7 ms·

Too many services use phone numbers as the keys to the kingdom. It's a convenient and stable identifier, but holy shit it's not designed for security at all.

dheera 6y ago
Yep, I hate this with a passion. I deprecated text messaging a decade ago, too. Anyone who thinks they can reach me by some ancient 140-character mobile-operator-controlled service, it's their fault for not getting with the beat in 2021.
lostlogin 6y ago
The whole 2 factor thing really falls down if sms is a part and you aren’t getting the messages. I had a miserable time trying to get into Backblaze recently, with even the ability it offered to switch sms providers failing. The list of valid keys they give you on setup bailed me out eventually, but it took me a while to remember them.
- InvertedRhodium 6y ago
  > remember them Uh. You're supposed to memorise them? I printed them out and stuck them in a safe place.
  - late2part 6y ago
    I put mine on stickies on my laptop. Or if they're really important on a sticky in my desk drawer.
  - wlesieutre 6y ago
    Maybe “remember that they exist”? I can’t imagine remembering those.
  - lostlogin 6y ago
    I laughed when I saw this. It took me a while to remember I had the backup codes. I hadn’t memorised them.
lxgr 6y ago
It's neither convenient nor stable for anyone moving between countries either. When given the choice between a service that uses my phone number as my permanent user identifier and one that uses my email, I'll always go for the latter. Unfortunately, big parts of the industry seem to be headed the other direction.
- firecall 6y ago
  International relocation is a very good point! Something I hadnt considered. Thanks!
- ronnier 6y ago
  I just transferred my phone number to google voice when I moved out of the country. When I moved it back I simply transfer it back to my carrier
  - bravura 6y ago
    There seem to be horror stories on reddit about Google Voice numbers being terminated for people out of the country too long. Is there a stable inexpensive phone number service for folks that are outside the US a lot?
    - cheriot 6y ago
      I used the Republic Wireless wifi only service for $5/month. Still more expensive than it _needs_ to be, but well worth it.
    - 0x38B 6y ago
      I've been looking into Google Voice alternatives, and https://voip.ms/ https://voip.ms/ looks good.
      - kevincox 6y ago
        I've been using voip.ms and it is fairly good. I wish the SMS support was a bit better but it does reliable deliver messages to email or SIP. (Large messages are not re-joined though and sending is based off of a code in the subject instead of an email address per-number which could be easily be added to an address book)
com2kid 6y ago
This is about complete takeover of SMS for a phone number. The threat model is beyond 2FA, imagine being able to impersonate anyone over text. Social engineering gone to the next level. This isn't about just taking over accounts, it is about taking over a huge chunk of someone's social existence.
- jhugo 6y ago
  I realise TFA is about the US, but it’s worth noting that in most of the world, SMS is pretty much just used for receiving messages from your bank and other automated stuff these days.
  - jfrunyon 6y ago
    Sure, and instead, people use apps like Signal or WhatsApp, which are tied to phone numbers, on which the attacker can now register to your phone number thanks to his receiving your SMS...
    - jhugo 6y ago
      Absolutely. Was just responding to SMS being a direct part of people's "social existence", which it really isn't in most of the world. As you say, though, it's one step away from things that are in fact directly used for communication.
    - tialaramex 6y ago
      If you tell Signal not to allow anybody else to re-register from your phone number without your PIN it will enforce this until at least seven days passes without you using Signal. If you've uninstalled Signal or just never use your phone then yeah, after a week or so this proposed attack "works" and the safety numbers for any ongoing conversations with anybody reset (the attacker doesn't know the long term identity key for your phone so they'll get a new one, thus generating a different safety number), which will be notified to the other participants although since you presumably never use Signal there may not be any such conversations.
mikem170 6y ago
Agreed. Users have it in their power not to use services that require a phone number for SMS verifcation.
- bluGill 6y ago
  But we often don't. I just got my covid shot and with it a request to sign up for vsafe, which needs a phone number. (Which means i can't sign up since I have anti spam protection on and so their texts don't get through )
  - mikem170 6y ago
    Tell them you have no phone. It seems to disarm people. You're not telling that you refuse their request, and getting into a power struggle. Then ask them if that means you can't get a vaccination or whatever. This has worked every time so far for me. It doesn't get easier. It probably would if more of us did it, though.
    - bluGill 6y ago
      I got the vaccine not problem. With the vaccine came a sheet of paper requesting I sign up for vsafe which is a program unrelated to those giving the vaccine. It is probably useful to sign up, so I tried, but there wasn't an option of no phone, or at least not until it was too late.
- SilverRed 6y ago
  The local government here has a covid tracking system that uses SMS verification and many stores won't let you in without using it.
  - mikem170 6y ago
    I hear you, this comes up more and more often. I remember reading that Singapore had something like this (for contact tracing, I think), but they'd give you a dedicated device if you didn't have a phone. Ugh. I like telling companies who want my number: No, my phone is for people I know to call me, not corporations. Other times I tell them that I don't have a phone and ask them if they are refusing me service. Not saying I have a perfect record, sometimes it is convenient to have the mechanic call when the car is done, etc. But the more I see companies who don't need a dossier on me asking for my personal info the harder I want to push back. I seek out and appreciate organizations that don't do this. I joke that I might end up living in a commune one day! I can see this becoming a bigger problem. I've been following the idea of covid-vaccination-tracking applications, and don't have a good feeling about any of that. I'm expecting that the vaccination campaign will work well enough for that idea to be a moot point, but also expecting that companies and governments will want to do the extra tracking anyways, because their incentives are not aligned with the general population for stuff like this.
auslegung 6y ago
> It's a convenient and stable identifier It is not stable in the least for millions of Americans, especially those who live in poverty (I'm not sure about the rest of the world). Phones are lost or stolen, phone numbers changed because of being harassed by debt collectors, ex-partners, current partners, etc. And if it isn't stable, it isn't convenient.
- jfrunyon 6y ago
  My phone number changes every 2-3 years whenever I switch to a new carrier for their acquisition offer. Why would I port my old number when 9/10 people who call me, I don't want to be calling me? And heck, I don't exactly live in poverty, even if my (student and scum landlord) debt is significantly more than my assets.
- kevincox 6y ago
  It is better in the US as generally all plays are country-wide but as a Canadian my number has changed many times. - First number. - Moved to a different city for Uni. Switched number so that people didn't have to pay long-distance to call. - Moved back. - Move to Europe for a job. - Moved back. I would never consider an identifier that is (loosely) tied to your location stable.

