7 ms·

While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mo

by stirlo 7y ago

While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system like that can never be secure.

anticensor 7y ago
Or do it like Turkey, and require central clearance with physical SIM replacement (this is required both for ownership and porting transfers). One of the few things we got right.
- spuz 7y ago
  How does this work? You have to send in your old sim before you can receive a new one? What if you lose your old sim?
  - Cthulhu_ 7y ago
    > What if you lose your old sim? I'd say it's pretty simple then: you can't transfer your number and just need to get a new one. I mean at some point you have to draw a line; losing your password and resetting it via email is already a pretty gracious thing, and most support desks will help you beyond the default password reset as well if necessary. But at some point you have to draw a line - key's lost? Access is lost.
    - TeMPOraL 7y ago
      I think this is going too far. It's easy to lose your SIM - in particular, whenever you lose your phone (you left it somewhere, it fell into a river, etc.). Why not just require that if you don't have your old SIM on you, you have to jump through extra hoops involving physically showing government-issued documents and otherwise leaving enough paper trail for the police to find and jail you if it turns out you were a fraud?
      - acqq 7y ago
        > Why not Maybe the laws don’t consider that a serious enough crime to even investigate the cases?
      - CrLf 7y ago
        The last time I got my SIM reissued (the old one was too big for my new phone), I had the old SIM with me and I still had to show government-issued documents matching the registered SIM owner.
      - scarface74 7y ago
        That still doesn’t help. Who are you showing your physical ID to? The store clerk at the carrier store? There have been cases where the clerk was in on the fraud.
    - soulofmischief 7y ago
      We keep keys safe at home in the closet or under the mattress. We take our phones everywhere. Such a policy would be a usability nightmare. Even if someone's phone is locked and useless, you could steal it, dispose of it, and cause a lot of grief.
    - hgoel 7y ago
      That kinda ruins the main utility of the system for most people. People aren't switching service providers often or SIM sizes at all these days (the latter especially with larger SIMs just being the same nanoSIM but with an adapter of sorts around it). For the average person, the best utility of it is being able to retain your number on losing your device. Usually you aren't expecting to lose your device, so imagine how much more complicated everything gets when not only do you have to worry about getting a new one unexpectedly, but then also have to get a new number, inform everyone you know about that, and then update all your accounts. All of that just to protect people from being targeted by fraud that is not only very unlikely to happen to them unless they're well known, but is also better resolved by making authentication systems smarter.
    - celticninja 7y ago
      That's ridiculous to suggest as a solution and that's why it won't be adopted. Better to work on an alternative solution that has a better chance of adoption.
    - mffnbs 7y ago
      I would so much rather lose my twitter account where: a) I don't use twitter, so it's a loss of minimal proportions b) It's twitter's fault and easily prevented by them Sure, a) won't be applicable to all services because there are services I actually use that my life revolves around. However, the only service I can think of that would disrupt more of my life than losing my phone number is verified 2FA secured and does not have this vulnerability. I would actively avoid a carrier that promotes this policy and think it's naive to assert that it's even remotely viable.
- ninjaoxygen 7y ago
  I feel like a time delay would help with this too. If it takes an extra 24 hours and you get notifications by SMS and email during that period with the chance to call "fraud" it stops most of these attacks which take control of e-mail and phone simultaneously. I get that makes life much more difficult when you are travelling and have your phone (and therefore SIM) stolen, but given the severity of the current issues it seems minimal disruption. You get a burner phone for 24 hours?
  - floatboth 7y ago
    Porting takes over a week in Russia. You get a new SIM instantly, but it has a temporary number. Then you get notifications via SMS on your old SIM, you usually get a call from your old carrier trying to get you to stay, offering discounts and shit. Then after 7-14 days the new SIM gets the old number and the old SIM stops working. The U.S. system sounds horrifically irresponsible. // Replacement with the same carrier is quick, but requires physical presence with government ID (passport)
    - anticensor 7y ago
      Same in Turkey (takes 2-6 days), but you get your replacement SIM after the transfer is cleared, you still use your old carrier and SIM during porting porting. Old one simply gets inoperable by a remote command.
      - floatboth 7y ago
        Yeah, you can use the old SIM during porting here too, but you can also use the new one with a temp number.
    - celticninja 7y ago
      In the UK it is usually 24-48 hours but both numbers gets texts about the impending switch to a new SIM.
  - matwood 7y ago
    > I feel like a time delay would help with this too. It used to take a long time and the carriers caught grief for making it hard for people to port out to another carrier.
nialv7 7y ago
> “Never transfer my Number” flag what if you actually want to transfer your number?
- scep12 7y ago
  OP's intent was clear, at least to me: never transfer my number on the phone. Require it to be in person with some stronger form of identification.
  - matwood 7y ago
    The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?
    - celticninja 7y ago
      It could be done remotely but only if the store had signed off that ID had been viewed and the port confirmed in person. Of course this could be gamed but an employee would need to put their name on the line to say they had met the person and viewed the ID
      - deleted 7y ago
        [deleted]
      - dboreham 7y ago
        We have a <major us carrier> rep (as a business customer) and he will port our lines and change SIMs for me based on an email. However I noticed the last time I initiated one of these requests there was a confirmation step that involved an email sent to me with a URL I had to click to approve. From memory I don't believe that URL needed authentication so the email was a bearer instrument. An attacker would need to both fake my outgoing email (easy) and also intercept incoming email (not so easy). There was also a confirmation email sent advising that the request had been approved and processed. I can imagine however that an admin at a reasonably large business would receive several of these emails per day and may just reflexively click on them all. Note these emails are sent to the business account admin, not the end-user. I happen to be both so can see both sides of the process. Edit: I should also add that I have never met this rep and so he has definitely not looked at my government ID. The process is secured only by receipt of email.
DCKing 7y ago
The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better than no 2FA [1]. [1]:https://security.googleblog.com/2019/08/understanding-why-phishing-attacks-are.html https://security.googleblog.com/2019/08/understanding-why-ph...
- mmaunder 7y ago
  Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is. A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key. SMS does not verify this and the factor is not something you have. Instead, SMS is more like "something loosely associated with you that is transferrable and vulnerable to social engineering attacks". Anything is better than nothing. However this may be worse because it provides a false sense of security. https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa96f8ab33e029.jpg https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa...
  - DCKing 7y ago
    Although I agree that in some cases SMS 2FA provides a false sense of security, this argument misses the economy of the attacks here. It's not that black and white. Any attacks on phone numbers are spearphishing, almost my definition. Some form of identity fraud - no matter how easy it is for an attacker - must be performed in phone number stealing. Even if it's very easy, that's a significant cost for an attacker and not an easily scalable attack. I agree that SMS 2FA must never be presented as an effective means to thwart spearphishing, where attackers are willing to put in this effort. Now in the real world, password reuse attacks are far more common, and an commonly bigger concern for a random online accounts system. SMS 2FA can be of really big help there.
  - 7y ago
jschwartzi 7y ago
T-Mobile lets you set a PIN that you have to present if you want to port your number or get a new SIM. They sent out mass texts about it a couple of years ago.
- notyourday 7y ago
  The problem is that it is not enforced by the automated system. Instead it is enforced by sales people who have ability to override the system, including people like the blue shirts at Best Buy. Yes, they are not supposed to, but they can.
rtkwe 7y ago
I thought number portability was only a between carriers thing. SIM swapping doesn't cross the carrier border usually so would setting that flag actually fix anything?
parliament32 7y ago
That's how domain registrars work. You set a "lock" so the domain can't be transferred away until you "unlock". Then you can tie this locking/unlocking procedure to 2FA, identify verification, whatever.

