6 ms·

Losing a smartphone today can have a profound impact on people’s lives. You lose your ability to pay for things (unless you have physical cards with you); you l

Losing a smartphone today can have a profound impact on people’s lives. You lose your ability to pay for things (unless you have physical cards with you); you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work; you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel. Maybe it’s time for more severe punishments for phone theft? The slap on the wrist thieves get today doesn’t seem like much of a deterrent, especially compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication.

tinus_hn 4y ago
There should be more severe consequences for unlocking stolen devices, it’s crime on the same level as SIM swapping by phone store employees.
amelius 4y ago
Shouldn't you be able to walk into a phone store, get a new one and automatically sync all your files, passwords, etc., then pay for the phone using that data?
- tartoran 4y ago
  Well, you need the phone to prove who you are. Out of luck…
  - feet 4y ago
    In what country is ID stored on the phone? Do people not carry licenses or IDs physically?
    - lb1lf 4y ago
      If my own anecdotal experience is anything to go by, we tend to carry IDs in the phone wallet case. Lose one, lose the other. Sigh. The worst part is, I know this is a terrible idea, and yet I carry all my eggs in the very same basket. At least I've had the good sense to leave my physical driver's licence in the car I use 99% of the time after we got a driver's licence app - I can now simply show the police my cellphone with a QR code and a control animation on it, and they can verify my licence class and expiry date on the spot.
      - feet 4y ago
        Maybe I'm weird then, I have a case with all my physical cards and I carry it in the opposite pocket from my phone
        sixstringtheory 4y ago
        I’m one of the only people I know with a wallet style phone case with cards/id in it but I think I’ve just decided to go back to a separate wallet/card case. Will help thin down the phone too since I’ll probably just go caseless.
    - robbiep 4y ago
      In NSW we have digital licences. My APEC business traveller card is now digital as well. 2 forms of 50 odd points of ID
- r2p2 4y ago
  At least once we reach the point where we use passkeys everywhere - which as far as I understand is the safest authentication method? Then a new phone will not have the trusted keys since they are stored in the hardware of the stolen phone.
- kevinmchugh 4y ago
  Now you've got two vectors to get all the important data that lives on my phone: steal my phone, or convince a retail associate that you're me
  - amelius 4y ago
    You're assuming the worst possible implementation of that idea.
    - kevinmchugh 4y ago
      Well, I don't think I am. I think the easier it is for me to get a clone of my phone, the easier it is for someone else to get it. If at&t makes it really hard to get a clone, okay, but that makes the offering less useful. A seven day waiting period might make fraud less lucrative, but it also means I'm without a phone for a week, so what's the point
sublinear 4y ago
This is precisely why it's constantly argued that a phone is not a good 2nd factor for authentication. The auth data should be on a device that is basically worthless except for the data it holds which in turn is also inaccessible to someone else. Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.
- coaltunbey 4y ago
  How are "tough on crime" laws regressive? What do you think is the actual problem?
  - Swenrekcah 4y ago
    I think they mean that just passing laws that make it punishable by say 30 years in prison to steal a phone would be regressive, since the punishment is in no proportion to the crime. However, what would actually be nice if, like people here have suggested, is that the police would actually bum off to retrieve stolen phones, bikes, etc and then deliver whatever appropriate penalties to the perpetrators if found. Doesn’t matter if it’s only a small punishment so long as people get their stuff back and the thieves learn they’ll be sought after. So basically, we don’t need better laws here, simply enforcement of them.
  - josephcsible 4y ago
    Since rich people are less likely to steal phones, increasing the punishment for phone theft affects rich people less, which means it's regressive. (I think using this argument to justify being soft on crime is ridiculous. I'm just pointing out what the argument is.)
  - sublinear 4y ago
    > Losing a smartphone today can have a profound impact on people’s lives. This is the actual problem. Theft is also a problem, but not all that relevant. "Tough on crime" doesn't really prevent crime when the incentive to commit it is still probably higher than the disincentive no matter how "tough" and getting caught is still unlikely. A trivial, but more relatable, example of this line of (criminal) reasoning is that people are more likely to enjoy extreme sports vs a high paying "dangerous job" despite working the job being less lethal, less accident prone, and a much greater net positive. Anyway the regression is adding unnecessary laws.
scarface74 4y ago
My wife and I are doing the digital nomad thing flying across the US and staying in hotels. I’ve thought about what would happen if I lost my phone and/or my wallet. - I have a cellular equipped Apple Watch and iPad that both independently get regular SMS messages along with my phone. - I can sign into my Mac and get text messages. - I have a second wallet in my bookbag with a few lesser used credit cards, a little cash and my passport card for ID - my wife is my backup recovery source if I get locked out of my account.
- boulos 4y ago
  > I can sign into my Mac and get text messages. Doesn't this actually depend on relaying the SMS from the phone? I don't think delivery works if your phone isn't in range of the laptop. Even the watch seems to require the relay to work for receiving [1]: > To receive SMS, MMS, or push notifications from third-party apps on your cellular Apple Watch, your paired iPhone must be powered on and connected to Wi-Fi or cellular, but it doesn't need to be nearby. You also need to be signed in to iMessage on your iPhone to use Messages on your watch. [1] https://support.apple.com/en-us/HT205547 https://support.apple.com/en-us/HT205547
  - scarface74 4y ago
    Well shit you’re right.
Kiro 4y ago
I don't understand how people recover from unexpectedly losing their phone. How do you get back into your accounts with 2FA?
- CatWChainsaw 4y ago
  In a sense, humans already have to be cyborgs to function in modern society.
- meindnoch 4y ago
  I guess you'd write an "Ask HN" post and hope that a Google engineer notices. Same for GitHub.
- windowsrookie 4y ago
  I specifically have multiple phones setup with my Google Authenticator account for this reason. If you don't have a spare phone, I recommend purchasing a used old android phone for $30 just for the peace of mind.
  - schrodinger 4y ago
    1Password on a laptop can hold google auth keys
  - patrickdavey 4y ago
    Just curious - what's wrong with backup codes?
    - Too 4y ago
