9 ms·

Who Owns Your Wireless Service? Crooks Do

204 points by hsnewman 7y ago

OedipusRex 7y ago
It's hard not to get really depressed when you think about all the political institutions that were setup to protect consumers and have since been hijacked by the corporations to protect them from the consumers.
- mikedilger 7y ago
  Maybe you won't be so depressed when you realize that some of the quotes in that article by Gigi Sohn ("complete and total abdication of oversight") are prima facie hyberbole, and thus we can dismiss them as politically motivated. How can I say it's hyberbole? The rest of the article tells us that there are lawsuits, prosecutions, and FCC investigations. That doesn't sound like a complete and total abdication of oversight. Is the problem serious? yes. Is it ongoing? yes. Is there regulatory capture? yes. But is nothing being done about it? no.
  - nnvvhh 7y ago
    I think you're overreacting. The Sohn quote is referring specifically to oversight by relevant government agencies. Lawsuits are not relevant to the statement. The article implies that the FCC investigation into location data sharing was, at best, proceeding slowly.
    - mikedilger 7y ago
      Perhaps. I mostly concur with the article. I think FCC deregulation was poorly done. I'm not happy with the wording of my prior statement but I'm not going to edit it. What I was thinking when I wrote it was "cheer up, things will work out okay"
- supertrope 7y ago
  It's inevitable unless regulators and consumer activists maintain the upper hand (in which case businesses will complain about a business unfriendly environment). Badly behaved businesses reap concentrated benefit while imposing diffuse losses on others. It's kind of like how a factory worker in a declining city notices the harm of a layoff much more than the benefit of TVs costing 25% less.
Causality1 7y ago
Curiously enough, an edition of the Encyclopedia Galactica that had the good fortune to fall through a time warp from a thousand years in the future defined the telecommunications executives of America as "a bunch of mindless jerks who were the first against the wall when the revolution came."
- CumcastSux 7y ago
  I'd pay to see this. Extra if cumcast is up front.
- dylan604 7y ago
  How I miss Douglas Adams
wmf 7y ago
AT&T's response to this sounds pretty bad. They're not going to prevent SIM swaps but they're going to let banks (not Google, not cryptocurrency exchanges) discover that you got swapped after the fact.
- supertrope 7y ago
  Telcoms want the revenue that comes with identity and access as a service, but not the liability nor due diligence costs.
- incompatible 7y ago
  Eventually, this could make legitimate SIM swaps unusable. The point of SIM swaps was to retain a phone number when swapping carriers or SIM chips. If a number becomes untrusted after a SIM swap, you may be better off getting a new number.
  - gruez 7y ago
    >If a number becomes untrusted after a SIM swap, you may be better off getting a new number. Do you only use your phone number for 2fa? People don't call you or send texts? Keeping the same phone number is still convenient so people can still reach you at the same number.
    - incompatible 7y ago
      I can imagine the convenience for most people. For me, not being a big phone user, it's not difficult. I did it recently when porting to a new provider failed to work (despite only needing my phone number and date of birth as input). Perhaps a few organisations didn't get the new number and can no longer contact me for marketing etc., but that's a bonus.
  - iforgotpassword 7y ago
    Assuming it wasn't bribery but simple social engineering, what's there to prevent this from being abused? In Germany, porting the number to another carrier would be next to impossible without the victim realizing. You have to request from the old carrier to release the number for porting, then you have to tell the new carrier you want to port over the old number from the old carrier. Then the old carrier informs you via SMS and email when the switchover will happen. That date is usually at least one week in the future. And usually the evening before the switch you get another SMS. Pretending to have lost your SIM and requesting a new one might be slightly easier, I never needed to do that. But it would mean your SIM gets deactivated the moment they start the process of shipping out the new SIM, so it will give you at least a full 24 hours to notice you got no service, usually two days. I wouldn't be surprised if they'd also send you a text plus email before deactivation just in case. But in general I feel like call center workers here are very good at following the protocol. I'd be very surprised if you'd manage to convince one that you lost your phone and you also happen to have moved and want it sent to another address. But sure, if you're paying someone on the inside, all bets are off.
beeschlenker 7y ago
Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Harris $1 billion, Schumer $2 billion, to help bring the boys over the border. See pages 18-23, 8, 11, 12, 35, 45, 61, 62 Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".
maximente 7y ago
this is actually an existential financial threat for some people: - SIM swap to get obtain SMS/telephone capability - hijack email, if known + non-2FA or known SMS/telephone 2FA - this could be socially engineered as well - "sorry, i forgot my password to that email account, can you change it to..." - using gathered intel from email (e.g. monthly statements), call up banks/financial account (many of which are non-2FA or SMS/telephone 2FA) - password reset/etc any accounts without 2FA or with SMS/telephone 2FA - social engineer way into bank/financial accounts - drain and profit i've seriously considered tying up financial stuff to an undisclosed phone number on its own account.
