3 ms·
> Walk into a store and provide a government ID and the original SIM card. This is how it works in Poland since September 2019, after some recent SIM-swap atta
by chewz 7y ago
> Walk into a store and provide a government ID and the original SIM card.
This is how it works in Poland since September 2019, after some recent SIM-swap attacks. You can swap SIM or get a replacement if stolen only at store showing government ID. It is free of charge with Orange and not always free with T-mobile.
But this has some downsides in real life.
1) I had to walk my 88 yo Mom to the store to swap SIM card.
2) Every clerk at every shop can do that so for a determined criminal it is possible to bribe or threaten one.
3) Virtual operators (MVNOs) usually do not have physical locations and there is a dozen of them.
- istjohn 7y agoOn your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant improvement. Your first drawback is substantial, though.
- chewz 7y ago> criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.
- paranoidrobot 7y agoOr like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-helped-sim-swap-hackers-rob-man-of-1-8-million-lawsuit-says/ https://arstechnica.com/tech-policy/2019/10/att-employees-he...
- chewz 7y agoThe clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.
- ryanlol 7y agoI think most people fail to realize that excellent fake IDs cost like $50. (A tad more in the EU because of the lower drinking age)
- adrr 7y agoIf you make the carrier liable for damages in case of fraud, there would be process to mitigate the risk from one bad actor. Like the bank requires a manager approval for certain high risk transactions like international wires.
- ahaseeb 7y agoToo long of a moon shot. Generally the T&C are limited to actual loss, like you lost your internet for 2 days so they'll reimburse you for 2 days of bill but not if you lost a business deal. Similarly in case of airline if you missed your game. they're not responsible for the game tickets
- Nextgrid 7y agoThe problem is that the ID is still checked by the clerk. They could be bribed or tricked by a fake ID. A recovery code snail-mailed/e-mailed to the account holder when they first open the account is the correct way to go, and if they can't provide it they need to go through a lengthy process where many factors are used to authenticate them (verify their physical address, verify their ID, ask to confirm last call records, billing details, etc).
- tinus_hn 7y agoYou can require the clerk to note the document ID to avoid bribery.
- pas 7y agoHow would this work exactly?
- tinus_hn 7y agoThe clerk has to use some kind of online system to connect the new sim to the customers phone number. The system would obviously require the clerk to authenticate himself and could require him to enter the passport number or other document ID he checked to verify the customers identity. If later it turns out this was a sim swapping attack you can verify if the clerk entered a valid document ID. He can’t do that without having been presented a proper document, so you can tell if he checked.
- ahaseeb 7y agoIts just convenience over security. Lot of things can be done but then the extra burden that companies have to go through. Think about that people don't use app based authentication because it's inconvenient even though it matters to them. How can you expect carriers to do it
- tinus_hn 7y ago