      If you are really paranoid. Backup codes can be copied without you noticing. Even bigger risk if you bring them along while traveling, or worse, leave unattended in hotel room. The Authenticator apps store keys in Secure Enclave (or at least I hope so). Which in themselves are 2fa by not being copyable thus requiring direct access to unlocked phone before using. Of course that also comes with bigger risk of you locking yourself out, by forgetting Lock Screen password or phone getting bricked for some stupid reason. Printed paper don’t have that problem, except can also easily be lost.
CatWChainsaw 4y ago
Anticipating the nightmare a lost phone would cause me means I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it. As for MFA, I have to grit my teeth every time my phone is the backup. Losing your phone is like losing your sight now.
- josephcsible 4y ago
  > I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it. Which is becoming less and less often in my experience. I was recently at an event that used SeatGeek for ticketing, and the only way they'd give you tickets was digitally through an iOS or Android app.
  - CatWChainsaw 4y ago
    Hence why a person basically needs to be cyborg to function in modern society, via phone. You are not a person unless you are effectively part machine. So stretching the analogy as far as it will go, phone theft should be considered dismemberment, or organ harvesting or trafficking.
Freak_NL 4y ago
> You lose your ability to pay for things (unless you have physical cards with you) So don't do that. Always carry some cash and your debit and/or credit cards. Spread out the risk (especially when travelling). > you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work; So don't do that. If you enable 2FA, have backups and recovery codes. Assume the phone will get lost at some point. > you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel. So don't do that. When travelling I always take the printouts of the tickets along, even if I end up not needing them. Don't turn your smartphone into your everything. Treat it as a tool which can get lost, stolen, or broken.
- Gazoche 4y ago
  But the reality is that we're fast approaching a future where every service assumes you have a smartphone and leaves you SOL if you don't. As an extreme example, my previous workplace had a "smart" lock on the door that could only be opened with a bluetooth-enabled smartphone and a dedicated app. It was immensely dumb and everyone hated it, but the owners thought they could save on keycards by doing this and so they did, because every employee had a smartphone anyways.
  - ruleforty 4y ago
    I second this with the caveat that stealing someone’s car simply means they don’t have transportation (cost aside). For many theft of a phone could be losing all the things the OP mentions. Your average consumer has no idea what backup codes are. Your average consumer relies on the no contact pay. Your average consumer relies on 2FA. There is a massively more inconvenience (cost aside again) in having your phone stolen versus your car. It could upend your life a lot worse than having your wallet or laptop stolen as well. There are only so much things we can expect from the average consumer and theft of a phone massively changes that persons life. I’m for increasing the resources put into specifically phone theft. My laptop was stolen from the airport (inside security!) and I had needle like precision with where the cops could find it. Nothing was done and I simply got back the insured value for it and the items with it. It put me out of work for the trip I was taking but I’m not your average consumer and everything was backed up and I did still have my phone. If my phone had been taken and not on me I would have been in a much larger world of pain (though I have backup codes, etc.).
WiggleGuy 4y ago
> you lose access to your email/bank/github/etc. accounts protected by 2FA I wonder if apps like Microsoft Authenticator are better for this. They sync 2fa codes to your Microsoft account. Naturally, the question becomes "Doesn't that make Microsoft a single point of failure? If someone know's your Microsoft password, they can get into your Authenticator and all your other accounts basically don't have 2FA anymore" From what I can tell it doesn't look like Microsoft has an answer to this, unless there's something obvious I'm missing. On the bright side, though, if you lose your phone, your 2FA codes aren't lost. Choices, choices.
- trelane 4y ago
  > They sync 2fa codes to your Microsoft account. This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account would also have access to your shared secret for every site. I would wager that they also would have access to your communications medium and password stores as well, in most cases, since you'd likey have bought in to the wider ecosystem. Or do they encrypt it client side?
  - WiggleGuy 4y ago
    Restoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption going on. The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)
ghusto 4y ago
Good lord, no. I don't lose any of those things, not even the 2FA. > compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication. For goodness sake, push back! I didn't even allow for the presumption I have a phone to read QR codes for restaurant menus, because of where I saw that was heading. Never allow anyone or any place to presume they can rely on your smartphone for something they should be responsible for. I noticed places I work for started to try this, and put a stop to it right from the beginning by asking if they were going to start paying for my phone contract, and buy the phone from me, so I could buy another private one. Putting it in black and white makes it clear what's going on; which is work trying to get (a) free hardware, services, and (b) free work out of hours.
gregmac 4y ago
You can pretty much say the exact same thing about stealing someone's wallet or purse. There's a lot of travel advice to the effect of "don't keep everything in one place". A phone is no different. A phone at least has the benefit of being backed up. In theory, I could log into a couple accounts on a brand new phone and have access to everything within tens of minutes. Contrast to the hours of phone calls and weeks of waiting it takes if I lost my driver's license, passport, etc. And though a phone can be used for payments, it must be unlocked. Not true of the physical credit/debit cards (swipe or tap) or cash found in a wallet/purse. If you have non-backed-up 2FA tied to your phone, you should fix that. Batteries die, and phones can be physically damaged, bricked for some software reason (they're computers, after all), dropped into the ocean or off a cliff, or just legitimately lost (ie: falls out of pocket into the cracks of a car seat and battery dies). I won't weigh into the punishment-deterrent argument at all, I'm merely pointing out that in theory there's actually a lot less disruption having your phone stolen vs having a wallet/purse stolen. Both suck, of course. Replacing a phone is almost certainly more expensive, but it should be significantly faster to recover from. And backup your 2FA.

