11 ms·

Phone Numbers Were Never Meant as ID. Now We’re All at Risk

245 points by colinprince 8y ago

tehlike 8y ago
SSNs were never meant as ID. Now we are all at risk.
simmons 8y ago
Bootstrapping identity is a very hard problem, and implementors can't resist the easy path of piggy-backing on someone else's identity or authentication system -- social security numbers, email addresses, telephone numbers, etc. AT&T is being sued by someone who lost $24M in cryptocurrency because someone decided to piggy-back authentication on AT&T. While AT&T should certainly be called out for having sloppy security, I can't help but feel that they never really signed up for the job of protecting such a valuable asset. It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open.
- kurthr 8y ago
  They gave their employee the ability to bypass the security PIN code locking the account. If they hadn't touted it as account security, their case would probably be better.
- supertrope 8y ago
  This is fundamentally a regulatory and economic problem. The exact challenge-response flow and physical artifacts/electronic credentials we use to assert identity and request access with change over time. Businesses are only motivated to prevent fraud if they will be liable for losses. They have managed to label it "identity theft," as if you forgot to lock up your bicycle, and give ironic post-breach advice to their customers like installing anti-virus software and not surrendering information to unsolicited callers. Incentives need to be aligned. The Trump Administration cancelled the investigation into Equifax. Target's stock price barely budged. Regulations may not be a panacea as the OPM breach suggests. "Cyber insurance" is an interesting market. Ideally insurers would require best practices to be followed for policy issuance and claim payout. But that can lead to compliance box checking, and litigation/coverage struggles instead of actual security.
  - samatman 8y ago
    What you say about Target's stock price is true, but markets exist to price assets, not to punish malefactors. What this shows is that the market decided losing a ton of data wouldn't affect Target's bottom line; this supports your point about incentives but is itself not something in need of adjustment. The market is literally signaling that losing customer data isn't going to cost a company anything.
  - pitaj 8y ago
    I think we'd probably all be using private/decentralized identity systems if it wasn't for KYC/AML regulations. The problem is that decentralized and some private identity systems are all "vulnerable" to pseudonymization, so it make KYC/AML impossible.
- mindslight 8y ago
  As it should remain! The fundamental problem is this concept of "identity" is a bundled abstraction that is being used in order to ignore every way in which scaling to the Internet is intrinsically difficult. Because sitting down face-to-face with someone yesteryear was completely and totally safe, so if only we can replicate that and "know" the other person, then all of these newfangled problems will just disappear! This is a partial list of actual problems "identity" is purporting to solve and an example of someone heavily relying on it: user-device security (Coinbase), cross-medium access (banks), Sybil problem (Google / IRS), persistent tracking (commercial surveillance), offline transactions (healthcare industry). Each one of these is an area of research unto itself, but yet "identity" is going to solve all of them together! Really, it is just a crutch that allows organizations to pretend to have solved the issues, and then act entitled when their "solution" falls apart. After having architected their systems as if their identifiers are entirely reliable, any action purporting to have been done by you is then your mess to clean up! Because "your" identity was "stolen", see? Problem solved! This article ultimately seems like a submarine for the industry consortium of the week. The primary reason a "good" identity system hasn't taken off is that the main thing demanded by users is to create arbitrary unlinkable nyms. Meanwhile these backwards-thinking organizations are looking to "identity" mainly to prevent people from doing just that!
  - closeparen 8y ago
    The main thing demanded by users is cheap credit, which is diametrically opposed to a system designed to optimize the ease of fraud, as you suggest. Use all the scare quotes you want. You are one person, not several, and are accountable for your actions regardless of which pseudonym you wish to present them under.
    - mindslight 8y ago
      Only two of the five aspects I listed involve credit. And I'm pretty sure at this point people would be much happier getting healthcare without implicit credit, and thus not end up receiving kilodollar nastygrams in the mail for months afterwards. There are plenty of contexts for which there is nothing to be "accountable" for - I would say most general Internet use. And sure, it's possible to disagree reasonably about this, perhaps asserting that you only want to read comments that are policed by some authority. But it is an explicit tradeoff, not merely implicit that we should live in a world without some absolute privacy. There are plenty of current reliances on "identity" that don't pass the smell test - for example the seemingly common flow of setting up online banking by going home, going to a website, and entering in your public identifiers. In the context of a brick and mortar bank, this is utterly backwards! Describing an identity system based on nyms as having been "designed to optimize the ease of fraud" is utterly disingenuous. Fraud requires the other party to buy in to assumptions which are then invalidated. Most uses of identity, say online user accounts, don't need to carry such strong assertions in the first place. Also, highlighting that a term carries a loaded defintion is not using "scare quotes".
- kalleboo 8y ago
  I'm surprised a company that already has a lot of personal info like Equifax hasn't stepped up and created an online ID system (like how you have DUNS numbers for businesses). As a counter-example, Sweden has national personal ID number system where everyone is assigned a number at birth. This is fine as a primary key in databases but it's not exactly a secret so can't be used to authenticate someone. The banks stepped up to this challenge and created a common digital signature system called "BankID" where you get either a certificate/private key file (PC) or app (mobile). BankID is used for online filing of taxes, filing change of address, signing up for stuff like insurance, anything that traditionally would require a physical signature. ID verification is done by bank branches when you sign up for internet banking.