dheera 6y ago

Yep, I hate this with a passion. I deprecated text messaging a decade ago, too. Anyone who thinks they can reach me by some ancient 140-character mobile-operator-controlled service, it's their fault for not getting with the beat in 2021.

lostlogin 6y ago

The whole 2 factor thing really falls down if sms is a part and you aren’t getting the messages. I had a miserable time trying to get into Backblaze recently, with even the ability it offered to switch sms providers failing. The list of valid keys they give you on setup bailed me out eventually, but it took me a while to remember them.

InvertedRhodium 6y ago
> remember them Uh. You're supposed to memorise them? I printed them out and stuck them in a safe place.
- late2part 6y ago
  I put mine on stickies on my laptop. Or if they're really important on a sticky in my desk drawer.
- wlesieutre 6y ago
  Maybe “remember that they exist”? I can’t imagine remembering those.
- lostlogin 6y ago
  I laughed when I saw this. It took me a while to remember I had the backup codes. I hadn’t memorised them.

lxgr 6y ago

It's neither convenient nor stable for anyone moving between countries either. When given the choice between a service that uses my phone number as my permanent user identifier and one that uses my email, I'll always go for the latter. Unfortunately, big parts of the industry seem to be headed the other direction.

firecall 6y ago
International relocation is a very good point! Something I hadnt considered. Thanks!
ronnier 6y ago
I just transferred my phone number to google voice when I moved out of the country. When I moved it back I simply transfer it back to my carrier
- bravura 6y ago
  There seem to be horror stories on reddit about Google Voice numbers being terminated for people out of the country too long. Is there a stable inexpensive phone number service for folks that are outside the US a lot?
  - cheriot 6y ago
    I used the Republic Wireless wifi only service for $5/month. Still more expensive than it _needs_ to be, but well worth it.
  - 0x38B 6y ago
    I've been looking into Google Voice alternatives, and https://voip.ms/ https://voip.ms/ looks good.
    - kevincox 6y ago
      I've been using voip.ms and it is fairly good. I wish the SMS support was a bit better but it does reliable deliver messages to email or SIP. (Large messages are not re-joined though and sending is based off of a code in the subject instead of an email address per-number which could be easily be added to an address book)

com2kid 6y ago

This is about complete takeover of SMS for a phone number. The threat model is beyond 2FA, imagine being able to impersonate anyone over text. Social engineering gone to the next level. This isn't about just taking over accounts, it is about taking over a huge chunk of someone's social existence.

