9 ms·

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address o

by adrr 7y ago

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

fastball 7y ago
Photo ID seems like enough, no?
- adrr 7y ago
  Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.
  - rahuldottech 7y ago
    This is not true everywhere. There are Aadhar cards in India where you can confirm your identity with biometrics at any store using government-provided equipment that many stores have.
  - willvarfar 7y ago
    I’m not in the US, but the only ID card without a chip that I can think of here is a European driving license, which is just a plastic credit-card-sized thing that is often used as informal verification eg to collect a parcel.
  - PeterisP 7y ago
    That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. I mean, in Europe if criminals want to get a bunch of stuff on credit from some place with a disposable identity, they generally recruit poor/homeless people with real IDs, because that is simpler/cheaper/safer than trying to do it with counterfeit IDs. SMS hijacking, just as the core identity theft issue is so much rare elsewhere - it demonstrates that it's a solvable issue if the USA wanted to solve it. (in some sense the discussion on identity theft reminds me of https://www.theonion.com/no-way-to-prevent-this-says-only-nation-where-this-r-1819580358 https://www.theonion.com/no-way-to-prevent-this-says-only-na...) However, the straightforward way to do that would require a proper single centralized (i.e. federal) gov't ID issued to almost all people, which seems to be anathema in USA.
    - vladvasiliu 7y ago
      I have a counterpoint from my experience in France. A few years back I have lost my phone and went to get a new SIM. The attendant in the shop only had a quick look over my ID card. He didn't scan it nor did he enter the ID number in the computer to check anything. I think he only verified that the name was the same as the one on file and the photo looked like me. The same happens at the post office when you go to collect a parcel / registered mail. On the other hand, in almost every bar I've been, staff would do a quick check with a pen on every 50 € note they would get, and those notes are fairly common (two cocktails in a random bar in Paris can often cost more than 20 €). I don't know how effective that is in actually detecting counterfeit bills, but there's clearly more effort that what the other clerk did.
      - tialaramex 7y ago
        The pen contains a chemical that interacts with the paper that's always used to make these bank notes. Specifically it blackens the starch found in wood pulp, and the paper in your laser printer, photocopier, etcetera uses wood pulp because that's cheap. Bank notes use a higher quality paper and so they aren't turned black. This forces crooks to use more expensive and traceable high quality papers for their counterfeit notes or they'll get rejected in stores and bars. Having IDs that actually look up to anything at all is a relatively modern idea. When I was born if you suspected a passport in my country of being bogus it'd probably take a bunch of clerks several hours of physically looking through filing cabinets to check. And where we build systems that can check often people don't. The UK government built a system which lets a driver prove to the government who they are and then get a token value back which they can give to anyone - that token can be exchanged for viewing the government records for that driver. So e.g. hire firms could insist on this token to see you're not disqualified and actually have the entitlements your physical driving license says you have. They don't. Some of them will let you give them this token reluctantly but all prefer you give them a print out, which obviously you could just fake.
        ahaseeb 7y ago
        I still think the system is very much gameable. In US atleast it'll take lot of time. We still have to swipe cards and checks are accepted
  - scintill76 7y ago
    $200 and greater risk of getting caught -- that's still a step forward. Right now it only takes sitting at home spending a few cents to call customer service and social engineering them.
  - pta2002 7y ago
    Not necessarily, all IDs here in Portugal have a chip that can be used to verify its authenticity.
  - fastball 7y ago
    My DL has a barcode that can be swiped. They already use it at grocery stores to confirm that you are over 21 and that it's a real ID.
    - Nextgrid 7y ago
      Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature? Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.
      - fastball 7y ago
        I can almost guarantee it's not the latter.
        wool_gather 7y ago
        You would lose; the barcodes are just machine-readable packaging of the information already on the licenses: name, DOB, address, etc.
Lucadg 7y ago
What if you are abroad? My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.
- ozim 7y ago
  Before you go abroad you could notify your bank. Then in period you declared you are abroad they should lower expectation from "in person and ID" to phone call and other means of verification. After that period you are automatically back to normal security. That is for example how my debit card works. If I want to use it abroad I have to turn that feature on for whatever time I am abroad.
  - egwor 7y ago
    In Europe you have a telephone PIN codes, you have number generators on the app. There are lots of ways to authenticate yourself. IN Europe you no longer need to tell them whether you're abroad or not; I guess the ML algo's that monitor for fraud are so much better than before that this isn't needed.
    - frutiger 7y ago
      > IN Europe you no longer need to tell them whether you're abroad or not The same is true with my major US bank (and probably other banks too).
      - alamortsubite 7y ago
        YMMV. An ING ATM in Romania swallowed my gf's U.S. Santander card a couple months ago. We were told it was because she hadn't set a travel notice.
        ahaseeb 7y ago
        Losing a bank card isn't as critical as losing a phone # so companies have to act quickly. Think about it - Can you live without your bank card for few days vs living without your #
cortesoft 7y ago
I meant for the services currently relying on SMS for account recovery... for example, how should you recover your gmail account if you lose access?
- fauigerzigerk 7y ago
  Use backup verification codes and a recovery email address. Also, remember the date when you created your Google account. The best way to find that date may be to look at the first email you received in the account.
  - hanney 7y ago
    ".. a recovery email address" This just moves your security issues to another account.. how many layers of recovery email address are you willing to go before hitting the end?
    - fauigerzigerk 7y ago
      What you can do with email is move the problem to your most secure account or to an account that you know how to recover under essentially all circumstances.
      - ahaseeb 7y ago
        As I mentioned before that it's just convenience. SMS based authentication is flawed and is also prone to SS7 Attacks but people just do it because it's simple. Nothing in the world is hack proof
aiiane 7y ago
Cool. What store? Do all services that provide accounts need physical stores now? How do you ensure the store endpoints are trustworthy, and actually checking said IDs and SIMs?
ekianjo 7y ago
what store for online-only services?
- incompatible 7y ago
  Yes, like my mobile service is provided by a German supermarket chain that has outsourced the operation to somebody else, who run it as a virtual network over somebody else's cell network. The nearest of these supermarkets is hundreds of kilometres away, and the checkout operators are unlikely to be of much help.
chewz 7y ago
> Walk into a store and provide a government ID and the original SIM card. This is how it works in Poland since September 2019, after some recent SIM-swap attacks. You can swap SIM or get a replacement if stolen only at store showing government ID. It is free of charge with Orange and not always free with T-mobile. But this has some downsides in real life. 1) I had to walk my 88 yo Mom to the store to swap SIM card. 2) Every clerk at every shop can do that so for a determined criminal it is possible to bribe or threaten one. 3) Virtual operators (MVNOs) usually do not have physical locations and there is a dozen of them.
- istjohn 7y ago
  On your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant improvement. Your first drawback is substantial, though.
  - chewz 7y ago
    > criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.
    - paranoidrobot 7y ago
      Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-helped-sim-swap-hackers-rob-man-of-1-8-million-lawsuit-says/ https://arstechnica.com/tech-policy/2019/10/att-employees-he...
      - chewz 7y ago
        The clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.