  - Coding_Cat 8y ago
    >everyone is assigned a number at birth. Nitpicking (but what do you expect with a board that's majority programmers): only people born Swedish get one at birth. I got mine at age 23 when I studied there :) It still used my dob though.
  - roywiggins 8y ago
    They have tried! Equifax has a service where you can pay them to verify your users' identities by quizzing them on their credit history. That said, given the equifax breach, I literally can't think of someone I'd trust less to handle it.
    - nhf 8y ago
      This is a specific instance of a more general service called dynamic knowledge-based authentication (dynamic KBA).
    - hakfoo 8y ago
      I recently signed into a medical-related service that used a verification system like this. They asked three questions. All of which were multiple choice and populated with a lot of obvious wrong answers. Two of them were the year and model of a car I (no longer) leased, and one was a direct "what county do you live in?" which is trivial from the address. If you physically drove by my house any time when the garage door was open in the last three years, you had a decent chance of knowing the right answers. If you had access to the DMV records, you had the right answers. And on the flip side, I hate to imagine how this would have worked for, say, a scholarship student at age 20 with no credit file. Enjoy reading my lab test results. I feel so secure.
- solatic 8y ago
  > Bootstrapping identity is a very hard problem Oh come on. Bootstrapping <anything> is hard. Identity isn't special. When bootstrapping, you base initial migration work off of existing systems, until you reach critical mass and the adaptation on top of existing systems are no longer relevant or necessary. You might as well argue that passports are worthless because it's not that theoretically difficult to fake the foundations of identity to a good enough level in order to get a genuine passport. As long as passports are unique-enough (no two people are identified by the same passport), they're good enough. And so is any other system which succeeds at consistently identifying the same person.
- jedberg 8y ago
  > It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open. Well in this particular case, it's like protecting it with a consumer grade padlock, and then having someone who works for the padlock company give the thief a key to the lock. The reason he's suing is because AT&t failed to follow their own protocols for identifying the customer.
toast0 8y ago
Tieing 2fa directly to the phone is much better than tieing it to a phone number, until you don't control your phone. Then, how do you recover? You can't go down to the local Google (or whoever) kiosk, prove your identity, and get a new device added to 2fa, but you can get a new sim (downside, so can pretty much any carrier kiosk employee, or social engineer). Also, phone numbers are pretty useful for contacting people, and most people have an address book with their friends and family and other important contacts. There's tremendous social value for people in those numbers continuing to work, to the extent possible. You're never going to be able to tell everyone who might want to know when your number changes, especially if you for a new number when yours was assigned to someone else.
- madengr 8y ago
  Years ago, I had to physically show up at Verisign to get my domain changed. It was locked to an email address I no longer had. What a cluster that was.
  - torstenvl 8y ago
    That's exactly how it should work, though.
    - kodablah 8y ago
      In theory. In reality, people will sacrifice security for simplicity in these situations thereby financially incentivizing the opposite of "how it should work".
    - madengr 8y ago
      The problem is that I live in KS and Verisign was in VA. I only went in person since I was visiting home. Went several weeks without a working domain.
- jt2190 8y ago
  > Tieing 2fa directly to the phone is much better than tieing it to a phone number, until you don't control your phone. This is worse. (edit: i.e. easier for the attacker since they don't need physical access to your device.) You still control your phone, but the attacker takes your phone number.
mschuster91 8y ago
Well, Germany could have provided a (relatively) easy solution with the new (ah well, 10 years old by now) Personalausweis identity cards - they're RFID capable and contain crypto functions. Actually, there is a solution for using them to sign stuff - but it's proprietary in any case, and requires expensive certificates.
- gsich 8y ago
  Not everyone has a Personalausweis.
  - mschuster91 8y ago
    Nearly all Germans do have one (yes, I know, having a passport is sufficient... but, anecdata, never met anyone with only a passport), and iirc the Elektronischer Aufenthaltstitel required for non-German residents of Germany has the same functions. It's a perfect model of "the tech would be there but government is incompetent/corrupt and so it is not freely available for the benefit of citizens".
deleted 8y ago
[deleted]
jt2190 8y ago
tl;dr > The use of phone numbers as both lock and key has led to the rise, in recent years, of so-called SIM swapping attacks, in which an attacker steals your phone number. When you add two-factor authentication to an account and receive your codes through SMS texts, they go to the attacker instead, along with any calls and texts intended for the victim. Sometimes attackers even use inside sources at carriers who will transfer numbers for them.
aviv 8y ago
I repeat this on related threads: taking over any US phone number's inbound/outbound SMS traffic with the ability to intercept inbound SMS as well as send SMS originating from a particular number is dangerously easy. It takes one minute, and ALL numbers are vulnerable. Worse, there is no fix for this. Never ever use SMS for authentication, or sensitive communication of any kind. I believe this is being exploited on a regular basis and people just have no clue. This is likely used for anything from gaining access to email accounts to insider trading to political leverage to who the heck knows what else.
