4 ms·

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, but just knowing my number was on that list worried me. I called AT&T and asked them to put a note in my account that said not to allow my phone number to be transferred to another SIM. They said they did it, but again I don't know how effective that is. I understand why they make it possible to move a number to a new SIM, but I really wish you had an option to force a notification and delay the transfer for a number off days. Even a three day delay would be enough. You'd put in the request and they'd send a notification via SMS/call and email, and then the transfer wouldn't happen for 72 hours. I would gladly deal with the potential inconvenience of not having access to my phone for a few days if it meant that it would make it harder to transfer my number to a different SIM. I don't think this should be mandatory, but I'd like the option. It's just WAY too easy to call a cell provider and have them transfer your number to a new SIM and all the security measures that they use are easily defeated. Once you have someone's social security number you can spend 99¢ on a public records dump and get enough information to convince just about any customer service person to do whatever you want.

notyourday 8y ago
The lack of security of cell phone providers is absolutely infuriating considering the sheer number of people who are paid $20/h that have ability to see and manipulate records at the likes of AT&T, Sprint, TMO and VZ not to mention those who work for resellers like BestBuy that are authorized to make activation and porting related changes. It reminds me of MJR confidently stating that the maximum cost of gaining access to any secure network is min: 1) A yearly salary of the lowest paid employee who has access (i.e. someone's secretary) 2) A price of a Desert Eagle
- wikibob 8y ago
  Ah just FYI the pay is around $10-$11 an hour.
Liquix 8y ago
There definitely needs to be more stringent protocols in place for transferring numbers, but I have to disagree with the 72-hour delay idea - it may hamstring those who are porting numbers for legitimate reasons. For example, I lost my phone on a Thursday a couple months ago and desperately needed it for work the following week. Ordered a replacement phone as well as SIM with express shipping. Received both over the weekend, called the provider to port from the lost SIM to the new one, and was able to work on Monday. Having an unavoidable X-hour long delay before the port went through would've been awful. I'm sure there's another way to accomplish the same goal - perhaps requiring more info than just account number / PIN / password, implementing physical ID verification, etc.
- cj 8y ago
  > Having an unavoidable X-hour long delay before the port went through would've been awful What if that "unavoidable X-hour long delay" prevented your 2-FA codes from being compromised during a targeted attack? To be fair, very few people are individually targeted in these types of attacks (statistically). It would be great to have a 72-hour delay on transfer if it were on an opt-in basis. (Side note: has anyone tried to disable web access to text messages on a Verizon line?)
- themagician 8y ago
  That's why I said it should be optional. A lot of people wouldn't want this. Some would. I definitely would. For me the potential delay in the event of a lost/stolen/upgraded device is well worth it when the flip side is the potential nightmare resulting from the damage done if the person gets into an important account. It seems to me like requiring some secondary form of authentication can always be bypassed at the discretion of the agent helping you because there will always be a possibility that the customer lost/can't remember the secondary key or ID. Although, now that I think about it… UPS does something interesting to verify your account. They ask you to input a unique set of numbers that appear on your last invoice to link your account and verify your ID. Not foolproof by any means, but it's enforced for every authentication by design. Definitely more secure than the current PIN.
snuxoll 8y ago
T-Mobile has put in place some protections to prevent unauthorized transfers of your account to new SIM cards, I just had to deal with them last night - actually. Swapping SIM cards for a line must either be done in-store where your photo ID can be verified, or over the phone but only after confirmation of a OTP sent to account managers via SMS. I know T-Mobile actually had some issues with this in the past, so even though I miss the convenience of going to t-mobile.com/sim to swap a card out I feel it's a much better solution security-wise.
phire 8y ago
I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number. They said the best they could do was to add a note to my file to check id in store before transferring. This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it. And more importantly, it does noting to stop someone asking another provider to port my number to them. Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it.
- narrator 8y ago
  Running it through google voice will make it subject to your google 2fa.
  - davchana 8y ago
    Could you please elaborate about google thing you mentioned? I am interested in making my ATT sim morr secure..
    - zimbatm 8y ago
      It replaces the SMS 2FA with a Google prompt app on the phone for Gmail verification. So it doesn't make the SIM more secure but the SIM get hacked it doesn't allow the attacker to gain access to Gmail.
      - narrator 8y ago
        Also if your public SMS reset number is in google voice, a hacker can't port it off of Google easily because you need to log into your google account to port it, which requires 2fa. They have to figure out your real number, but you never give that out to anyone or you just use google hangouts SMS instead of forwarding text messages to your insecure phone.
- im3w1l 8y ago
  > Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it. "Phone number" is truly the most dysfunctional social network.
eksemplar 8y ago
In my country you can’t transfer your sim or number without signing the transaction with our national two-factor digital identity that is provided by the government. You also need to supply your secret social security number in a safe validation form. So to me it’s much safer than a token auth that I’ll accidentally wipe whenever I buy a new phone. At least Authy allows SMS restore.