tinus_hn 4y ago

There should be more severe consequences for unlocking stolen devices, it’s crime on the same level as SIM swapping by phone store employees.

amelius 4y ago

Shouldn't you be able to walk into a phone store, get a new one and automatically sync all your files, passwords, etc., then pay for the phone using that data?

tartoran 4y ago
Well, you need the phone to prove who you are. Out of luck…
- feet 4y ago
  In what country is ID stored on the phone? Do people not carry licenses or IDs physically?
  - lb1lf 4y ago
    If my own anecdotal experience is anything to go by, we tend to carry IDs in the phone wallet case. Lose one, lose the other. Sigh. The worst part is, I know this is a terrible idea, and yet I carry all my eggs in the very same basket. At least I've had the good sense to leave my physical driver's licence in the car I use 99% of the time after we got a driver's licence app - I can now simply show the police my cellphone with a QR code and a control animation on it, and they can verify my licence class and expiry date on the spot.
    - feet 4y ago
      Maybe I'm weird then, I have a case with all my physical cards and I carry it in the opposite pocket from my phone
      - sixstringtheory 4y ago
        I’m one of the only people I know with a wallet style phone case with cards/id in it but I think I’ve just decided to go back to a separate wallet/card case. Will help thin down the phone too since I’ll probably just go caseless.
  - robbiep 4y ago
    In NSW we have digital licences. My APEC business traveller card is now digital as well. 2 forms of 50 odd points of ID
r2p2 4y ago
At least once we reach the point where we use passkeys everywhere - which as far as I understand is the safest authentication method? Then a new phone will not have the trusted keys since they are stored in the hardware of the stolen phone.
kevinmchugh 4y ago
Now you've got two vectors to get all the important data that lives on my phone: steal my phone, or convince a retail associate that you're me
- amelius 4y ago
  You're assuming the worst possible implementation of that idea.
  - kevinmchugh 4y ago
    Well, I don't think I am. I think the easier it is for me to get a clone of my phone, the easier it is for someone else to get it. If at&t makes it really hard to get a clone, okay, but that makes the offering less useful. A seven day waiting period might make fraud less lucrative, but it also means I'm without a phone for a week, so what's the point

sublinear 4y ago

This is precisely why it's constantly argued that a phone is not a good 2nd factor for authentication. The auth data should be on a device that is basically worthless except for the data it holds which in turn is also inaccessible to someone else. Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.