- scient 8y ago
  There are a couple of vendors out there who at least try to detect SIM swapping and traffic hijacking. It's better than nothing and eliminates the simplest attacks, but still has it flaws, including happy path case support (like only working on the network and needing a smart phone).
11thEarlOfMar 8y ago
We're seeing more biometric authentication with fingerprints, face recognition, perhaps retina scan. How do these methods perform in practice, considering both their contribution to security and their practical application? I currently authenticate on my iPhone with fingerprint. How hard is that to crack? If you had the victim's fingerprint, it's apparently trivial [1]. But accessing my fingerprint is not something that a random hacker/thief on the Internet would reasonably be able to do. Since our phones are becoming our life-key. Would a 3-factor authentication sufficiently protect us? Something you have: SmartPhone. Something you know: Password. Unique part of you: Fingerprint. [1] https://www.businessinsider.com/fingerprint-hacked-smartphones-2016-3 https://www.businessinsider.com/fingerprint-hacked-smartphon...
- 3pt14159 8y ago
  Fingerprints are so fucking dumb. You can't change them and you leave them everywhere! They're good against stopping your nosy family members from seeing your password, but what am I supposed to do when dining or paying someone? Wear gloves? If the cybersec game turns into "collect physical fingerprints" then the gangs are going to collect physical fingerprints and then what? What we need is something dynamic that's hard to fake, like a human voice or face, tied to a government issued cryptographic device with no input ports / volatile memory / inbound network adapter. You say a challenge sentence out loud. The device validates. Then the device signs or authenticates or whatever. For integrity it could optionally encrypt and broadcast what happened. You lose the device, you get a new one just like you get a passport. In person with other documents, etc. This really isn't that hard. We could have done it decades ago.
  - gregknicholson 8y ago
    > government issued cryptographic device I don't trust my government to be competent at cryptography. Some people don't trust their government to be non-malicious.
    - smnrchrds 8y ago
      > I don't trust my government to be competent at cryptography. Which government is it? If it is the US, you might as well not trust any cryptographic schemes, considering how many of them were developed by NSA.
gonmf 8y ago
We should more than ever be teaching everyone not to use their real name on the internet, not to give out their phone number or private email address. In the internet and for businesses for advertising or any other avoidable purpose. This would eventually prevent the assumption that everybody has a phone number that can be used as authentication, or even worse, a Facebook account!
wtmt 8y ago
> But the United States doesn't offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise. Oh, please! No! No! No! India bulldozed a national identification number (called Aadhaar) on its residents and it has made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement. As with things related to government, the governing organization for Aadhaar, called UIDAI, always claims that it’s completely secure, while ignoring the fact that linking one number to everything in one’s life increases the attack surface and the severity of the threats. So please research on the number of ways Aadhaar has failed, and is making some feeble attempts to recover, before getting into a “let’s create a new static number to identify people with instead of a phone number or SSN”. That’d just be changing the narrative without achieving anything. Bottom line, it’s not the phone number that’s the problem, but having a unique and non-changing number and linking it to everything else (including one’s phone numbers).
- addicted 8y ago
  Can you share some starting points to research it?
  - davchana 8y ago
    The law which implemented this ID, says, nobody can use it to malign purpose; The authority is found to use this clause against anybody who wrote about its flaws. The law also says that only Authority can disable this ID, anytime. So once somebody's ID is dead, they suffer civil death. No job, hospital, travel, mobile, taxes. Every week they switch from ID number is secret: ID number is not secret. This number can not be changed even for a person. To keep it safe, they introduced a virtual ID number, which, again is permanent for one's life.
  - wtmt 8y ago
    Here are a few things to start looking at (the amount of information could be overwhelming): * https://www.rethinkaadhaar.in https://www.rethinkaadhaar.in * https://twitter.com/no2uid https://twitter.com/no2uid * Search for #AadhaarFail on Twitter * Search for “Aadhaar frauds” on DuckDuckGo or your favorite search engine
jkingsbery 8y ago
I implemented number porting for a startup I worked for. It's all pretty scary: yes, it's easy to impersonate someone if you have some information about them, but some carriers don't check any sort of porting pin at all. That is, attackers sometimes do not need to impersonate you, they just have to ask for your number. It would be great if we all had something big more secure, but in the meantime understand your carrier's port out process and that you have your number secured.
twblalock 8y ago
Phone numbers are obviously flawed as identifiers, but so are social security numbers, drivers license numbers, etc. If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number? Biometric data can be replicated, e.g. fake fingerprints and synthesized voices. Good facial recognition is still a step ahead of scammers but they may catch up at some point. And you can't easily change your biometric data if someone manages to make a copy. At this point everyone knows passwords by themselves are not good enough. Physical tokens like Yubikeys can be stolen, although that's clearly more difficult than stealing some of these other identifiers. If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned? So, I find it difficult to blame companies for using phone numbers as identifiers -- it's easy, and all of the alternatives are also flawed. I haven't seen any foolproof identifier, probably because it's not possible to create one.
