Great paper. It covers common attacks and highlights the dangers of SMS 2FA and phone number based identities. The two carriers in this study, TMobile and Veriz

Great paper. It covers common attacks and highlights the dangers of SMS 2FA and phone number based identities. The two carriers in this study, TMobile and Verizon, changed their practices in response to this study: > In October 2020 we provided an initial notification of our findings to the carri- ers we studied and to CTIA, the U.S. trade association repre- senting the wireless communications industry. > In December 2020, T-Mobile informed us that after review- ing our research, it had updated its number change support page to 1) remind subscribers to update their contact number on bank accounts and social media profiles, and 2) specify the FCC-mandated number aging period. Along with raising subscriber awareness, it also informed us that customer ser- vice agent manuals had been updated to emphasize those two points during relevant interactions, effective early December.1 > In December 2020, CTIA informed us that after reviewing our research, Verizon had updated its public-facing support document for number cancellations, suspensions, and transfers to 1) remind subscribers to update their contacts and unlink their business and online accounts, and 2) specify the FCC- mandated minimum aging period (45 days).2