coaltunbey 4y ago
How are "tough on crime" laws regressive? What do you think is the actual problem?
- Swenrekcah 4y ago
  I think they mean that just passing laws that make it punishable by say 30 years in prison to steal a phone would be regressive, since the punishment is in no proportion to the crime. However, what would actually be nice if, like people here have suggested, is that the police would actually bum off to retrieve stolen phones, bikes, etc and then deliver whatever appropriate penalties to the perpetrators if found. Doesn’t matter if it’s only a small punishment so long as people get their stuff back and the thieves learn they’ll be sought after. So basically, we don’t need better laws here, simply enforcement of them.
- josephcsible 4y ago
  Since rich people are less likely to steal phones, increasing the punishment for phone theft affects rich people less, which means it's regressive. (I think using this argument to justify being soft on crime is ridiculous. I'm just pointing out what the argument is.)
- sublinear 4y ago
  > Losing a smartphone today can have a profound impact on people’s lives. This is the actual problem. Theft is also a problem, but not all that relevant. "Tough on crime" doesn't really prevent crime when the incentive to commit it is still probably higher than the disincentive no matter how "tough" and getting caught is still unlikely. A trivial, but more relatable, example of this line of (criminal) reasoning is that people are more likely to enjoy extreme sports vs a high paying "dangerous job" despite working the job being less lethal, less accident prone, and a much greater net positive. Anyway the regression is adding unnecessary laws.

scarface74 4y ago

My wife and I are doing the digital nomad thing flying across the US and staying in hotels. I’ve thought about what would happen if I lost my phone and/or my wallet. - I have a cellular equipped Apple Watch and iPad that both independently get regular SMS messages along with my phone. - I can sign into my Mac and get text messages. - I have a second wallet in my bookbag with a few lesser used credit cards, a little cash and my passport card for ID - my wife is my backup recovery source if I get locked out of my account.

boulos 4y ago
> I can sign into my Mac and get text messages. Doesn't this actually depend on relaying the SMS from the phone? I don't think delivery works if your phone isn't in range of the laptop. Even the watch seems to require the relay to work for receiving [1]: > To receive SMS, MMS, or push notifications from third-party apps on your cellular Apple Watch, your paired iPhone must be powered on and connected to Wi-Fi or cellular, but it doesn't need to be nearby. You also need to be signed in to iMessage on your iPhone to use Messages on your watch. [1] https://support.apple.com/en-us/HT205547 https://support.apple.com/en-us/HT205547
- scarface74 4y ago
  Well shit you’re right.

Kiro 4y ago

I don't understand how people recover from unexpectedly losing their phone. How do you get back into your accounts with 2FA?

CatWChainsaw 4y ago
In a sense, humans already have to be cyborgs to function in modern society.
meindnoch 4y ago
I guess you'd write an "Ask HN" post and hope that a Google engineer notices. Same for GitHub.
windowsrookie 4y ago
I specifically have multiple phones setup with my Google Authenticator account for this reason. If you don't have a spare phone, I recommend purchasing a used old android phone for $30 just for the peace of mind.
- schrodinger 4y ago
  1Password on a laptop can hold google auth keys
- patrickdavey 4y ago
  Just curious - what's wrong with backup codes?
  - Too 4y ago
    If you are really paranoid. Backup codes can be copied without you noticing. Even bigger risk if you bring them along while traveling, or worse, leave unattended in hotel room. The Authenticator apps store keys in Secure Enclave (or at least I hope so). Which in themselves are 2fa by not being copyable thus requiring direct access to unlocked phone before using. Of course that also comes with bigger risk of you locking yourself out, by forgetting Lock Screen password or phone getting bricked for some stupid reason. Printed paper don’t have that problem, except can also easily be lost.

CatWChainsaw 4y ago

Anticipating the nightmare a lost phone would cause me means I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it. As for MFA, I have to grit my teeth every time my phone is the backup. Losing your phone is like losing your sight now.

josephcsible 4y ago
> I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it. Which is becoming less and less often in my experience. I was recently at an event that used SeatGeek for ticketing, and the only way they'd give you tickets was digitally through an iOS or Android app.
- CatWChainsaw 4y ago
  Hence why a person basically needs to be cyborg to function in modern society, via phone. You are not a person unless you are effectively part machine. So stretching the analogy as far as it will go, phone theft should be considered dismemberment, or organ harvesting or trafficking.

