5 ms·
Wow—I didn’t know this stuff was being done. While this has been shouted from rooftops for a while now, BANKS and related are still using SMS to verify things—
by binkHN 4y ago
Wow—I didn’t know this stuff was being done. While this has been shouted from rooftops for a while now, BANKS and related are still using SMS to verify things—this is yet another shout as to why SMS should not be used for 2FA.
- DrWumbo 4y agoI think part of the challenge is increasing tech literacy in America. Most of my friends and family have trouble understanding password managers or hardware 2fa.
- lotsofpulp 4y agoOr phone numbers should be treated as infrastructure and given legal protections above simply being at the whim of T-Mobile/ATT/Verizon employees.
- tomatocracy 4y agoI think you're overestimating the problem. Here in the UK, banks send out physical 2FA devices (card readers, little calculator style devices, etc) for those who don't want something eg linked a smart phone app. They're easy enough to use for anyone who can use online banking, and those who don't need or want online banking don't need them.
- DrWumbo 4y agoI think you're overestimating Americans We got credit cards with chips way after Europe. We don't have anything close to GDPR because enough voters don't understand data privacy (and ofc regulatory capture).
- aerostable_slug 4y ago> We got credit cards with chips way after Europe. That was largely due to POS terminals in gas pumps — we have LOTS of gas pumps and the POS devices in them aren't uniform or inexpensive. When I worked on payment systems the resistance was from the merchants, not the consumers. Where research (and experience) has shown some degree of consumer dissatisfaction is with entering PINs, which is why chip-and-PIN credit cards aren't commonly seen in the US. Even in countries where it's commonly used, you generally only require the PIN over a merchant-set amount.
- random42_ 4y agoAlso: sending a check by mail is still a thing.
- kylehotchkiss 4y agoWhich banks still send these? Former HSBC USA sent me one before they shut down their consumer products but it was very poorly implemented in their web interface
- neoncontrails 4y agoThere's reasons to be optimistic that the solution to preventing this type of attack (which is so troubling precisely because the difficulty of patching it is utterly colossal) might yet be around the corner. Band-aid mitigations, like programmable eSIMs and tethering one's phone to an online identity (as Google Fi does) have existed for a while now, neither of which is an ideal solution. I was surprised recently though by what sounds like credible speculation that Apple's next iPhone release may drop the SIM card slot completely. If true, I'm guessing that could be the Zugzwang that will force mainstream wireless carriers, notoriously allergic to investing in their own infrastructure, to finally make the needed upgrades to achieve a post-SIM card future — much in the same way, I'm hoping, that the elimination of the audio jack forced the adoption of Bluetooth on even the most viscerally reluctant consumer. https://news.ycombinator.com/item?id=29701887 https://news.ycombinator.com/item?id=29701887
- jelled 4y agoIt's not speculation. The iPhone 14/pro dropped the sim card for models sold in the US.