- ryacko 7y ago
  Should be more than that, data leaks are everywhere, and anything worth more than the fee for a phone line should have it’s own number. I wonder if the government wants people to be as paranoid as the people running the government, or they’re just ignorant. Most of these protocols were developed during the Cold War, not after.
- rolltiide 7y ago
  this happens to people that store their cryptocurrency on services with sms-based 2fa. any service that uses sms-based 2fa without any other option like client side generated one time passcodes (otp) should be sued for negligence at this point. the otp should be the default choice. people are currently masquerading incompetence as an indictment to cryptocurrencies as a concept. this is allowing negligent, incompetent businesses to get a free pass, because the people that should be in charge of protecting consumers are thinking the cryptocurrency itself is insecure or "got hacked" which so far isn't what is happening. (with regard to storing cryptocurrency on someone else's server, yeah those users are being negligent too.)
  - i_am_nomad 7y ago
    My personal peeve is various services that offer MFA, but very quietly still offer SMS-based 2FA as a backup that is nearly impossible to turn off. If you set up MFA, be absolutely sure that recovery is only done through one-time codes and the service doesn't automatically fall back on SMS.
nimbius 7y ago
As a personal hacking project in my spare time, I switched from T-Mobile to anveo and an asterisk setup. I can send and receive SMS on my server and can make WiFi calls on my phone. SMS gets sent to my email as well. This costs maybe $45 USD a year. I've thought about documenting my setup but I don't know if there is any interest.
- asteli 7y ago
  Yes! I've wanted to decouple SMS from the phone I carry, be able to respond to SMS via other devices. Right now the best option I have is to convince as many people I can to start using Signal.
- ct520 7y ago
  How reliable is it? Could it be used to replace non critical services twilio offers for say small business?
- g82918 7y ago
  I am interested!
- nimbius 7y ago
  Some responses: Its reliable enough to pay my credit card bills over the phone using public bus WiFi SMS is trickier as I only know enough programming to write a script in bash to send sms. I can't send pictures or videos, so I try to convince friends to use signal instead. 911 works with no sim card, as required by federal law. I do have working SMS to email however, so viewing SMS is a piece of cake :)
- fredmonroe 7y ago
  i'm interested too.
- dsd 7y ago
  If you were to get a plan on a cheap mvno with a second phone number, would it work as seamlessly as if your main number were tied to your SIM?
3xblah 7y ago
I see these problems from a different angle than the usual commentators. I continue to ask myself: Why is mobile used for important things, e.g., banking, payments, etc.? A great example is authenticating a person's identity via possession of a SIM card, i.e., their mobile number. If one can switch SIM cards, then one can switch identities. This flexibility is not a flaw in mobile communications; the ease-of-use is what makes mobile so useful. However it is silly to pretend mobile is as safe as landline for all uses. Mobile may be altogether more useful than landline -- few could argue otherwise -- and at the same time it can be entirely inappropriate for use in important things like banking. This concept seems non-existant. Instead the prevailing thinking is all-or-nothing. In addition to "convenience", mobile has introduced a new class of problems when used for important things like banking and payments. These problems either do not exist or exist at a much lower scale with respect to landline. Who owns landline service? Crooks? From where I stand, the risks of using mobile for important transactions outweigh the benefits. Unfortunately, I also see that "convenience" continues to prevail over common sense. I am willing to sacrafice convenience for peace of mind. Meanwhile banks and others push harder and harder for customers to use mobile, including as a means of verifying identity.
- wvenable 7y ago
  > These problems either do not exist or exist at a much lower scale with respect to landline. Except for an ever-growing amount of the population doesn't have a landline -- only mobile.
  - umeshunni 7y ago
    The vast majority of people do not have a land line. Per World Bank data, there are 12 landlines per 100 people and 102 mobile lines per 100 people.
    - 3xblah 7y ago
      What are the statistics for businesses? How many landlines per business entity? Are the vast majority of businesses using cellphones exclusively? Why not?
KirinDave 7y ago
I didn't know AT&T was just selling real time data in defiance of the FCC rules and I'm quite inclined to just terminate my service after holding an account for nearly 20 years with them over it. That's beyond unacceptable.
the_arun 7y ago
I liked the smart title of this article!
iflywithbook 7y ago
Great piece of content. First time I read something in krebsonsecurity Love the combination of investigation and cybersecurity.
calvano915 7y ago
Are any providers offering an opt-in SIM freeze of sorts with some kind of enhanced authentication in order to unfreeze? Wouldn't such a feature/service easily prevent the SIM-swap risk? I don't know how easy this is to prevent regarding the infrastructure (do networks detect a SIM-swap via change in host IMEI?). I understand the article describes a rogue employee but it seems to me that an added layer for such a service could easily prevent unauthorized access.

