4 ms·

Does that make it easy to steal phone numbers, and therefore identities?

by jonny_eh 7y ago

onion2k 7y ago
Based on the fact that never seems to happen, no.
- viraptor 7y ago
  What do you mean never? It has a name and is pretty common in Bitcoin exchange fraud: https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
  - nullymcnull 7y ago
    The specific UK mechanism that is the subject of this subthread was introduced in July; it's not what your wikipedia link describes (social engineering to get a number ported).
    - velox_io 7y ago
      I'm also in the UK, I've had the same phone number for at least a decade. It has been easy to carry your phone number to a new provider for as long as I can remember. You just contact your existing provider, tell them you wish to leave and need the PAC code. After they beg to stay and throw you a sweetheart deal. They'll send it via text or post.
      - abrugsch 7y ago
        you have been ABLE to do that for as long as I can remember (I've kept the same number since 2005 now on all the major networks. I only didn't keep my number prior to that because it was a work provided contract) but depending on which you were dealing with would put up a number of different obstacles when you contact them to make the process as painful as possible (to keep you as a customer... THREE I'm looking at you!) so the new automated SMS process introduced in July is a welcome addition
- mulmen 7y ago
  Didn't it happen to Jack Dorsey last week? https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twitter-blames-att-for-ceo-jack-dorsey-account-hack-sending-shocking-racist-tweets/#5b6b4c672e30 https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twi...
willvarfar 7y ago
The handset initiates it by sending an SMS to a shortcode. Shortcodes are phonenumbers that are carrier-specific e.g. the three digit code that you use to access your voicemail etc. The phone company knows the identity of the calling handset when it gets the text message with a high degree of certainty, as the handset is directly connected to its network. So the person doing the transfer has to be in procession of the phone, or able to spoof or clone the phone. Trivia: an attacker who redirects phonenumbers to gain access to a bank account https://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication https://williamedwardscoder.tumblr.com/post/24949768311/i-kn...

Does that make it easy to steal phone numbers, and therefore identities?

onion2k 7y ago

Based on the fact that never seems to happen, no.

viraptor 7y ago
What do you mean never? It has a name and is pretty common in Bitcoin exchange fraud: https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- nullymcnull 7y ago
  The specific UK mechanism that is the subject of this subthread was introduced in July; it's not what your wikipedia link describes (social engineering to get a number ported).
  - velox_io 7y ago
    I'm also in the UK, I've had the same phone number for at least a decade. It has been easy to carry your phone number to a new provider for as long as I can remember. You just contact your existing provider, tell them you wish to leave and need the PAC code. After they beg to stay and throw you a sweetheart deal. They'll send it via text or post.
    - abrugsch 7y ago
      you have been ABLE to do that for as long as I can remember (I've kept the same number since 2005 now on all the major networks. I only didn't keep my number prior to that because it was a work provided contract) but depending on which you were dealing with would put up a number of different obstacles when you contact them to make the process as painful as possible (to keep you as a customer... THREE I'm looking at you!) so the new automated SMS process introduced in July is a welcome addition
mulmen 7y ago
Didn't it happen to Jack Dorsey last week? https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twitter-blames-att-for-ceo-jack-dorsey-account-hack-sending-shocking-racist-tweets/#5b6b4c672e30 https://www.forbes.com/sites/jeanbaptiste/2019/08/31/why-twi...

willvarfar 7y ago

The handset initiates it by sending an SMS to a shortcode. Shortcodes are phonenumbers that are carrier-specific e.g. the three digit code that you use to access your voicemail etc. The phone company knows the identity of the calling handset when it gets the text message with a high degree of certainty, as the handset is directly connected to its network. So the person doing the transfer has to be in procession of the phone, or able to spoof or clone the phone. Trivia: an attacker who redirects phonenumbers to gain access to a bank account https://williamedwardscoder.tumblr.com/post/24949768311/i-know-someone-whose-2-factor-phone-authentication https://williamedwardscoder.tumblr.com/post/24949768311/i-kn...