4 ms·

There definitely needs to be more stringent protocols in place for transferring numbers, but I have to disagree with the 72-hour delay idea - it may hamstring t

by Liquix 8y ago

There definitely needs to be more stringent protocols in place for transferring numbers, but I have to disagree with the 72-hour delay idea - it may hamstring those who are porting numbers for legitimate reasons. For example, I lost my phone on a Thursday a couple months ago and desperately needed it for work the following week. Ordered a replacement phone as well as SIM with express shipping. Received both over the weekend, called the provider to port from the lost SIM to the new one, and was able to work on Monday. Having an unavoidable X-hour long delay before the port went through would've been awful. I'm sure there's another way to accomplish the same goal - perhaps requiring more info than just account number / PIN / password, implementing physical ID verification, etc.

cj 8y ago
> Having an unavoidable X-hour long delay before the port went through would've been awful What if that "unavoidable X-hour long delay" prevented your 2-FA codes from being compromised during a targeted attack? To be fair, very few people are individually targeted in these types of attacks (statistically). It would be great to have a 72-hour delay on transfer if it were on an opt-in basis. (Side note: has anyone tried to disable web access to text messages on a Verizon line?)
themagician 8y ago
That's why I said it should be optional. A lot of people wouldn't want this. Some would. I definitely would. For me the potential delay in the event of a lost/stolen/upgraded device is well worth it when the flip side is the potential nightmare resulting from the damage done if the person gets into an important account. It seems to me like requiring some secondary form of authentication can always be bypassed at the discretion of the agent helping you because there will always be a possibility that the customer lost/can't remember the secondary key or ID. Although, now that I think about it… UPS does something interesting to verify your account. They ask you to input a unique set of numbers that appear on your last invoice to link your account and verify your ID. Not foolproof by any means, but it's enforced for every authentication by design. Definitely more secure than the current PIN.

by Liquix 8y ago

cj 8y ago

> Having an unavoidable X-hour long delay before the port went through would've been awful What if that "unavoidable X-hour long delay" prevented your 2-FA codes from being compromised during a targeted attack? To be fair, very few people are individually targeted in these types of attacks (statistically). It would be great to have a 72-hour delay on transfer if it were on an opt-in basis. (Side note: has anyone tried to disable web access to text messages on a Verizon line?)

themagician 8y ago

That's why I said it should be optional. A lot of people wouldn't want this. Some would. I definitely would. For me the potential delay in the event of a lost/stolen/upgraded device is well worth it when the flip side is the potential nightmare resulting from the damage done if the person gets into an important account. It seems to me like requiring some secondary form of authentication can always be bypassed at the discretion of the agent helping you because there will always be a possibility that the customer lost/can't remember the secondary key or ID. Although, now that I think about it… UPS does something interesting to verify your account. They ask you to input a unique set of numbers that appear on your last invoice to link your account and verify your ID. Not foolproof by any means, but it's enforced for every authentication by design. Definitely more secure than the current PIN.