5 ms·

Because SIMs require the physical card. You cannot forge a SIM without the SIM itself. There's a physical second factor. Usernames and passwords get leaked all

by junon 5y ago

Because SIMs require the physical card. You cannot forge a SIM without the SIM itself. There's a physical second factor. Usernames and passwords get leaked all the time, and since Reddit et al are meant to be accessed by multiple devices, device-locking them would be antithetical and anti-consumer. A phone service is implicitly device-locked (well, doesn't have to be, but it doesn't make sense to allow multiple devices per number anyway). Just using device credentials could allow anyone to log in with that information and use your subscription or pose as you. As for ADSL or other forms of internet, there is already a second factor - ISPs generally know from which vicinity you are connecting from, and when you log in with your account information in your modem, they can match what's on your account to your physical "drop" and assert that it is at least within the same neighborhood - again, creating a physical second factor. This is also why your internet service generally needs to be "moved" whenever you change your residence. A SIM card allows the freedom as the GP mentioned, without requiring someone from the centralized authority to process the request somehow. There is a huge difference if you think about it for a bit.

jtbayly 5y ago
I think you are confused. SIM cards are not a second factor. SIM swaps are proof of this.
- Nextgrid 5y ago
  SIM is the second factor when it comes to proving that this device with this physical SIM is indeed accessing the network. Fraudulent SIM swaps are attacking a different layer of the system, they are social-engineering underpaid idiots to associate a new SIM with a given account & number. You could in theory social-engineer a bank to reissue someone's payment card and somehow intercept it in the post or steal it from their mailbox. That doesn't mean chip & PIN is insecure.
  - deleted 5y ago
    [deleted]
  - jtbayly 5y ago
    But Esim already exists. Nobody needs to steal your SIM card to start using your phone number.
  - ksec 5y ago
    And from my understanding, these social engineering and sim swap problems are mostly ( if not all ) US specific. I have never heard anything near the order of magnitude of US sim swap from any other country. Most countries have Personal ID that are required and issued by government as verification. But even places like UK will require address and Driving License / Passport proof along with security questions.
    - Nextgrid 5y ago
      > But even places like UK will require address and Driving License / Passport proof along with security questions. I was a phone store monkey in the UK a few years back and a dedicated attacker can absolutely bypass this: https://news.ycombinator.com/item?id=29714400 https://news.ycombinator.com/item?id=29714400 I can only assume it's not more common because other scams are more profitable and/or not enough targets (banks, etc) use SMS 2FA as their only method of authentication so a SIM swap wouldn't give you much.
mrtksn 5y ago
SIM cards are famously the weak link in the 2FA. They have all kind of security issues as they are computers themselves. The way forward is to get rid of the SIM and access those carrier networks through credentials, ideally I would love to see it as a cryptographic receipt that you get from your payment provider and pass it to the the carrier as a proof of right for account and usage of their networks.
- Nextgrid 5y ago
  SMS-based 2FA's weakness is not due to SIM cards. It's due to carriers being shit. SMS-based 2FA is not exploited by breaking any cryptography or exploiting some software vulnerability. It's by "asking nicely" the carrier's customer support idiots to associate a new SIM to the target account & number. Replacing the SIM with username/password wouldn't do anything - instead of the attackers having to associate a new physical SIM they'll just associate a new set of credentials.
  - mrtksn 5y ago
    Those SIM engineers should build other unhackable systems too! Anyway, it's not only social engineering but even if it was it simply means that it's useless for security. Just yesterday, a friend of mine got a fringe hacking incident or a bug. We are not still sure if it was hack but somehow the SIM card in her phone identified as another number from another carrier. Who knows what happened, her SIM wasn't swapped it simply think that it's another number as she found out when started receiving notifications about her new number. Maybe it was Apple's bug or something but who cares, the physical SIM did not change anything.
    - Nextgrid 5y ago
      > Those SIM engineers should build other unhackable systems too! They did - see EMV payment cards for example. > it simply means that it's useless for security. It's not - SIMs close one attack vector where credentials can't be stolen by malware/bruteforced. Current SIM-swap attacks don't scale well; imagine how worse the problem would be if any Android malware could silently take over your number even after you've wiped the device clean. The solution is to close the social-engineering attack vector by making carriers liable for any losses, not to remove a different layer of security because it's currently being bypassed by a different flaw. > Who knows what happened I doubt it was nefarious, I'll place my bets on misconfiguration somewhere. The telephone network is a massive mess and it could very well be that some carrier/equipment in the path rewrote the caller ID as something else.
thirdlamp 5y ago
> but it doesn't make sense to allow multiple devices per number anyway Why not? This is a useful behavior that is currently emulated by forwarding calls to laptops and tablets with the same account when the devices are on the same Wi-Fi. You could get rid of the Wi-Fi requirement if those devices all simply had an eSIM with the same number.
- Nextgrid 5y ago
  Number assignment is handled at the network level. I have the exact functionality you speak of (single number to multiple devices) on my company's good old physical SIMs. Phones & SIMs don't even know nor care about their own number. The SIM has a field for that but in fact it's often left empty (iOS devices discover their own number by texting a known Apple number and getting the response via the Internet, they'll then populate this field out of courtesy but it's not necessary for functionality). When a call comes in, the carrier decides which SIM it should be routed to. When a SIM makes an outbound call, the carrier decides which number to set as caller ID. The functionality you speak of has nothing to do with SIM vs eSIM, it's about carriers having to actually innovate and do some engineering. Their current oligopoly means there's no commercial pressure for them to do so, and there's no reason why they would suddenly do this with the switch to eSIMs.
  - newsbinator 5y ago
    > iOS devices discover their own number by texting a known Apple number and getting the response via the Internet, they'll then populate this field out of courtesy but it's not necessary for functionality TIL! Is that why in some countries and some SIM cards my iPhone can automatically report its own phone number (when I look at my own profile under 'Contacts') and in some countries it doesn't do that?
    - Nextgrid 5y ago
      Yes! Carriers who assign numbers to SIMs in advance could set that field directly. Others, either because they don't assign a number at the time of the SIM manufacture/personalization or just because they can't be bothered as it's not functionally necessary will leave it blank - in that case from my experience iPhones will populate the field with the number they get back from the iMessage & FaceTime provisioning step but again that's not actually necessary for functionality. The field is also user-editable in Settings -> Phone if you wish.
viktorcode 5y ago
> Because SIMs require the physical card. You cannot forge a SIM without the SIM itself Your SIM provider certainly can issue a duplicate. Also, SIMs can be spoofed.
- junon 5y ago
  I didn't say either of those things weren't true. Perhaps I should have used "cloned" instead of "forged" to be clearer. You can't remotely clone a SIM unless you use an OTA exploit or something. It's not the 'normal' case.
  - lopis 5y ago
    But what's the point in cloning a SIM card if SIM swapping is possible without them? SIM cards have shown to have no extra security than an eSIM.
    - junon 5y ago
      SIM swapping is an exploit of humans. Not of SIMs.
Gigachad 5y ago
The SIM card is even less secure than a username and password because someone just calls the carrier, reads out some sob story and gets your sim credentials transferred over to them. The sim is nothing more than an auth token which can easily be duplicated.