204 points by hsnewman 7y ago

It's hard not to get really depressed when you think about all the political institutions that were setup to protect consumers and have since been hijacked by the corporations to protect them from the consumers.

mikedilger 7y ago
Maybe you won't be so depressed when you realize that some of the quotes in that article by Gigi Sohn ("complete and total abdication of oversight") are prima facie hyberbole, and thus we can dismiss them as politically motivated. How can I say it's hyberbole? The rest of the article tells us that there are lawsuits, prosecutions, and FCC investigations. That doesn't sound like a complete and total abdication of oversight. Is the problem serious? yes. Is it ongoing? yes. Is there regulatory capture? yes. But is nothing being done about it? no.
- nnvvhh 7y ago
  I think you're overreacting. The Sohn quote is referring specifically to oversight by relevant government agencies. Lawsuits are not relevant to the statement. The article implies that the FCC investigation into location data sharing was, at best, proceeding slowly.
  - mikedilger 7y ago
    Perhaps. I mostly concur with the article. I think FCC deregulation was poorly done. I'm not happy with the wording of my prior statement but I'm not going to edit it. What I was thinking when I wrote it was "cheer up, things will work out okay"
supertrope 7y ago
It's inevitable unless regulators and consumer activists maintain the upper hand (in which case businesses will complain about a business unfriendly environment). Badly behaved businesses reap concentrated benefit while imposing diffuse losses on others. It's kind of like how a factory worker in a declining city notices the harm of a layoff much more than the benefit of TVs costing 25% less.

Causality1 7y ago

Curiously enough, an edition of the Encyclopedia Galactica that had the good fortune to fall through a time warp from a thousand years in the future defined the telecommunications executives of America as "a bunch of mindless jerks who were the first against the wall when the revolution came."

CumcastSux 7y ago
I'd pay to see this. Extra if cumcast is up front.
dylan604 7y ago
How I miss Douglas Adams

wmf 7y ago

AT&T's response to this sounds pretty bad. They're not going to prevent SIM swaps but they're going to let banks (not Google, not cryptocurrency exchanges) discover that you got swapped after the fact.

supertrope 7y ago
Telcoms want the revenue that comes with identity and access as a service, but not the liability nor due diligence costs.
incompatible 7y ago
Eventually, this could make legitimate SIM swaps unusable. The point of SIM swaps was to retain a phone number when swapping carriers or SIM chips. If a number becomes untrusted after a SIM swap, you may be better off getting a new number.
- gruez 7y ago
  >If a number becomes untrusted after a SIM swap, you may be better off getting a new number. Do you only use your phone number for 2fa? People don't call you or send texts? Keeping the same phone number is still convenient so people can still reach you at the same number.
  - incompatible 7y ago
    I can imagine the convenience for most people. For me, not being a big phone user, it's not difficult. I did it recently when porting to a new provider failed to work (despite only needing my phone number and date of birth as input). Perhaps a few organisations didn't get the new number and can no longer contact me for marketing etc., but that's a bonus.
- iforgotpassword 7y ago
  Assuming it wasn't bribery but simple social engineering, what's there to prevent this from being abused? In Germany, porting the number to another carrier would be next to impossible without the victim realizing. You have to request from the old carrier to release the number for porting, then you have to tell the new carrier you want to port over the old number from the old carrier. Then the old carrier informs you via SMS and email when the switchover will happen. That date is usually at least one week in the future. And usually the evening before the switch you get another SMS. Pretending to have lost your SIM and requesting a new one might be slightly easier, I never needed to do that. But it would mean your SIM gets deactivated the moment they start the process of shipping out the new SIM, so it will give you at least a full 24 hours to notice you got no service, usually two days. I wouldn't be surprised if they'd also send you a text plus email before deactivation just in case. But in general I feel like call center workers here are very good at following the protocol. I'd be very surprised if you'd manage to convince one that you lost your phone and you also happen to have moved and want it sent to another address. But sure, if you're paying someone on the inside, all bets are off.

beeschlenker 7y ago

Obama rapes & kills 2 boys. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pelosi $3 billion, Harris $1 billion, Schumer $2 billion, to help bring the boys over the border. See pages 18-23, 8, 11, 12, 35, 45, 61, 62 Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 71 page document filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill M^urray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illum%inati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapi'sts. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who ^we are." Full 71 page document: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "faggot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other faggot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".

maximente 7y ago

this is actually an existential financial threat for some people: - SIM swap to get obtain SMS/telephone capability - hijack email, if known + non-2FA or known SMS/telephone 2FA - this could be socially engineered as well - "sorry, i forgot my password to that email account, can you change it to..." - using gathered intel from email (e.g. monthly statements), call up banks/financial account (many of which are non-2FA or SMS/telephone 2FA) - password reset/etc any accounts without 2FA or with SMS/telephone 2FA - social engineer way into bank/financial accounts - drain and profit i've seriously considered tying up financial stuff to an undisclosed phone number on its own account.

