor authentication is when you need both a password and an SMS token, like how GitHub does it. I'm not saying SMS 2fa is strong enough, often passwords are weak and/or weakly guarded, and ostensibly phone numbers can be fidgeted with. But having a phone number be the only thing guarding your entire identity is a whole next level of weak.

slg 8y ago

In my opinion "take security more seriously" is too nebulous to be constructive here. What do we want these companies to do? Security is an incredibly hard problem. It is only exacerbated when we go years without speaking with one of these companies. Anything that you have to remember in that time whether it is a password, pin code, or "who was your childhood hero" type security questions can all be forgotten. How else is this company supposed to identify you over the phone, without something that can be forgotten, without referencing easy to find public information, and without using a secondary verified contact method like email?

mikeash 8y ago
Is there an absolute requirement to be able to demonstrate your identity over the phone even if you have no secret information with which to confirm it? How about, if you forget your password and can’t get into your account, you need to visit a store in person to show your ID, or mail in a notarized copy, or something like that?
- slg 8y ago
  Requiring customers to come to a store would basically exclude anyone from accessing their account outside the retail footprint of the company. That isn't realistic for companies that are trying to provide you a global service like most telecoms. It also introduces plenty of other problems. For example, if you are mugged on the street and lose your phone and wallet are you just frozen out of your mobile account until you can get to the DMV and wait the month until you get a new ID? It is a hard problem that can't just be fixed by "taking it seriously".
  - mikeash 8y ago
    Physical presence wouldn’t be required unless you forgot your credentials. If you are mugged and forgot your password, then you’d be screwed. I’m not sure how reasonable it is to try to make that particular situation better though.
kodablah 8y ago

redm 8y ago

There are of course two sides to every coin. The flip side is, cell carriers never signed up to be a secure identification mechanism. SMS wasn't designed for security, and there's little financial incentive for them to invest in those changes, i.e., they don't charge you more for secure authorization of 3rd party platforms. I think its very akin to the US Social Security Number being used as a 'secure' identification in many cases. I imagine a world where you go into the cell store, and they demand three forms of identification including a utility bill to talk to you. I can already hear the complaints from a much larger portion of their customer base.

sdkmvx 8y ago
I just want a world where you go into a cell store, and they don't tell you they've got a great idea, just make your PIN your birthdate. If they actually took part that seriously, most identification could be done with a PIN or a password or whatever and the serious identification could be reserved for people who've actually forgotten.
ghaff 8y ago
Exactly. You can always debate specific security practices. But there's definitely a tradeoff between resistance to social engineering and related attacks on the one hand and convenience on the other hand. You give one example. It also applies when people lose the password for an account, no longer have access to their original or backup email, etc. The most secure thing to do is probably to tell the customer "tough." But that won't go over very well so account recovery practices get put in place that are probably susceptible to social engineering attacks.
- tonyztan 8y ago
  What if carriers created an "enhanced security mode," which users can opt-in to if they want more security and are okay with sacrificing convenience in case of account recovery? It would be similar to the account recovery aspect of Google's Advanced Protection Program: "A common way that hackers try to access your account is by impersonating you and pretending they have been locked out of your account. To give you the strongest protection against this type of fraudulent account access, Advanced Protection adds extra steps to verify your identity during the account recovery process. If you ever lose access to your account and both of your Security Keys, these added verification requirements will take a few days to restore access to your account."[1] [1] https://landing.google.com/advancedprotection https://landing.google.com/advancedprotection

wowzerz 8y ago

our phone numbers are more a part of our identity than ever before Okay, great idea: phone numbers are the new social security number. Oh but wait, not really. Not when I can set up a prepaid phone for $30. Or three for $90. Or what about office phones and VOIP services that accept text messages on office desktop phones. Or virtual services like twilio, and on and on. Yeah, not really. Phones aren’t quite anyone’s identity at all. Don’t pretend like the world is so beholden to some AOL homepage instagram vanity account, signed up with a free email address.