2 ms·

Phone numbers are specifically designed to serve as public identifiers. I don't think you can expect a security mechanism that is supposed to work counter to t

• closeparen 8y ago
  The validation mechanism is control over the phone number, not knowledge of it. Verification by knowledge of numbers intended to remain secret (social security, credit card) is also never okay.
  • jmull 8y ago
    I'm going by the content of the story, which describes acquiring the phone number as the key issue. > After the first hack, Terpin alleged that an impostor was able to get his phone number from an "insider cooperating with the hacker" without an AT&T store employee requiring him to show valid identification or provide a required password. That phone number was later used to access Terpin's cryptocurrency accounts, according to the complaint.
    • closeparen 8y ago
      “Acquiring the phone number” means getting it mapped to the attacker’s phone/SIM card. Overview of SMS hijacking (copy paste link, JWZ doesn’t line HN referrer headers): https://www.jwz.org/blog/2018/07/two-factor-auth-and-sms-hijacking/ https://www.jwz.org/blog/2018/07/two-factor-auth-and-sms-hij...
      • jmull 8y ago
        What you say must be the real story. It's just that the article says, "was able to get his phone number". Getting a phone number, to me, has always had a pretty universal meaning, which is to simply learn its digits. But I suppose you must be right and they actually mean a deeper compromise.