- Avamander 8y ago
  > how would they keep it secure without resorting to one of the flawed systems I just mentioned? It's small, hard to exploit flaws vs. large easy to exploit flaws. > If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned? Physical smartcard/smart SIM/phone. You have to steal something physical + get the PIN. Definitely possible, but really hard and if that gets lost you have to go to the Police, get yourself re-identified and get a new card. Compared what bullshit of an identifier a phone number is Estonian system is miles ahead.
- solatic 8y ago
  > If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number Everyone gets a national ID number. This number is considered public and is used for signing up for public and private services. Everyone gets a ID card, issued by the government. This ID card holds a private key, used to enter legally-binding agreements, and the card is printed with the photo of the holder. Attempts to use the card to authorize purchases online redirect to a government-managed identity provider (think SAML 2.0), where the user must provide either a password (preferable) or, if there is no password, some other knowledge proof that is not discernible from the physical ID card, either of which were set up when the card was issued. When people become incapacitated for publicly-known reasons (incarceration, hospitalization, etc.), their public certificates are temporarily added to a revocation list. When issued, the card comes with three one-time-use secret codes, each of which triggers a 24-hour temporary revocation, which must be kept secret-enough to prevent abuse. Obtaining more temporary revocation codes, or permanent revocation (in case of loss or theft), or password/knowledge proof reset without the previous password/knowledge proof, is handled in physically secure government facilities, by providing DNA and other biometrics, that were registered when the card was issued and are not used for any other purpose. Corruption is combated at the DNA-collection stage by requiring the secure facilities to actually collect fresh physical samples each time - this constitutes a biological sort of paper trail for auditing revocation requests. No, it's not impossible to game the system. People can be bribed to overlook the photo; DNA can be stolen and used to continually permanently-revoke victims. Paper trails are not magic cure-alls. There are serious ethical concerns with entrusting the government with a populace's DNA (particularly, the potential to re-index it for the purposes of ethnic cleansing). And yet, when compared to modern-day systems, I'm hard-pressed to complain. If you ask, quite simply, which is better, the system proposed above or the contemporary system, one or the other, I have a hard time imagining people defending the contemporary system.
heinrichf 8y ago
Never meant for identification purposes, just like social security numbers: https://www.npr.org/templates/transcript/transcript.php?storyId=593603674 https://www.npr.org/templates/transcript/transcript.php?stor... (interesting Planet Money episode on the history of the SSN)
nkkollaw 8y ago
So, do phone numbers get recycled? For instance, if I change phone company and decide not to keep the number or they're unable to transfer it, can it be assigned to someone else?
- kickling 8y ago
  Happened to my number at least (I live in Sweden). A person sent me a text message saying he had my previous number and that he got frequent calls from my friends.
  - nkkollaw 8y ago
    Jesus... Yes, this is NOT good, considering the number of services that you can log in into with just a SMS confirmation (my bank, for instance).
Spooky23 8y ago
The US absolutely offers universal id, it’s just federated. All states will have common identity standards shortly (all but 2-3 do today). There’s a parallel system through the various passport and trusted traveler schemes that are controlled by the US government directly as well.
ggm 8y ago
My UK NI number is burned into my brain. It might be because it was given to me at a highly emotional time (transition from school to unemployment and university) or because I had to know it to complete forms (UB-40 and P-45 employment status). From thirty years distance, trying to re-connect to my UK pension rights, as a non-resident migrant, it floated back up into my consciousness instantly. I suspect even with dementia its one of the digit strings I'll hang onto. FWIW former forces probably have their serial number forwards and backwards because of hazing. I only have my NI number because of money.
badrabbit 8y ago
Neither were social security numbers. If OPM and equifax breaches weren't enough,I don't know what is. I think the west as a whole would change fast when this information is used against them in war with a formidable adversary(russia,china...)
jwr 8y ago
I see no problem with using phone numbers can be used as an ID. They should not be used for authentication though. For some reason it has become fashionable to force 2-factor authentication on users using SMS as the 2nd factor. That is a terrible idea, and yet it proliferates, especially at most calcified institutions (banks, DMV, twitter). This has to end.
crazy_monkey 8y ago
If it looks like an ID, people will use it like one... Good thing nobody has my DNA yet..., probably..., maybe...
cyphunk 8y ago
Lebanon was fun. When I arrived and purchased a SIM card, after getting on the different smartphone instamessage systems everyone that knew the previous owner started contacting me.
guru4consulting 8y ago
Every factor is vulnerable.. phones, phone provider, gmail accounts, yubi keys and even yourself. What if someone points a gun at you and asks you to transfer all the bitcoins? Why not distribute the authentication factors among multiple trusted parties instead of a single person? This would not scale for normal use cases, but could help for mission critical updates. For example, if I change my gmail password or port my phone number or update my auth factors (which are all considered major/mission critical changes), then the change has to be verified by at least 51% of my trusted contacts. So, instead of verifying authentication just with me, the provider has to send 2fa tokens to all my trusted parties (my spouse/partner, close friends, family members, etc). If 3 (out of 5) have verified and approved the change, then the provider would implement the change.