by adrr 7y ago

Walk into a store and provide a government ID and the original SIM card. If customer doesn’t have the sim/phone, send a recovery code to the billing address on file in lieu of the SIM card.

fastball 7y ago

Photo ID seems like enough, no?

adrr 7y ago
Problem with a government photo ID, There's no way to verify its authentic besides a visual inspection. I consider them as secure as SMS 2FA. For $200 and someone could get passable ID with your name on it.
- rahuldottech 7y ago
  This is not true everywhere. There are Aadhar cards in India where you can confirm your identity with biometrics at any store using government-provided equipment that many stores have.
- willvarfar 7y ago
  I’m not in the US, but the only ID card without a chip that I can think of here is a European driving license, which is just a plastic credit-card-sized thing that is often used as informal verification eg to collect a parcel.
- PeterisP 7y ago
  That's the key problem that US needs to solve - the businesses don't really have a solid gov't ID system to fall back on. In most of Europe (UK seems to be more like USA as far as I understand) passing on a counterfeit ID to a mobile shop is harder (and more rare) than paying with counterfeit money, the IDs can be checked, employees are required to verify online if that ID has been reported lost or stolen, etc. I mean, in Europe if criminals want to get a bunch of stuff on credit from some place with a disposable identity, they generally recruit poor/homeless people with real IDs, because that is simpler/cheaper/safer than trying to do it with counterfeit IDs. SMS hijacking, just as the core identity theft issue is so much rare elsewhere - it demonstrates that it's a solvable issue if the USA wanted to solve it. (in some sense the discussion on identity theft reminds me of https://www.theonion.com/no-way-to-prevent-this-says-only-nation-where-this-r-1819580358 https://www.theonion.com/no-way-to-prevent-this-says-only-na...) However, the straightforward way to do that would require a proper single centralized (i.e. federal) gov't ID issued to almost all people, which seems to be anathema in USA.
  - vladvasiliu 7y ago
    I have a counterpoint from my experience in France. A few years back I have lost my phone and went to get a new SIM. The attendant in the shop only had a quick look over my ID card. He didn't scan it nor did he enter the ID number in the computer to check anything. I think he only verified that the name was the same as the one on file and the photo looked like me. The same happens at the post office when you go to collect a parcel / registered mail. On the other hand, in almost every bar I've been, staff would do a quick check with a pen on every 50 € note they would get, and those notes are fairly common (two cocktails in a random bar in Paris can often cost more than 20 €). I don't know how effective that is in actually detecting counterfeit bills, but there's clearly more effort that what the other clerk did.
    - tialaramex 7y ago
      The pen contains a chemical that interacts with the paper that's always used to make these bank notes. Specifically it blackens the starch found in wood pulp, and the paper in your laser printer, photocopier, etcetera uses wood pulp because that's cheap. Bank notes use a higher quality paper and so they aren't turned black. This forces crooks to use more expensive and traceable high quality papers for their counterfeit notes or they'll get rejected in stores and bars. Having IDs that actually look up to anything at all is a relatively modern idea. When I was born if you suspected a passport in my country of being bogus it'd probably take a bunch of clerks several hours of physically looking through filing cabinets to check. And where we build systems that can check often people don't. The UK government built a system which lets a driver prove to the government who they are and then get a token value back which they can give to anyone - that token can be exchanged for viewing the government records for that driver. So e.g. hire firms could insist on this token to see you're not disqualified and actually have the entitlements your physical driving license says you have. They don't. Some of them will let you give them this token reluctantly but all prefer you give them a print out, which obviously you could just fake.
      - ahaseeb 7y ago
        I still think the system is very much gameable. In US atleast it'll take lot of time. We still have to swipe cards and checks are accepted
- scintill76 7y ago
  $200 and greater risk of getting caught -- that's still a step forward. Right now it only takes sitting at home spending a few cents to call customer service and social engineering them.
- pta2002 7y ago
  Not necessarily, all IDs here in Portugal have a chip that can be used to verify its authenticity.
- fastball 7y ago
  My DL has a barcode that can be swiped. They already use it at grocery stores to confirm that you are over 21 and that it's a real ID.
  - Nextgrid 7y ago
    Does the bar code act as a key to lookup a record in a central database, or does it just encode "I am 21, trust me" without any cryptographic signature? Unless it's the former it's as good as a standard paper ID as far as forgeries go. If anything, having it machine-readable decreases security as it means the person inspecting it spends less time looking at it and just scans it in a machine.
    - fastball 7y ago
      I can almost guarantee it's not the latter.
      - wool_gather 7y ago
        You would lose; the barcodes are just machine-readable packaging of the information already on the licenses: name, DOB, address, etc.