by junon 5y ago

jtbayly 5y ago

I think you are confused. SIM cards are not a second factor. SIM swaps are proof of this.

Nextgrid 5y ago
SIM is the second factor when it comes to proving that this device with this physical SIM is indeed accessing the network. Fraudulent SIM swaps are attacking a different layer of the system, they are social-engineering underpaid idiots to associate a new SIM with a given account & number. You could in theory social-engineer a bank to reissue someone's payment card and somehow intercept it in the post or steal it from their mailbox. That doesn't mean chip & PIN is insecure.
- deleted 5y ago
  [deleted]
- jtbayly 5y ago
  But Esim already exists. Nobody needs to steal your SIM card to start using your phone number.
- ksec 5y ago
  And from my understanding, these social engineering and sim swap problems are mostly ( if not all ) US specific. I have never heard anything near the order of magnitude of US sim swap from any other country. Most countries have Personal ID that are required and issued by government as verification. But even places like UK will require address and Driving License / Passport proof along with security questions.
  - Nextgrid 5y ago
    > But even places like UK will require address and Driving License / Passport proof along with security questions. I was a phone store monkey in the UK a few years back and a dedicated attacker can absolutely bypass this: https://news.ycombinator.com/item?id=29714400 https://news.ycombinator.com/item?id=29714400 I can only assume it's not more common because other scams are more profitable and/or not enough targets (banks, etc) use SMS 2FA as their only method of authentication so a SIM swap wouldn't give you much.

mrtksn 5y ago

SIM cards are famously the weak link in the 2FA. They have all kind of security issues as they are computers themselves. The way forward is to get rid of the SIM and access those carrier networks through credentials, ideally I would love to see it as a cryptographic receipt that you get from your payment provider and pass it to the the carrier as a proof of right for account and usage of their networks.