245 points by colinprince 8y ago

SSNs were never meant as ID. Now we are all at risk.

Bootstrapping identity is a very hard problem, and implementors can't resist the easy path of piggy-backing on someone else's identity or authentication system -- social security numbers, email addresses, telephone numbers, etc. AT&T is being sued by someone who lost $24M in cryptocurrency because someone decided to piggy-back authentication on AT&T. While AT&T should certainly be called out for having sloppy security, I can't help but feel that they never really signed up for the job of protecting such a valuable asset. It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open.

kurthr 8y ago
They gave their employee the ability to bypass the security PIN code locking the account. If they hadn't touted it as account security, their case would probably be better.
supertrope 8y ago
This is fundamentally a regulatory and economic problem. The exact challenge-response flow and physical artifacts/electronic credentials we use to assert identity and request access with change over time. Businesses are only motivated to prevent fraud if they will be liable for losses. They have managed to label it "identity theft," as if you forgot to lock up your bicycle, and give ironic post-breach advice to their customers like installing anti-virus software and not surrendering information to unsolicited callers. Incentives need to be aligned. The Trump Administration cancelled the investigation into Equifax. Target's stock price barely budged. Regulations may not be a panacea as the OPM breach suggests. "Cyber insurance" is an interesting market. Ideally insurers would require best practices to be followed for policy issuance and claim payout. But that can lead to compliance box checking, and litigation/coverage struggles instead of actual security.
- samatman 8y ago
  What you say about Target's stock price is true, but markets exist to price assets, not to punish malefactors. What this shows is that the market decided losing a ton of data wouldn't affect Target's bottom line; this supports your point about incentives but is itself not something in need of adjustment. The market is literally signaling that losing customer data isn't going to cost a company anything.
- pitaj 8y ago
  I think we'd probably all be using private/decentralized identity systems if it wasn't for KYC/AML regulations. The problem is that decentralized and some private identity systems are all "vulnerable" to pseudonymization, so it make KYC/AML impossible.
mindslight 8y ago
As it should remain! The fundamental problem is this concept of "identity" is a bundled abstraction that is being used in order to ignore every way in which scaling to the Internet is intrinsically difficult. Because sitting down face-to-face with someone yesteryear was completely and totally safe, so if only we can replicate that and "know" the other person, then all of these newfangled problems will just disappear! This is a partial list of actual problems "identity" is purporting to solve and an example of someone heavily relying on it: user-device security (Coinbase), cross-medium access (banks), Sybil problem (Google / IRS), persistent tracking (commercial surveillance), offline transactions (healthcare industry). Each one of these is an area of research unto itself, but yet "identity" is going to solve all of them together! Really, it is just a crutch that allows organizations to pretend to have solved the issues, and then act entitled when their "solution" falls apart. After having architected their systems as if their identifiers are entirely reliable, any action purporting to have been done by you is then your mess to clean up! Because "your" identity was "stolen", see? Problem solved! This article ultimately seems like a submarine for the industry consortium of the week. The primary reason a "good" identity system hasn't taken off is that the main thing demanded by users is to create arbitrary unlinkable nyms. Meanwhile these backwards-thinking organizations are looking to "identity" mainly to prevent people from doing just that!
- closeparen 8y ago
  The main thing demanded by users is cheap credit, which is diametrically opposed to a system designed to optimize the ease of fraud, as you suggest. Use all the scare quotes you want. You are one person, not several, and are accountable for your actions regardless of which pseudonym you wish to present them under.
  - mindslight 8y ago
    Only two of the five aspects I listed involve credit. And I'm pretty sure at this point people would be much happier getting healthcare without implicit credit, and thus not end up receiving kilodollar nastygrams in the mail for months afterwards. There are plenty of contexts for which there is nothing to be "accountable" for - I would say most general Internet use. And sure, it's possible to disagree reasonably about this, perhaps asserting that you only want to read comments that are policed by some authority. But it is an explicit tradeoff, not merely implicit that we should live in a world without some absolute privacy. There are plenty of current reliances on "identity" that don't pass the smell test - for example the seemingly common flow of setting up online banking by going home, going to a website, and entering in your public identifiers. In the context of a brick and mortar bank, this is utterly backwards! Describing an identity system based on nyms as having been "designed to optimize the ease of fraud" is utterly disingenuous. Fraud requires the other party to buy in to assumptions which are then invalidated. Most uses of identity, say online user accounts, don't need to carry such strong assertions in the first place. Also, highlighting that a term carries a loaded defintion is not using "scare quotes".
kalleboo 8y ago
I'm surprised a company that already has a lot of personal info like Equifax hasn't stepped up and created an online ID system (like how you have DUNS numbers for businesses). As a counter-example, Sweden has national personal ID number system where everyone is assigned a number at birth. This is fine as a primary key in databases but it's not exactly a secret so can't be used to authenticate someone. The banks stepped up to this challenge and created a common digital signature system called "BankID" where you get either a certificate/private key file (PC) or app (mobile). BankID is used for online filing of taxes, filing change of address, signing up for stuff like insurance, anything that traditionally would require a physical signature. ID verification is done by bank branches when you sign up for internet banking.
- Coding_Cat 8y ago
  >everyone is assigned a number at birth. Nitpicking (but what do you expect with a board that's majority programmers): only people born Swedish get one at birth. I got mine at age 23 when I studied there :) It still used my dob though.
- roywiggins 8y ago
  They have tried! Equifax has a service where you can pay them to verify your users' identities by quizzing them on their credit history. That said, given the equifax breach, I literally can't think of someone I'd trust less to handle it.
  - nhf 8y ago
    This is a specific instance of a more general service called dynamic knowledge-based authentication (dynamic KBA).
  - hakfoo 8y ago
    I recently signed into a medical-related service that used a verification system like this. They asked three questions. All of which were multiple choice and populated with a lot of obvious wrong answers. Two of them were the year and model of a car I (no longer) leased, and one was a direct "what county do you live in?" which is trivial from the address. If you physically drove by my house any time when the garage door was open in the last three years, you had a decent chance of knowing the right answers. If you had access to the DMV records, you had the right answers. And on the flip side, I hate to imagine how this would have worked for, say, a scholarship student at age 20 with no credit file. Enjoy reading my lab test results. I feel so secure.
solatic 8y ago
> Bootstrapping identity is a very hard problem Oh come on. Bootstrapping <anything> is hard. Identity isn't special. When bootstrapping, you base initial migration work off of existing systems, until you reach critical mass and the adaptation on top of existing systems are no longer relevant or necessary. You might as well argue that passports are worthless because it's not that theoretically difficult to fake the foundations of identity to a good enough level in order to get a genuine passport. As long as passports are unique-enough (no two people are identified by the same passport), they're good enough. And so is any other system which succeeds at consistently identifying the same person.
jedberg 8y ago
> It's like trying to protect Fort Knox with a consumer-grade padlock, then going after the padlock manufacturer when someone cuts it open. Well in this particular case, it's like protecting it with a consumer grade padlock, and then having someone who works for the padlock company give the thief a key to the lock. The reason he's suing is because AT&t failed to follow their own protocols for identifying the customer.

