3 ms·
> AT&T would be at most 50% responsible You could reduce that further by arguing AT&T aren't at fault because third-parties built authentication and identity p
by wp381640 8y ago
> AT&T would be at most 50% responsible
You could reduce that further by arguing AT&T aren't at fault because third-parties built authentication and identity protocols ontop of what was never guaranteed to be a secure or authenticated channel
- bdcravens 8y agoGiven that the NIST published guidance in 2016 recommending it not be used for 2FA, I agree with you. That's why I said "at most" :-)
- s73v3r_ 8y agoAnd then increase it again by arguing that AT&T should never have made it possible for employees to do this.
- evgen 8y agoAnd then diminish it to zero again because yes it should be possible for employees to do that. The economic value for most people of being locked out of your phone number and not being able to easily fix the problem or easily upgrade a phone exceeds the cost imposed when some of those people are morons and assume ability to receive an SMS message sent to a particular phone number is any sort of security factor.
- s73v3r_ 8y ago"And then diminish it to zero again because yes it should be possible for employees to do that." Absolutely not. It never should be possible for a single employee to do that with no checks at all.
- bdcravens 8y agoAccountability yes, but holding them responsible for what their service was used for is a slippery slope.
- s73v3r_ 8y agoI don't think so. Their service was used to steal someone's phone account, which was then used to steal someone's money.