by stirlo 7y ago

anticensor 7y ago

Or do it like Turkey, and require central clearance with physical SIM replacement (this is required both for ownership and porting transfers). One of the few things we got right.

spuz 7y ago
How does this work? You have to send in your old sim before you can receive a new one? What if you lose your old sim?
- Cthulhu_ 7y ago
  > What if you lose your old sim? I'd say it's pretty simple then: you can't transfer your number and just need to get a new one. I mean at some point you have to draw a line; losing your password and resetting it via email is already a pretty gracious thing, and most support desks will help you beyond the default password reset as well if necessary. But at some point you have to draw a line - key's lost? Access is lost.
  - TeMPOraL 7y ago
    I think this is going too far. It's easy to lose your SIM - in particular, whenever you lose your phone (you left it somewhere, it fell into a river, etc.). Why not just require that if you don't have your old SIM on you, you have to jump through extra hoops involving physically showing government-issued documents and otherwise leaving enough paper trail for the police to find and jail you if it turns out you were a fraud?
    - acqq 7y ago
      > Why not Maybe the laws don’t consider that a serious enough crime to even investigate the cases?
    - CrLf 7y ago
      The last time I got my SIM reissued (the old one was too big for my new phone), I had the old SIM with me and I still had to show government-issued documents matching the registered SIM owner.
    - scarface74 7y ago
      That still doesn’t help. Who are you showing your physical ID to? The store clerk at the carrier store? There have been cases where the clerk was in on the fraud.
  - soulofmischief 7y ago
    We keep keys safe at home in the closet or under the mattress. We take our phones everywhere. Such a policy would be a usability nightmare. Even if someone's phone is locked and useless, you could steal it, dispose of it, and cause a lot of grief.
  - hgoel 7y ago
    That kinda ruins the main utility of the system for most people. People aren't switching service providers often or SIM sizes at all these days (the latter especially with larger SIMs just being the same nanoSIM but with an adapter of sorts around it). For the average person, the best utility of it is being able to retain your number on losing your device. Usually you aren't expecting to lose your device, so imagine how much more complicated everything gets when not only do you have to worry about getting a new one unexpectedly, but then also have to get a new number, inform everyone you know about that, and then update all your accounts. All of that just to protect people from being targeted by fraud that is not only very unlikely to happen to them unless they're well known, but is also better resolved by making authentication systems smarter.
  - celticninja 7y ago
    That's ridiculous to suggest as a solution and that's why it won't be adopted. Better to work on an alternative solution that has a better chance of adoption.
  - mffnbs 7y ago
    I would so much rather lose my twitter account where: a) I don't use twitter, so it's a loss of minimal proportions b) It's twitter's fault and easily prevented by them Sure, a) won't be applicable to all services because there are services I actually use that my life revolves around. However, the only service I can think of that would disrupt more of my life than losing my phone number is verified 2FA secured and does not have this vulnerability. I would actively avoid a carrier that promotes this policy and think it's naive to assert that it's even remotely viable.
ninjaoxygen 7y ago
I feel like a time delay would help with this too. If it takes an extra 24 hours and you get notifications by SMS and email during that period with the chance to call "fraud" it stops most of these attacks which take control of e-mail and phone simultaneously. I get that makes life much more difficult when you are travelling and have your phone (and therefore SIM) stolen, but given the severity of the current issues it seems minimal disruption. You get a burner phone for 24 hours?
- floatboth 7y ago
  Porting takes over a week in Russia. You get a new SIM instantly, but it has a temporary number. Then you get notifications via SMS on your old SIM, you usually get a call from your old carrier trying to get you to stay, offering discounts and shit. Then after 7-14 days the new SIM gets the old number and the old SIM stops working. The U.S. system sounds horrifically irresponsible. // Replacement with the same carrier is quick, but requires physical presence with government ID (passport)
  - anticensor 7y ago
    Same in Turkey (takes 2-6 days), but you get your replacement SIM after the transfer is cleared, you still use your old carrier and SIM during porting porting. Old one simply gets inoperable by a remote command.
    - floatboth 7y ago
      Yeah, you can use the old SIM during porting here too, but you can also use the new one with a temp number.
  - celticninja 7y ago
    In the UK it is usually 24-48 hours but both numbers gets texts about the impending switch to a new SIM.
- matwood 7y ago
  > I feel like a time delay would help with this too. It used to take a long time and the carriers caught grief for making it hard for people to port out to another carrier.