jhugo 6y ago
I realise TFA is about the US, but it’s worth noting that in most of the world, SMS is pretty much just used for receiving messages from your bank and other automated stuff these days.
- jfrunyon 6y ago
  Sure, and instead, people use apps like Signal or WhatsApp, which are tied to phone numbers, on which the attacker can now register to your phone number thanks to his receiving your SMS...
  - jhugo 6y ago
    Absolutely. Was just responding to SMS being a direct part of people's "social existence", which it really isn't in most of the world. As you say, though, it's one step away from things that are in fact directly used for communication.
  - tialaramex 6y ago
    If you tell Signal not to allow anybody else to re-register from your phone number without your PIN it will enforce this until at least seven days passes without you using Signal. If you've uninstalled Signal or just never use your phone then yeah, after a week or so this proposed attack "works" and the safety numbers for any ongoing conversations with anybody reset (the attacker doesn't know the long term identity key for your phone so they'll get a new one, thus generating a different safety number), which will be notified to the other participants although since you presumably never use Signal there may not be any such conversations.

mikem170 6y ago

Agreed. Users have it in their power not to use services that require a phone number for SMS verifcation.

bluGill 6y ago
But we often don't. I just got my covid shot and with it a request to sign up for vsafe, which needs a phone number. (Which means i can't sign up since I have anti spam protection on and so their texts don't get through )
- mikem170 6y ago
  Tell them you have no phone. It seems to disarm people. You're not telling that you refuse their request, and getting into a power struggle. Then ask them if that means you can't get a vaccination or whatever. This has worked every time so far for me. It doesn't get easier. It probably would if more of us did it, though.
  - bluGill 6y ago
    I got the vaccine not problem. With the vaccine came a sheet of paper requesting I sign up for vsafe which is a program unrelated to those giving the vaccine. It is probably useful to sign up, so I tried, but there wasn't an option of no phone, or at least not until it was too late.
SilverRed 6y ago
The local government here has a covid tracking system that uses SMS verification and many stores won't let you in without using it.
- mikem170 6y ago
  I hear you, this comes up more and more often. I remember reading that Singapore had something like this (for contact tracing, I think), but they'd give you a dedicated device if you didn't have a phone. Ugh. I like telling companies who want my number: No, my phone is for people I know to call me, not corporations. Other times I tell them that I don't have a phone and ask them if they are refusing me service. Not saying I have a perfect record, sometimes it is convenient to have the mechanic call when the car is done, etc. But the more I see companies who don't need a dossier on me asking for my personal info the harder I want to push back. I seek out and appreciate organizations that don't do this. I joke that I might end up living in a commune one day! I can see this becoming a bigger problem. I've been following the idea of covid-vaccination-tracking applications, and don't have a good feeling about any of that. I'm expecting that the vaccination campaign will work well enough for that idea to be a moot point, but also expecting that companies and governments will want to do the extra tracking anyways, because their incentives are not aligned with the general population for stuff like this.

auslegung 6y ago

> It's a convenient and stable identifier It is not stable in the least for millions of Americans, especially those who live in poverty (I'm not sure about the rest of the world). Phones are lost or stolen, phone numbers changed because of being harassed by debt collectors, ex-partners, current partners, etc. And if it isn't stable, it isn't convenient.

jfrunyon 6y ago
My phone number changes every 2-3 years whenever I switch to a new carrier for their acquisition offer. Why would I port my old number when 9/10 people who call me, I don't want to be calling me? And heck, I don't exactly live in poverty, even if my (student and scum landlord) debt is significantly more than my assets.
kevincox 6y ago
It is better in the US as generally all plays are country-wide but as a Canadian my number has changed many times. - First number. - Moved to a different city for Uni. Switched number so that people didn't have to pay long-distance to call. - Moved back. - Move to Europe for a job. - Moved back. I would never consider an identifier that is (loosely) tied to your location stable.