Nextgrid 5y ago
SMS-based 2FA's weakness is not due to SIM cards. It's due to carriers being shit. SMS-based 2FA is not exploited by breaking any cryptography or exploiting some software vulnerability. It's by "asking nicely" the carrier's customer support idiots to associate a new SIM to the target account & number. Replacing the SIM with username/password wouldn't do anything - instead of the attackers having to associate a new physical SIM they'll just associate a new set of credentials.
- mrtksn 5y ago
  Those SIM engineers should build other unhackable systems too! Anyway, it's not only social engineering but even if it was it simply means that it's useless for security. Just yesterday, a friend of mine got a fringe hacking incident or a bug. We are not still sure if it was hack but somehow the SIM card in her phone identified as another number from another carrier. Who knows what happened, her SIM wasn't swapped it simply think that it's another number as she found out when started receiving notifications about her new number. Maybe it was Apple's bug or something but who cares, the physical SIM did not change anything.
  - Nextgrid 5y ago
    > Those SIM engineers should build other unhackable systems too! They did - see EMV payment cards for example. > it simply means that it's useless for security. It's not - SIMs close one attack vector where credentials can't be stolen by malware/bruteforced. Current SIM-swap attacks don't scale well; imagine how worse the problem would be if any Android malware could silently take over your number even after you've wiped the device clean. The solution is to close the social-engineering attack vector by making carriers liable for any losses, not to remove a different layer of security because it's currently being bypassed by a different flaw. > Who knows what happened I doubt it was nefarious, I'll place my bets on misconfiguration somewhere. The telephone network is a massive mess and it could very well be that some carrier/equipment in the path rewrote the caller ID as something else.

thirdlamp 5y ago

> but it doesn't make sense to allow multiple devices per number anyway Why not? This is a useful behavior that is currently emulated by forwarding calls to laptops and tablets with the same account when the devices are on the same Wi-Fi. You could get rid of the Wi-Fi requirement if those devices all simply had an eSIM with the same number.

Nextgrid 5y ago
Number assignment is handled at the network level. I have the exact functionality you speak of (single number to multiple devices) on my company's good old physical SIMs. Phones & SIMs don't even know nor care about their own number. The SIM has a field for that but in fact it's often left empty (iOS devices discover their own number by texting a known Apple number and getting the response via the Internet, they'll then populate this field out of courtesy but it's not necessary for functionality). When a call comes in, the carrier decides which SIM it should be routed to. When a SIM makes an outbound call, the carrier decides which number to set as caller ID. The functionality you speak of has nothing to do with SIM vs eSIM, it's about carriers having to actually innovate and do some engineering. Their current oligopoly means there's no commercial pressure for them to do so, and there's no reason why they would suddenly do this with the switch to eSIMs.
- newsbinator 5y ago
  > iOS devices discover their own number by texting a known Apple number and getting the response via the Internet, they'll then populate this field out of courtesy but it's not necessary for functionality TIL! Is that why in some countries and some SIM cards my iPhone can automatically report its own phone number (when I look at my own profile under 'Contacts') and in some countries it doesn't do that?
  - Nextgrid 5y ago
    Yes! Carriers who assign numbers to SIMs in advance could set that field directly. Others, either because they don't assign a number at the time of the SIM manufacture/personalization or just because they can't be bothered as it's not functionally necessary will leave it blank - in that case from my experience iPhones will populate the field with the number they get back from the iMessage & FaceTime provisioning step but again that's not actually necessary for functionality. The field is also user-editable in Settings -> Phone if you wish.

viktorcode 5y ago

> Because SIMs require the physical card. You cannot forge a SIM without the SIM itself Your SIM provider certainly can issue a duplicate. Also, SIMs can be spoofed.

junon 5y ago
I didn't say either of those things weren't true. Perhaps I should have used "cloned" instead of "forged" to be clearer. You can't remotely clone a SIM unless you use an OTA exploit or something. It's not the 'normal' case.
- lopis 5y ago
  But what's the point in cloning a SIM card if SIM swapping is possible without them? SIM cards have shown to have no extra security than an eSIM.
  - junon 5y ago
    SIM swapping is an exploit of humans. Not of SIMs.

Gigachad 5y ago

The SIM card is even less secure than a username and password because someone just calls the carrier, reads out some sob story and gets your sim credentials transferred over to them. The sim is nothing more than an auth token which can easily be duplicated.