6 ms·
> ... the attackers had to perform a "SIM swap" type attack on the users Minor nitpick: I find your framing problematic as it transfers "burden of security" to
by sangnoir 5y ago
> ... the attackers had to perform a "SIM swap" type attack on the users
Minor nitpick: I find your framing problematic as it transfers "burden of security" to the end-users over a process that did not involve them: this was not an attack on the users - it was an attack on the telecoms infrastructure.
I have a similar gripe against "identity theft", which really ought to be "fraud against corporation X, using false identity" - however, that framing is necessary to make consumers accept, by default, the burden of clearing debts they were never party to simply because the defrauded party did not have adequately verify perpetrators identity.
- heleninboodler 5y agoA point very well made by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- tompazourek 5y agoThis is brilliant.
- vngzs 5y agoI agree. From Coinbase's perspective, they ought to defend their infrastructure against fraud, whether that is a direct attack on the users, an attack on the users' telcos, or insider activity directly. From the telco's perspective, they have a responsibility to stop SMS and SIM fraud, and our regulations have failed to properly hold them accountable in this domain. I would add that the users have some responsibility for losing their emails/passwords, but my initial framing insufficiently demands responsibility for the service providers in this instance. The service providers should be expected to take all reasonable steps to prevent fraud on their platforms, and that should include extra scrutiny of SMS-based authentication mechanisms (e.g., identity verification). This is why Coinbase paid them back, accepting some responsibility for the fraud.
- sangnoir 5y agoI fully agree that users are not absolved of all responsibilities or vigilance (e.g. over passwords/devices). I think the legal framework has to be overhauled to clarify the culpability of all parties involved, rather than the current "Sucks to be you" attitude towards consumers, who are the least powerful, and have the least agency in these issues.
- miohtama 5y agoTelcos have no responsibility to stop SIM fraud. Telcos have communicated the last 30 years SMS is not secure (travels as plain text) and should not be used for 2FA. If companies have ignored this advise then it is on them.
- bbarnett 5y agoAnd the elephant in the room is... the real purpose, for many corps eg Google, others, is to identify you, track you more accurately. And your mobile phone number is invaluable here.
- dropnerd 5y agocoinbase does kyc. it already knows who you are why sms? because everyone has it. we're not in a otp/u2f only world yet. sms 2fa is better than no 2fa
- tdeck 5y agoSIM swapping also allows you to intercept voice calls, which are encrypted and supposed to be secure. The idea that telcos have no responsibility to stop people from taking over the telephone number that customers pay for is completely absurd. Moreover, often the SIM swapping is done by employees of the Telco itself using company infrastructure.
- miohtama 5y agoNo you are not correct. The whole underlying mobile phone network infrastructure is based on (failed) trust and is not secure. Though it is slowly being replaced. https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls https://www.theguardian.com/technology/2016/apr/19/ss7-hack-... https://www.firstpoint-mg.com/blog/ss7-attack-guide/ https://www.firstpoint-mg.com/blog/ss7-attack-guide/
- narrator 5y agoThe easiest way to prevent sim swap attacks is to use Google Voice. Google has no customer service, so there isn't anyone you can call up and con.
- ta1234567890 5y agoThat is smart, funny and sad, all at the same time.
- pxeboot 5y agoThis isn't really true. Google Voice numbers are managed by bandwidth.com and have been taken by attackers submitting fraudulent number portability requests in the past.
- narrator 5y agoDon't you have to login to your Google account to port a number?
- pxeboot 5y agoIt has been possible in some instances for an attacker to port a number directly from the underlying carrier, in this case, bandwidth.com. When I saw this happen, Google was not aware the number was gone, so calls and texts from other Google Voice users still worked.
- tyingq 5y agoThere's ways to intercept SMS messages without sim-jacking or number porting too. https://arstechnica.com/information-technology/2021/03/16-attack-let-hacker-intercept-a-t-mobile-users-text-messages/ https://arstechnica.com/information-technology/2021/03/16-at...
- ensignavenger 5y agoCoinbase and other sites (especially those that deal in money) should stop using SIM cards as a form of authentication. While carriers should probably do more to secure SIMs and phone #s, it has always been known that the system was never designed to be used as a security mechanism, and Coinbase using it as such is a security flaw that they are responsible for.
- Consultant32452 5y agoOkta architect here. It's hard enough getting MFA to work in a large organization where technically illiterate people are surrounded by coworkers to ask who have all figured out their RSA tokens or Okta Verify enrollment. Trying to manage this for the general public would be an incredible undertaking. The cost benefit analysis probably does not make sense for a gazillion low balance users. It may make sense to enforce strong factors for high balance users. You have to balance that against them taking their business elsewhere.
- bonzini 5y agoIn Europe all banks are using 2FA, and it's usually based on TOTP (and enrolling the first phone is a pain usually requiring QR codes and whatnot). 17 years ago some were using smartcards as 2FA. It's doable and secure, to the point that identity theft is almost unheard of (and usually used more as a synonym of catfishing than in the American sense). SMS is handy but it should be a last resort rather than the main second factor.
- trelane 5y agoIf you can use sms as a factor, you can use sms as a factor. The only way to win is not to play at all
- bonzini 5y agoYeah what I meant is that companies should propose other methods than SMS. SMS can be good enough to confirm a password reset link that was sent by email (so you will not really do anything without access to an account's linked email address), but not as the main second factor for login.
- zikduruqe 5y ago> I have a similar gripe against "identity theft", which really ought to be... ... bank robbery by unknowing proxy. If we reframed the narrative, I bet banks and financial institutions would bust their asses to make things better.
- thinkharderdev 5y agoThey already do for the most part though right? That is, they lose a huge amount of money to "identity theft" and have ample incentives to stop/prevent it.