nialv7 7y ago

> “Never transfer my Number” flag what if you actually want to transfer your number?

scep12 7y ago
OP's intent was clear, at least to me: never transfer my number on the phone. Require it to be in person with some stronger form of identification.
- matwood 7y ago
  The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?
  - celticninja 7y ago
    It could be done remotely but only if the store had signed off that ID had been viewed and the port confirmed in person. Of course this could be gamed but an employee would need to put their name on the line to say they had met the person and viewed the ID
    - deleted 7y ago
      [deleted]
    - dboreham 7y ago
      We have a <major us carrier> rep (as a business customer) and he will port our lines and change SIMs for me based on an email. However I noticed the last time I initiated one of these requests there was a confirmation step that involved an email sent to me with a URL I had to click to approve. From memory I don't believe that URL needed authentication so the email was a bearer instrument. An attacker would need to both fake my outgoing email (easy) and also intercept incoming email (not so easy). There was also a confirmation email sent advising that the request had been approved and processed. I can imagine however that an admin at a reasonably large business would receive several of these emails per day and may just reflexively click on them all. Note these emails are sent to the business account admin, not the end-user. I happen to be both so can see both sides of the process. Edit: I should also add that I have never met this rep and so he has definitely not looked at my government ID. The process is secured only by receipt of email.

DCKing 7y ago

The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better than no 2FA [1]. [1]:https://security.googleblog.com/2019/08/understanding-why-phishing-attacks-are.html https://security.googleblog.com/2019/08/understanding-why-ph...

mmaunder 7y ago
Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is. A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key. SMS does not verify this and the factor is not something you have. Instead, SMS is more like "something loosely associated with you that is transferrable and vulnerable to social engineering attacks". Anything is better than nothing. However this may be worse because it provides a false sense of security. https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa96f8ab33e029.jpg https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa...
- DCKing 7y ago
  Although I agree that in some cases SMS 2FA provides a false sense of security, this argument misses the economy of the attacks here. It's not that black and white. Any attacks on phone numbers are spearphishing, almost my definition. Some form of identity fraud - no matter how easy it is for an attacker - must be performed in phone number stealing. Even if it's very easy, that's a significant cost for an attacker and not an easily scalable attack. I agree that SMS 2FA must never be presented as an effective means to thwart spearphishing, where attackers are willing to put in this effort. Now in the real world, password reuse attacks are far more common, and an commonly bigger concern for a random online accounts system. SMS 2FA can be of really big help there.
- 7y ago

jschwartzi 7y ago

T-Mobile lets you set a PIN that you have to present if you want to port your number or get a new SIM. They sent out mass texts about it a couple of years ago.

notyourday 7y ago
The problem is that it is not enforced by the automated system. Instead it is enforced by sales people who have ability to override the system, including people like the blue shirts at Best Buy. Yes, they are not supposed to, but they can.

rtkwe 7y ago

I thought number portability was only a between carriers thing. SIM swapping doesn't cross the carrier border usually so would setting that flag actually fix anything?

parliament32 7y ago

That's how domain registrars work. You set a "lock" so the domain can't be transferred away until you "unlock". Then you can tie this locking/unlocking procedure to 2FA, identify verification, whatever.