toast0 8y ago

Tieing 2fa directly to the phone is much better than tieing it to a phone number, until you don't control your phone. Then, how do you recover? You can't go down to the local Google (or whoever) kiosk, prove your identity, and get a new device added to 2fa, but you can get a new sim (downside, so can pretty much any carrier kiosk employee, or social engineer). Also, phone numbers are pretty useful for contacting people, and most people have an address book with their friends and family and other important contacts. There's tremendous social value for people in those numbers continuing to work, to the extent possible. You're never going to be able to tell everyone who might want to know when your number changes, especially if you for a new number when yours was assigned to someone else.

madengr 8y ago
Years ago, I had to physically show up at Verisign to get my domain changed. It was locked to an email address I no longer had. What a cluster that was.
- torstenvl 8y ago
  That's exactly how it should work, though.
  - kodablah 8y ago
    In theory. In reality, people will sacrifice security for simplicity in these situations thereby financially incentivizing the opposite of "how it should work".
  - madengr 8y ago
    The problem is that I live in KS and Verisign was in VA. I only went in person since I was visiting home. Went several weeks without a working domain.
jt2190 8y ago
> Tieing 2fa directly to the phone is much better than tieing it to a phone number, until you don't control your phone. This is worse. (edit: i.e. easier for the attacker since they don't need physical access to your device.) You still control your phone, but the attacker takes your phone number.

mschuster91 8y ago

Well, Germany could have provided a (relatively) easy solution with the new (ah well, 10 years old by now) Personalausweis identity cards - they're RFID capable and contain crypto functions. Actually, there is a solution for using them to sign stuff - but it's proprietary in any case, and requires expensive certificates.

gsich 8y ago
Not everyone has a Personalausweis.
- mschuster91 8y ago
  Nearly all Germans do have one (yes, I know, having a passport is sufficient... but, anecdata, never met anyone with only a passport), and iirc the Elektronischer Aufenthaltstitel required for non-German residents of Germany has the same functions. It's a perfect model of "the tech would be there but government is incompetent/corrupt and so it is not freely available for the benefit of citizens".

deleted 8y ago

[deleted]

jt2190 8y ago

tl;dr > The use of phone numbers as both lock and key has led to the rise, in recent years, of so-called SIM swapping attacks, in which an attacker steals your phone number. When you add two-factor authentication to an account and receive your codes through SMS texts, they go to the attacker instead, along with any calls and texts intended for the victim. Sometimes attackers even use inside sources at carriers who will transfer numbers for them.

aviv 8y ago

I repeat this on related threads: taking over any US phone number's inbound/outbound SMS traffic with the ability to intercept inbound SMS as well as send SMS originating from a particular number is dangerously easy. It takes one minute, and ALL numbers are vulnerable. Worse, there is no fix for this. Never ever use SMS for authentication, or sensitive communication of any kind. I believe this is being exploited on a regular basis and people just have no clue. This is likely used for anything from gaining access to email accounts to insider trading to political leverage to who the heck knows what else.

scient 8y ago
There are a couple of vendors out there who at least try to detect SIM swapping and traffic hijacking. It's better than nothing and eliminates the simplest attacks, but still has it flaws, including happy path case support (like only working on the network and needing a smart phone).