notyourday 8y ago

The lack of security of cell phone providers is absolutely infuriating considering the sheer number of people who are paid $20/h that have ability to see and manipulate records at the likes of AT&T, Sprint, TMO and VZ not to mention those who work for resellers like BestBuy that are authorized to make activation and porting related changes. It reminds me of MJR confidently stating that the maximum cost of gaining access to any secure network is min: 1) A yearly salary of the lowest paid employee who has access (i.e. someone's secretary) 2) A price of a Desert Eagle

wikibob 8y ago
Ah just FYI the pay is around $10-$11 an hour.

Liquix 8y ago

There definitely needs to be more stringent protocols in place for transferring numbers, but I have to disagree with the 72-hour delay idea - it may hamstring those who are porting numbers for legitimate reasons. For example, I lost my phone on a Thursday a couple months ago and desperately needed it for work the following week. Ordered a replacement phone as well as SIM with express shipping. Received both over the weekend, called the provider to port from the lost SIM to the new one, and was able to work on Monday. Having an unavoidable X-hour long delay before the port went through would've been awful. I'm sure there's another way to accomplish the same goal - perhaps requiring more info than just account number / PIN / password, implementing physical ID verification, etc.

cj 8y ago
> Having an unavoidable X-hour long delay before the port went through would've been awful What if that "unavoidable X-hour long delay" prevented your 2-FA codes from being compromised during a targeted attack? To be fair, very few people are individually targeted in these types of attacks (statistically). It would be great to have a 72-hour delay on transfer if it were on an opt-in basis. (Side note: has anyone tried to disable web access to text messages on a Verizon line?)
themagician 8y ago
That's why I said it should be optional. A lot of people wouldn't want this. Some would. I definitely would. For me the potential delay in the event of a lost/stolen/upgraded device is well worth it when the flip side is the potential nightmare resulting from the damage done if the person gets into an important account. It seems to me like requiring some secondary form of authentication can always be bypassed at the discretion of the agent helping you because there will always be a possibility that the customer lost/can't remember the secondary key or ID. Although, now that I think about it… UPS does something interesting to verify your account. They ask you to input a unique set of numbers that appear on your last invoice to link your account and verify your ID. Not foolproof by any means, but it's enforced for every authentication by design. Definitely more secure than the current PIN.

snuxoll 8y ago

T-Mobile has put in place some protections to prevent unauthorized transfers of your account to new SIM cards, I just had to deal with them last night - actually. Swapping SIM cards for a line must either be done in-store where your photo ID can be verified, or over the phone but only after confirmation of a OTP sent to account managers via SMS. I know T-Mobile actually had some issues with this in the past, so even though I miss the convenience of going to t-mobile.com/sim to swap a card out I feel it's a much better solution security-wise.

phire 8y ago

I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number. They said the best they could do was to add a note to my file to check id in store before transferring. This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it. And more importantly, it does noting to stop someone asking another provider to port my number to them. Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it.

narrator 8y ago
Running it through google voice will make it subject to your google 2fa.
- davchana 8y ago
  Could you please elaborate about google thing you mentioned? I am interested in making my ATT sim morr secure..
  - zimbatm 8y ago
    It replaces the SMS 2FA with a Google prompt app on the phone for Gmail verification. So it doesn't make the SIM more secure but the SIM get hacked it doesn't allow the attacker to gain access to Gmail.
    - narrator 8y ago
      Also if your public SMS reset number is in google voice, a hacker can't port it off of Google easily because you need to log into your google account to port it, which requires 2fa. They have to figure out your real number, but you never give that out to anyone or you just use google hangouts SMS instead of forwarding text messages to your insecure phone.
im3w1l 8y ago
> Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it. "Phone number" is truly the most dysfunctional social network.

eksemplar 8y ago

In my country you can’t transfer your sim or number without signing the transaction with our national two-factor digital identity that is provided by the government. You also need to supply your secret social security number in a safe validation form. So to me it’s much safer than a token auth that I’ll accidentally wipe whenever I buy a new phone. At least Authy allows SMS restore.