4 ms·

My understanding is that the PUK is used to unlock a SIM that has become locked if too many incorrect SIM PINs were entered. The advantage of the attacker havi

My understanding is that the PUK is used to unlock a SIM that has become locked if too many incorrect SIM PINs were entered. The advantage of the attacker having a PUK is therefore that they could then physically put the SIM into their own phone, or use the SIM in the target's phone (if they have their phone PIN as well as the PUK). This of course means that they need to have physical possession of the target's SIM, and that the target needs to be unaware that their SIM has been taken, because as soon as they realize they don't have a SIM they'll obviously contact their carrier. So the adversarial use-case of having a PUK is pretty limited. Which in turn explains why the security in giving it out is comparatively low. I guess I'm not seeing the issue here too much. There are cases of social engineering carriers that are way more damaging.

schroeding 5y ago
The german carrier Telekom allows you to take posession (add it to your customer account as a "contract owner") of a phone number with just the PUK and a one-time code sent to the phone number via SMS. I guess many other carriers use the same system. You're then able to modify the contract and, for example, can get a second sim card. The affected phone number gets a "Welcome to our customer portal" message, but that's that. I actually used this to get access to my own phone number after losing access to the connected mail account. :-D
- Ansil849 5y ago
  > The german carrier Telekom allows you to take posession (add it to your customer account as a "contract owner") of a phone number with just the PUK and a one-time code sent to the phone number via SMS. I guess many other carriers use the same system. Ah, very interesting. I was unaware of this usage of the PUK. If it's used for account ownership authentication, then absolutely carriers should be treating it way more securely.

schroeding 5y ago

The german carrier Telekom allows you to take posession (add it to your customer account as a "contract owner") of a phone number with just the PUK and a one-time code sent to the phone number via SMS. I guess many other carriers use the same system. You're then able to modify the contract and, for example, can get a second sim card. The affected phone number gets a "Welcome to our customer portal" message, but that's that. I actually used this to get access to my own phone number after losing access to the connected mail account. :-D

Ansil849 5y ago
> The german carrier Telekom allows you to take posession (add it to your customer account as a "contract owner") of a phone number with just the PUK and a one-time code sent to the phone number via SMS. I guess many other carriers use the same system. Ah, very interesting. I was unaware of this usage of the PUK. If it's used for account ownership authentication, then absolutely carriers should be treating it way more securely.