11thEarlOfMar 8y ago

We're seeing more biometric authentication with fingerprints, face recognition, perhaps retina scan. How do these methods perform in practice, considering both their contribution to security and their practical application? I currently authenticate on my iPhone with fingerprint. How hard is that to crack? If you had the victim's fingerprint, it's apparently trivial [1]. But accessing my fingerprint is not something that a random hacker/thief on the Internet would reasonably be able to do. Since our phones are becoming our life-key. Would a 3-factor authentication sufficiently protect us? Something you have: SmartPhone. Something you know: Password. Unique part of you: Fingerprint. [1] https://www.businessinsider.com/fingerprint-hacked-smartphones-2016-3 https://www.businessinsider.com/fingerprint-hacked-smartphon...

3pt14159 8y ago
Fingerprints are so fucking dumb. You can't change them and you leave them everywhere! They're good against stopping your nosy family members from seeing your password, but what am I supposed to do when dining or paying someone? Wear gloves? If the cybersec game turns into "collect physical fingerprints" then the gangs are going to collect physical fingerprints and then what? What we need is something dynamic that's hard to fake, like a human voice or face, tied to a government issued cryptographic device with no input ports / volatile memory / inbound network adapter. You say a challenge sentence out loud. The device validates. Then the device signs or authenticates or whatever. For integrity it could optionally encrypt and broadcast what happened. You lose the device, you get a new one just like you get a passport. In person with other documents, etc. This really isn't that hard. We could have done it decades ago.
- gregknicholson 8y ago
  > government issued cryptographic device I don't trust my government to be competent at cryptography. Some people don't trust their government to be non-malicious.
  - smnrchrds 8y ago
    > I don't trust my government to be competent at cryptography. Which government is it? If it is the US, you might as well not trust any cryptographic schemes, considering how many of them were developed by NSA.

gonmf 8y ago

We should more than ever be teaching everyone not to use their real name on the internet, not to give out their phone number or private email address. In the internet and for businesses for advertising or any other avoidable purpose. This would eventually prevent the assumption that everybody has a phone number that can be used as authentication, or even worse, a Facebook account!

wtmt 8y ago

> But the United States doesn't offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise. Oh, please! No! No! No! India bulldozed a national identification number (called Aadhaar) on its residents and it has made more people vulnerable to many kinds of attacks, including phone number hijacking, draining people’s bank accounts, etc. To say that it’s been an unmitigated disaster would be an understatement. As with things related to government, the governing organization for Aadhaar, called UIDAI, always claims that it’s completely secure, while ignoring the fact that linking one number to everything in one’s life increases the attack surface and the severity of the threats. So please research on the number of ways Aadhaar has failed, and is making some feeble attempts to recover, before getting into a “let’s create a new static number to identify people with instead of a phone number or SSN”. That’d just be changing the narrative without achieving anything. Bottom line, it’s not the phone number that’s the problem, but having a unique and non-changing number and linking it to everything else (including one’s phone numbers).

addicted 8y ago
Can you share some starting points to research it?
- davchana 8y ago
  The law which implemented this ID, says, nobody can use it to malign purpose; The authority is found to use this clause against anybody who wrote about its flaws. The law also says that only Authority can disable this ID, anytime. So once somebody's ID is dead, they suffer civil death. No job, hospital, travel, mobile, taxes. Every week they switch from ID number is secret: ID number is not secret. This number can not be changed even for a person. To keep it safe, they introduced a virtual ID number, which, again is permanent for one's life.
- wtmt 8y ago
  Here are a few things to start looking at (the amount of information could be overwhelming): * https://www.rethinkaadhaar.in https://www.rethinkaadhaar.in * https://twitter.com/no2uid https://twitter.com/no2uid * Search for #AadhaarFail on Twitter * Search for “Aadhaar frauds” on DuckDuckGo or your favorite search engine

jkingsbery 8y ago

I implemented number porting for a startup I worked for. It's all pretty scary: yes, it's easy to impersonate someone if you have some information about them, but some carriers don't check any sort of porting pin at all. That is, attackers sometimes do not need to impersonate you, they just have to ask for your number. It would be great if we all had something big more secure, but in the meantime understand your carrier's port out process and that you have your number secured.

twblalock 8y ago

Phone numbers are obviously flawed as identifiers, but so are social security numbers, drivers license numbers, etc. If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number? Biometric data can be replicated, e.g. fake fingerprints and synthesized voices. Good facial recognition is still a step ahead of scammers but they may catch up at some point. And you can't easily change your biometric data if someone manages to make a copy. At this point everyone knows passwords by themselves are not good enough. Physical tokens like Yubikeys can be stolen, although that's clearly more difficult than stealing some of these other identifiers. If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned? So, I find it difficult to blame companies for using phone numbers as identifiers -- it's easy, and all of the alternatives are also flawed. I haven't seen any foolproof identifier, probably because it's not possible to create one.