Freak_NL 4y ago

> You lose your ability to pay for things (unless you have physical cards with you) So don't do that. Always carry some cash and your debit and/or credit cards. Spread out the risk (especially when travelling). > you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work; So don't do that. If you enable 2FA, have backups and recovery codes. Assume the phone will get lost at some point. > you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel. So don't do that. When travelling I always take the printouts of the tickets along, even if I end up not needing them. Don't turn your smartphone into your everything. Treat it as a tool which can get lost, stolen, or broken.

Gazoche 4y ago
But the reality is that we're fast approaching a future where every service assumes you have a smartphone and leaves you SOL if you don't. As an extreme example, my previous workplace had a "smart" lock on the door that could only be opened with a bluetooth-enabled smartphone and a dedicated app. It was immensely dumb and everyone hated it, but the owners thought they could save on keycards by doing this and so they did, because every employee had a smartphone anyways.
- ruleforty 4y ago
  I second this with the caveat that stealing someone’s car simply means they don’t have transportation (cost aside). For many theft of a phone could be losing all the things the OP mentions. Your average consumer has no idea what backup codes are. Your average consumer relies on the no contact pay. Your average consumer relies on 2FA. There is a massively more inconvenience (cost aside again) in having your phone stolen versus your car. It could upend your life a lot worse than having your wallet or laptop stolen as well. There are only so much things we can expect from the average consumer and theft of a phone massively changes that persons life. I’m for increasing the resources put into specifically phone theft. My laptop was stolen from the airport (inside security!) and I had needle like precision with where the cops could find it. Nothing was done and I simply got back the insured value for it and the items with it. It put me out of work for the trip I was taking but I’m not your average consumer and everything was backed up and I did still have my phone. If my phone had been taken and not on me I would have been in a much larger world of pain (though I have backup codes, etc.).

WiggleGuy 4y ago

> you lose access to your email/bank/github/etc. accounts protected by 2FA I wonder if apps like Microsoft Authenticator are better for this. They sync 2fa codes to your Microsoft account. Naturally, the question becomes "Doesn't that make Microsoft a single point of failure? If someone know's your Microsoft password, they can get into your Authenticator and all your other accounts basically don't have 2FA anymore" From what I can tell it doesn't look like Microsoft has an answer to this, unless there's something obvious I'm missing. On the bright side, though, if you lose your phone, your 2FA codes aren't lost. Choices, choices.

trelane 4y ago
> They sync 2fa codes to your Microsoft account. This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account would also have access to your shared secret for every site. I would wager that they also would have access to your communications medium and password stores as well, in most cases, since you'd likey have bought in to the wider ecosystem. Or do they encrypt it client side?
- WiggleGuy 4y ago
  Restoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption going on. The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)

ghusto 4y ago

Good lord, no. I don't lose any of those things, not even the 2FA. > compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication. For goodness sake, push back! I didn't even allow for the presumption I have a phone to read QR codes for restaurant menus, because of where I saw that was heading. Never allow anyone or any place to presume they can rely on your smartphone for something they should be responsible for. I noticed places I work for started to try this, and put a stop to it right from the beginning by asking if they were going to start paying for my phone contract, and buy the phone from me, so I could buy another private one. Putting it in black and white makes it clear what's going on; which is work trying to get (a) free hardware, services, and (b) free work out of hours.

gregmac 4y ago

You can pretty much say the exact same thing about stealing someone's wallet or purse. There's a lot of travel advice to the effect of "don't keep everything in one place". A phone is no different. A phone at least has the benefit of being backed up. In theory, I could log into a couple accounts on a brand new phone and have access to everything within tens of minutes. Contrast to the hours of phone calls and weeks of waiting it takes if I lost my driver's license, passport, etc. And though a phone can be used for payments, it must be unlocked. Not true of the physical credit/debit cards (swipe or tap) or cash found in a wallet/purse. If you have non-backed-up 2FA tied to your phone, you should fix that. Batteries die, and phones can be physically damaged, bricked for some software reason (they're computers, after all), dropped into the ocean or off a cliff, or just legitimately lost (ie: falls out of pocket into the cracks of a car seat and battery dies). I won't weigh into the punishment-deterrent argument at all, I'm merely pointing out that in theory there's actually a lot less disruption having your phone stolen vs having a wallet/purse stolen. Both suck, of course. Replacing a phone is almost certainly more expensive, but it should be significantly faster to recover from. And backup your 2FA.