5 ms·
Privacy flaw and a security flaw: it is feasible to take over somebody's phone number through social engineering attack on the phone co's tech support. The tech
by dexen 6y ago
Privacy flaw and a security flaw: it is feasible to take over somebody's phone number through social engineering attack on the phone co's tech support. The tech support has ability to issue replacement SIM cards for users, and if an attacker socially engineers them to send SIM card with your number to them, it's a game over for you.
That is aside of the obvious problem of phone numbers being recycled for re-issue after having been abandoned for a stretch of time.
- gaius_baltar 6y agoNot exactly a security flaw, as the new owner of the phone number won't have the original owner's secret keys (they never leave the phone, of course) and Signal will still send the messages to the previously authenticated client. Taking over a Signal account requires access to the phone number and the password used to register it (or waiting a week). And this will still not give the attacker access to the private keys; When these keys change, Signal will put an alert message on ongoing chats and ask for confirmation.