5 ms·
This seems important: "Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at on
by roywiggins 7y ago
This seems important:
"Ring does not alert users of attempted log-in from an unknown IP address, or tell users how many others are logged into an account at one time. Because of this, there is no obvious way to know whether any bad actors have logged into people’s compromised Ring accounts without their consent."
I can understand not having 2FA turned on by default, but a bare minimum for this kind of service would be to alert users when someone successfully logs in from a new device.
- spamizbad 7y agoMy home security system, which is really... uh... crappy... manages to do this (provide both 2 factor and letting you know when someone logs in + changes the alarm state)
- walrus01 7y agoDue to the overwhelmingly high amount of attempted fraud in grey/black market VoIP stuff, it's pretty common for wholesale SIP trunking providers to now alert the account owner whenever the web account control panel is logged into from a new, unknown ISP and/or useragent.
- dvtrn 7y agoThese “boutique” SIP providers (as I call them, Telnyx, Voipo, VoIP.ms etc) could really learn from their larger telecom counterpoints by allowing users to whitelist what IP ranges users can even authenticate from. Heck, even Linode offers this.
- dboreham 7y agoVitelity has supported this for probably a decade.
- dvtrn 7y agoGood! It’s been a long while since I’ve managed anything clients using Vitelity trunks, but recall having a generally positive experience, glad to hear they still run a good ship to have at least this mechanism.
- pdonis 7y agoHow does this work if you're traveling? Logging in from a mobile phone?
- dvtrn 7y agoSelf-Managed VPN, in our case.
- walrus01 7y agoTypically you have your own IP pbx such as an asterisk system which lives in one place on static v4/v6 IPs, it connects to your upstream sip trunk. Your own clients such as zoiper on Android connect to that.
- Zod666 7y agoI thought about using asterisk or something but does that noticeable latency when connecting remotely? Right now I connect directly to my sip provider on the go via an android sip client whereas running my own PBX would add another hop and was concerned how much this impacts latency.
- dvtrn 7y agoI'll open myself up for correction on the matter, but it's been my experience that these days Asterisk is more useful as and often more commonly deployed as a feature server (hunt-groups, ring-groups, call trees etc), at least for a broad majority of use cases where SIP is even a part of the conversation. Personally I'd not recommend one try rolling their own Ast based phone system for production/enterprise unless you just really want to and have literally no other projects to deliver back to the org. Otherwise, what you're doing is perfectly fine and well enough: connect to your SIP trunk via credentials using a local client and you've more or less got a working, accessible phone number. Unless you truly have a need for Asterisk features, don't bother. I happen to know first hand of a "voice company" that has a pretty sizeable footprint in the travel/hospitality industry making several million dollars a year and one of their products amounts to nothing more than configuring IVRs and charging through the nose to host them using what is (in my opinion alone) a thoroughly overly-complicated Asterisk infrastructure and similarly overly-complicated dial plans.
- mmmarnell 7y agoTelnyx offers IP whitelisting for inbound and outbound dialing on its platform as well. https://sip.telnyx.com/ https://sip.telnyx.com/
- dvtrn 7y agoCorrect, though the commenter above and I were referring specifically to user interfaces where sensitive accounting details are stored and configured and would allow access to privileged systems and user controls.
- BelleOfTheBall 7y agoI've recently had a similar problem with Spotify. My account was stolen. In part because I did not have 2FA turned on... because the app doesn't offer it for some reason. And, in part, because whoever logged into my account from a different IP and device supposedly didn't trip any of their security measures. So I was never even told that someone took hold of my account until I tried to get on. It's baffling to me that any popular app wouldn't have 2FA (or any app, for that matter.)
- choward 7y ago2FA for spotify? I'm curious where you draw the line for 2FA. Should every app (and web app) have 2FA?
- lighthazard 7y agoI'd argue, in 2019, every app/service that requires a login should offer a 2FA option to add an additional layer of security - the person logging in most likely is the owner of the 2FA device.
- BelleOfTheBall 7y agoMaybe not every app but definitely one through which I make any type of payment. Spotify wants me to buy Premium, Spotify should offer me security.
- close04 7y agoIf it involves money (paid service, even if the hijacker never gets access to your actual card data and can't make any payments) or private data (name, address, etc.) then it really should.
- choward 7y agoI agree for the most part about the money part. I would still want the option for them to not allow me to upgrade plans without re-entering my credit card info. But with regards to personal information, that is almost everything I log into. And those companies share your personal info anyway, so it just gives you a false sense of privacy/security.
- hanniabu 7y agoTin foil hat theory: They purposely don't show you this stuff because their security is garbage and it'd alert too many people of their shortcomings and negligence.