ryacko 7y ago
Should be more than that, data leaks are everywhere, and anything worth more than the fee for a phone line should have it’s own number. I wonder if the government wants people to be as paranoid as the people running the government, or they’re just ignorant. Most of these protocols were developed during the Cold War, not after.
rolltiide 7y ago
this happens to people that store their cryptocurrency on services with sms-based 2fa. any service that uses sms-based 2fa without any other option like client side generated one time passcodes (otp) should be sued for negligence at this point. the otp should be the default choice. people are currently masquerading incompetence as an indictment to cryptocurrencies as a concept. this is allowing negligent, incompetent businesses to get a free pass, because the people that should be in charge of protecting consumers are thinking the cryptocurrency itself is insecure or "got hacked" which so far isn't what is happening. (with regard to storing cryptocurrency on someone else's server, yeah those users are being negligent too.)
- i_am_nomad 7y ago
  My personal peeve is various services that offer MFA, but very quietly still offer SMS-based 2FA as a backup that is nearly impossible to turn off. If you set up MFA, be absolutely sure that recovery is only done through one-time codes and the service doesn't automatically fall back on SMS.

nimbius 7y ago

As a personal hacking project in my spare time, I switched from T-Mobile to anveo and an asterisk setup. I can send and receive SMS on my server and can make WiFi calls on my phone. SMS gets sent to my email as well. This costs maybe $45 USD a year. I've thought about documenting my setup but I don't know if there is any interest.

asteli 7y ago
Yes! I've wanted to decouple SMS from the phone I carry, be able to respond to SMS via other devices. Right now the best option I have is to convince as many people I can to start using Signal.
ct520 7y ago
How reliable is it? Could it be used to replace non critical services twilio offers for say small business?
g82918 7y ago
I am interested!
nimbius 7y ago
Some responses: Its reliable enough to pay my credit card bills over the phone using public bus WiFi SMS is trickier as I only know enough programming to write a script in bash to send sms. I can't send pictures or videos, so I try to convince friends to use signal instead. 911 works with no sim card, as required by federal law. I do have working SMS to email however, so viewing SMS is a piece of cake :)
fredmonroe 7y ago
i'm interested too.
dsd 7y ago
If you were to get a plan on a cheap mvno with a second phone number, would it work as seamlessly as if your main number were tied to your SIM?

3xblah 7y ago

I see these problems from a different angle than the usual commentators. I continue to ask myself: Why is mobile used for important things, e.g., banking, payments, etc.? A great example is authenticating a person's identity via possession of a SIM card, i.e., their mobile number. If one can switch SIM cards, then one can switch identities. This flexibility is not a flaw in mobile communications; the ease-of-use is what makes mobile so useful. However it is silly to pretend mobile is as safe as landline for all uses. Mobile may be altogether more useful than landline -- few could argue otherwise -- and at the same time it can be entirely inappropriate for use in important things like banking. This concept seems non-existant. Instead the prevailing thinking is all-or-nothing. In addition to "convenience", mobile has introduced a new class of problems when used for important things like banking and payments. These problems either do not exist or exist at a much lower scale with respect to landline. Who owns landline service? Crooks? From where I stand, the risks of using mobile for important transactions outweigh the benefits. Unfortunately, I also see that "convenience" continues to prevail over common sense. I am willing to sacrafice convenience for peace of mind. Meanwhile banks and others push harder and harder for customers to use mobile, including as a means of verifying identity.

wvenable 7y ago
> These problems either do not exist or exist at a much lower scale with respect to landline. Except for an ever-growing amount of the population doesn't have a landline -- only mobile.
- umeshunni 7y ago
  The vast majority of people do not have a land line. Per World Bank data, there are 12 landlines per 100 people and 102 mobile lines per 100 people.
  - 3xblah 7y ago
    What are the statistics for businesses? How many landlines per business entity? Are the vast majority of businesses using cellphones exclusively? Why not?

KirinDave 7y ago

I didn't know AT&T was just selling real time data in defiance of the FCC rules and I'm quite inclined to just terminate my service after holding an account for nearly 20 years with them over it. That's beyond unacceptable.

the_arun 7y ago

I liked the smart title of this article!

iflywithbook 7y ago

Great piece of content. First time I read something in krebsonsecurity Love the combination of investigation and cybersecurity.

calvano915 7y ago

Are any providers offering an opt-in SIM freeze of sorts with some kind of enhanced authentication in order to unfreeze? Wouldn't such a feature/service easily prevent the SIM-swap risk? I don't know how easy this is to prevent regarding the infrastructure (do networks detect a SIM-swap via change in host IMEI?). I understand the article describes a rogue employee but it seems to me that an added layer for such a service could easily prevent unauthorized access.