4 ms·
On your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant impr
by istjohn 7y ago
On your second point, a determined criminal could always deploy rubber-hose cryptanalysis on a 2-factor authentication scheme, but it's still a significant improvement.
Your first drawback is substantial, though.
- chewz 7y ago> criminal could always deploy rubber-hose cryptanalysis That would be smart criminal with means. I was thinking more of a hood with fat neck passing $20 to clerk assistant to obtain SIM for $5k fraud.
- paranoidrobot 7y agoOr like the recent case where it's alleged that carrier employees were actually in on SIM swap scams. https://arstechnica.com/tech-policy/2019/10/att-employees-helped-sim-swap-hackers-rob-man-of-1-8-million-lawsuit-says/ https://arstechnica.com/tech-policy/2019/10/att-employees-he...
- chewz 7y agoThe clerk is looking at ID and comparing with data in the system. If bribed he can always claim that ID looked legit or he made honest mistake. So easy for evildoers and so much friction for law-abiding customers.
- ryanlol 7y agoI think most people fail to realize that excellent fake IDs cost like $50. (A tad more in the EU because of the lower drinking age)
- adrr 7y agoIf you make the carrier liable for damages in case of fraud, there would be process to mitigate the risk from one bad actor. Like the bank requires a manager approval for certain high risk transactions like international wires.
- ahaseeb 7y agoToo long of a moon shot. Generally the T&C are limited to actual loss, like you lost your internet for 2 days so they'll reimburse you for 2 days of bill but not if you lost a business deal. Similarly in case of airline if you missed your game. they're not responsible for the game tickets