Avamander 8y ago
> how would they keep it secure without resorting to one of the flawed systems I just mentioned? It's small, hard to exploit flaws vs. large easy to exploit flaws. > If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned? Physical smartcard/smart SIM/phone. You have to steal something physical + get the PIN. Definitely possible, but really hard and if that gets lost you have to go to the Police, get yourself re-identified and get a new card. Compared what bullshit of an identifier a phone number is Estonian system is miles ahead.
solatic 8y ago
> If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number Everyone gets a national ID number. This number is considered public and is used for signing up for public and private services. Everyone gets a ID card, issued by the government. This ID card holds a private key, used to enter legally-binding agreements, and the card is printed with the photo of the holder. Attempts to use the card to authorize purchases online redirect to a government-managed identity provider (think SAML 2.0), where the user must provide either a password (preferable) or, if there is no password, some other knowledge proof that is not discernible from the physical ID card, either of which were set up when the card was issued. When people become incapacitated for publicly-known reasons (incarceration, hospitalization, etc.), their public certificates are temporarily added to a revocation list. When issued, the card comes with three one-time-use secret codes, each of which triggers a 24-hour temporary revocation, which must be kept secret-enough to prevent abuse. Obtaining more temporary revocation codes, or permanent revocation (in case of loss or theft), or password/knowledge proof reset without the previous password/knowledge proof, is handled in physically secure government facilities, by providing DNA and other biometrics, that were registered when the card was issued and are not used for any other purpose. Corruption is combated at the DNA-collection stage by requiring the secure facilities to actually collect fresh physical samples each time - this constitutes a biological sort of paper trail for auditing revocation requests. No, it's not impossible to game the system. People can be bribed to overlook the photo; DNA can be stolen and used to continually permanently-revoke victims. Paper trails are not magic cure-alls. There are serious ethical concerns with entrusting the government with a populace's DNA (particularly, the potential to re-index it for the purposes of ethnic cleansing). And yet, when compared to modern-day systems, I'm hard-pressed to complain. If you ask, quite simply, which is better, the system proposed above or the contemporary system, one or the other, I have a hard time imagining people defending the contemporary system.

heinrichf 8y ago

Never meant for identification purposes, just like social security numbers: https://www.npr.org/templates/transcript/transcript.php?storyId=593603674 https://www.npr.org/templates/transcript/transcript.php?stor... (interesting Planet Money episode on the history of the SSN)

nkkollaw 8y ago

So, do phone numbers get recycled? For instance, if I change phone company and decide not to keep the number or they're unable to transfer it, can it be assigned to someone else?

kickling 8y ago
Happened to my number at least (I live in Sweden). A person sent me a text message saying he had my previous number and that he got frequent calls from my friends.
- nkkollaw 8y ago
  Jesus... Yes, this is NOT good, considering the number of services that you can log in into with just a SMS confirmation (my bank, for instance).

Spooky23 8y ago

The US absolutely offers universal id, it’s just federated. All states will have common identity standards shortly (all but 2-3 do today). There’s a parallel system through the various passport and trusted traveler schemes that are controlled by the US government directly as well.

ggm 8y ago

My UK NI number is burned into my brain. It might be because it was given to me at a highly emotional time (transition from school to unemployment and university) or because I had to know it to complete forms (UB-40 and P-45 employment status). From thirty years distance, trying to re-connect to my UK pension rights, as a non-resident migrant, it floated back up into my consciousness instantly. I suspect even with dementia its one of the digit strings I'll hang onto. FWIW former forces probably have their serial number forwards and backwards because of hazing. I only have my NI number because of money.

badrabbit 8y ago

Neither were social security numbers. If OPM and equifax breaches weren't enough,I don't know what is. I think the west as a whole would change fast when this information is used against them in war with a formidable adversary(russia,china...)

jwr 8y ago

I see no problem with using phone numbers can be used as an ID. They should not be used for authentication though. For some reason it has become fashionable to force 2-factor authentication on users using SMS as the 2nd factor. That is a terrible idea, and yet it proliferates, especially at most calcified institutions (banks, DMV, twitter). This has to end.

crazy_monkey 8y ago

If it looks like an ID, people will use it like one... Good thing nobody has my DNA yet..., probably..., maybe...

cyphunk 8y ago

Lebanon was fun. When I arrived and purchased a SIM card, after getting on the different smartphone instamessage systems everyone that knew the previous owner started contacting me.

guru4consulting 8y ago

Every factor is vulnerable.. phones, phone provider, gmail accounts, yubi keys and even yourself. What if someone points a gun at you and asks you to transfer all the bitcoins? Why not distribute the authentication factors among multiple trusted parties instead of a single person? This would not scale for normal use cases, but could help for mission critical updates. For example, if I change my gmail password or port my phone number or update my auth factors (which are all considered major/mission critical changes), then the change has to be verified by at least 51% of my trusted contacts. So, instead of verifying authentication just with me, the provider has to send 2fa tokens to all my trusted parties (my spouse/partner, close friends, family members, etc). If 3 (out of 5) have verified and approved the change, then the provider would implement the change.