5 ms·

Note that some countries have prepaid SIMs that are regularly reassigned to new SIMs...as soon as 6 months after the last "refill" of the card. This happened t

Note that some countries have prepaid SIMs that are regularly reassigned to new SIMs...as soon as 6 months after the last "refill" of the card. This happened to a customer where their IT sysadmin got a prepaid phone and registered this as a recovery number in a critical system (read as: full control over infrastructure). And yes, the company forgot to refill the SIM card only to realize a year later that some script kiddie got the phone number by accident and was curious enough to lookup where the number was being used. DNS entries and ASN entries were enough OSINT to form an attack strategy. What you gonna do then? As it turns out, this was a shitstorm of problems to deal with through hours (probably days) of support hotline calls. Remember folks: 2FA via SMS is useless. Avoid phone numbers like the plague, everywhere.

encryptluks2 5y ago
Many providers don't give you a choice. Many major banks default to using SMS for 2FA. I'm sure if they get breached the government will bail them out so why should they change?
- iszomer 5y ago
  "FDIC insured".. I use a GV number for 2FA over SMS as the last mile solution.
  - lxgr 5y ago
    Me too, but some banks/payment services don't allow that – ostensibly for security reasons... Even when I did get a "real phone number" (that concept irritates me to no end), one of these first required me to send a phone bill as a "proof of me owning that number" before they would let me set it for 2FA. I guess that's just what happens when blending/confusing the three distinct concerns of spam/fraud protection, 2FA, and user identification (for inbound P2P payments) into a single identifier.
lxgr 5y ago
Couldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel. - I can own my email address; I cannot meaningfully own a phone number. - Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.) - Email works with or without a cell signal/via mobile data. - Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.
- laurex 5y ago
  Since you can have unlimited amounts of email addresses for free, they are not the ideal identifier for products for which there are “free up to a certain point” aspects or “we’d like to make sure we’re dealing with an individual person” aspects? Though surely in the latter case something better than an email OR phone number is possible.
  - lxgr 5y ago
    If "proof-of-x" is desired for spam account prevention: Sure, happy to provide that as a user. Just don‘t also tangle it to my user ID and/or 2FA recovery.
  - musicale 5y ago
    > they are not the ideal identifier for products They are a pretty decent identifier for users. Facebook demanded my phone number for "security" purposes then turned around and used it as a unique identifier to tie me to purchase records from various businesses (e.g. Ticketmaster - why am I not surprised?) that apparently have shady tracking/advertising deals with Facebook. This sort of information misuse and tracking (not to mention spam) is precisely what "sign in with Apple" was supposed to fix in terms of e-mail addresses, but it's currently instantly neutralized by SMS "verification" since it's a huge pain to get a different phone number just to prevent Facebook from using it as a tracking identifier. (I guess this reminds me why I have said "no" to multiple inquiries from Facebook. The thought of being told to implement a dark pattern as part of your job is extremely unpleasant. Facebook's confusing anti-privacy settings are another example.) And it's not just Facebook. This is seeping into other completely unexpected applications; for example I bought a game controller whose driver software setup demanded a mobile number for "verification" purposes. No, just no.

encryptluks2 5y ago

Many providers don't give you a choice. Many major banks default to using SMS for 2FA. I'm sure if they get breached the government will bail them out so why should they change?

iszomer 5y ago
"FDIC insured".. I use a GV number for 2FA over SMS as the last mile solution.
- lxgr 5y ago
  Me too, but some banks/payment services don't allow that – ostensibly for security reasons... Even when I did get a "real phone number" (that concept irritates me to no end), one of these first required me to send a phone bill as a "proof of me owning that number" before they would let me set it for 2FA. I guess that's just what happens when blending/confusing the three distinct concerns of spam/fraud protection, 2FA, and user identification (for inbound P2P payments) into a single identifier.

lxgr 5y ago

Couldn't agree more. It's baffling that we seem to be slowly moving away from email addresses as primary account identifiers, and less slowly from using them as the default 2FA reset channel. - I can own my email address; I cannot meaningfully own a phone number. - Email is international. Phone numbers aren't. (Edit: Often, not all countries/dial codes are accepted by sign-up forms, and it's usually not feasible to keep a phone number when moving internationally.) - Email works with or without a cell signal/via mobile data. - Many email providers offer 2FA, and domain name port-out prevention seems relatively robust these days. SIM swaps and port-out attacks still seem way too easy to pull off.

laurex 5y ago
Since you can have unlimited amounts of email addresses for free, they are not the ideal identifier for products for which there are “free up to a certain point” aspects or “we’d like to make sure we’re dealing with an individual person” aspects? Though surely in the latter case something better than an email OR phone number is possible.
- lxgr 5y ago
  If "proof-of-x" is desired for spam account prevention: Sure, happy to provide that as a user. Just don‘t also tangle it to my user ID and/or 2FA recovery.
- musicale 5y ago
  > they are not the ideal identifier for products They are a pretty decent identifier for users. Facebook demanded my phone number for "security" purposes then turned around and used it as a unique identifier to tie me to purchase records from various businesses (e.g. Ticketmaster - why am I not surprised?) that apparently have shady tracking/advertising deals with Facebook. This sort of information misuse and tracking (not to mention spam) is precisely what "sign in with Apple" was supposed to fix in terms of e-mail addresses, but it's currently instantly neutralized by SMS "verification" since it's a huge pain to get a different phone number just to prevent Facebook from using it as a tracking identifier. (I guess this reminds me why I have said "no" to multiple inquiries from Facebook. The thought of being told to implement a dark pattern as part of your job is extremely unpleasant. Facebook's confusing anti-privacy settings are another example.) And it's not just Facebook. This is seeping into other completely unexpected applications; for example I bought a game controller whose driver software setup demanded a mobile number for "verification" purposes. No, just no.