10 ms·

While this is factually correct, what you are missing is the point that most people have mobile phones these days, and their phone numbers are tied to a ton of

by talonx 6y ago

While this is factually correct, what you are missing is the point that most people have mobile phones these days, and their phone numbers are tied to a ton of other accounts and services. These include second factor auths (using text or voice calls) for other websites, bank accounts, social security ids (I'm not talking about the US), insurance policies - the list goes on. You would not want your number to be available to the general public - because that makes you vulnerable to social engineering attacks.

usr1106 6y ago
Here in Finland many if not most mobile phone numbers are in the phone book. Well, no physical book has been printed for years, but you can call directory enquiries or look them up online. Even reverse look-ups are possible. (Only an ever shrinking minority of households still owns a landline.) How exactly would that subvert 2FA via SMS? Except for calling and ask please read the SMS you just received for me. While that will work with some people, I am not worried in my case.
- anonymousiam 6y ago
  It subverts 2FA and SMS because of SIM hijacking. If a bad actor has your mobile number and you use that for 2FA, they can socially engineer (or bribe) a rep from your mobile company to assign your number to a new SIM/phone. This is a common attack these days. https://www.theverge.com/2019/5/11/18564381/community-hacking-sim-hijacking-cryptocurrency https://www.theverge.com/2019/5/11/18564381/community-hackin...
  - fckthisguy 6y ago
    To elaborate how easy this is: I did this recently in my own number after loosing the sim card. I just called up the phone company and convinced the customer service agent to assign the number to a new sim card I had just bought from the petrol station near my house. I provided no authentication for this and they had no way to prove I was the owner of the account. Took all of 5 minutes to pull off.

by talonx 6y ago

usr1106 6y ago

Here in Finland many if not most mobile phone numbers are in the phone book. Well, no physical book has been printed for years, but you can call directory enquiries or look them up online. Even reverse look-ups are possible. (Only an ever shrinking minority of households still owns a landline.) How exactly would that subvert 2FA via SMS? Except for calling and ask please read the SMS you just received for me. While that will work with some people, I am not worried in my case.

anonymousiam 6y ago
It subverts 2FA and SMS because of SIM hijacking. If a bad actor has your mobile number and you use that for 2FA, they can socially engineer (or bribe) a rep from your mobile company to assign your number to a new SIM/phone. This is a common attack these days. https://www.theverge.com/2019/5/11/18564381/community-hacking-sim-hijacking-cryptocurrency https://www.theverge.com/2019/5/11/18564381/community-hackin...
- fckthisguy 6y ago
  To elaborate how easy this is: I did this recently in my own number after loosing the sim card. I just called up the phone company and convinced the customer service agent to assign the number to a new sim card I had just bought from the petrol station near my house. I provided no authentication for this and they had no way to prove I was the owner of the account. Took all of 5 minutes to pull off.