Lucadg 7y ago

What if you are abroad? My debit card was recently blocked and I had to wait until I went back, walked in the bank and show my face and ID.

ozim 7y ago
Before you go abroad you could notify your bank. Then in period you declared you are abroad they should lower expectation from "in person and ID" to phone call and other means of verification. After that period you are automatically back to normal security. That is for example how my debit card works. If I want to use it abroad I have to turn that feature on for whatever time I am abroad.
- egwor 7y ago
  In Europe you have a telephone PIN codes, you have number generators on the app. There are lots of ways to authenticate yourself. IN Europe you no longer need to tell them whether you're abroad or not; I guess the ML algo's that monitor for fraud are so much better than before that this isn't needed.
  - frutiger 7y ago
    > IN Europe you no longer need to tell them whether you're abroad or not The same is true with my major US bank (and probably other banks too).
    - alamortsubite 7y ago
      YMMV. An ING ATM in Romania swallowed my gf's U.S. Santander card a couple months ago. We were told it was because she hadn't set a travel notice.
      - ahaseeb 7y ago
        Losing a bank card isn't as critical as losing a phone # so companies have to act quickly. Think about it - Can you live without your bank card for few days vs living without your #

cortesoft 7y ago

I meant for the services currently relying on SMS for account recovery... for example, how should you recover your gmail account if you lose access?

fauigerzigerk 7y ago
Use backup verification codes and a recovery email address. Also, remember the date when you created your Google account. The best way to find that date may be to look at the first email you received in the account.
- hanney 7y ago
  ".. a recovery email address" This just moves your security issues to another account.. how many layers of recovery email address are you willing to go before hitting the end?
  - fauigerzigerk 7y ago
    What you can do with email is move the problem to your most secure account or to an account that you know how to recover under essentially all circumstances.
    - ahaseeb 7y ago
      As I mentioned before that it's just convenience. SMS based authentication is flawed and is also prone to SS7 Attacks but people just do it because it's simple. Nothing in the world is hack proof

aiiane 7y ago

Cool. What store? Do all services that provide accounts need physical stores now? How do you ensure the store endpoints are trustworthy, and actually checking said IDs and SIMs?

ekianjo 7y ago

what store for online-only services?

incompatible 7y ago
Yes, like my mobile service is provided by a German supermarket chain that has outsourced the operation to somebody else, who run it as a virtual network over somebody else's cell network. The nearest of these supermarkets is hundreds of kilometres away, and the checkout operators are unlikely to be of much help.

chewz 7y ago

> Walk into a store and provide a government ID and the original SIM card. This is how it works in Poland since September 2019, after some recent SIM-swap attacks. You can swap SIM or get a replacement if stolen only at store showing government ID. It is free of charge with Orange and not always free with T-mobile. But this has some downsides in real life. 1) I had to walk my 88 yo Mom to the store to swap SIM card. 2) Every clerk at every shop can do that so for a determined criminal it is possible to bribe or threaten one. 3) Virtual operators (MVNOs) usually do not have physical locations and there is a dozen of them.

istjohn 7y ago
On your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant improvement. Your first drawback is substantial, though.
- chewz 7y ago
  > criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.
  - paranoidrobot 7y ago
    Or like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-helped-sim-swap-hackers-rob-man-of-1-8-million-lawsuit-says/ https://arstechnica.com/tech-policy/2019/10/att-employees-he...
    - chewz 7y ago
      The clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.