3 ms·
> if I didn’t reply in the negative within 10 minutes, the transfer would go through by default! How can such bullshit even be real?
by Double_a_92 4y ago
> if I didn’t reply in the negative within 10 minutes, the transfer would go through by default!
How can such bullshit even be real?
- donmcronald 4y agoThe system was probably designed with narrow requirements where the goal was to deal with lost phones or SIM cards. I assume people want their service back instantly. They should at least have an opt-in for better security. For example, let the transfer happen after an affirmative response to a text message because it demonstrates the requestor is already in control of the SIM. If an affirmative response isn't possible, disable service to the phone for 24 hours and then approve the transfer. That way people get 24h to notice the issue and figure out what's going on if a bad actor tries to perform a SIM swap on them. If I had the choice between losing service to my phone for a full week or getting SIM swapped, I'd choose the former because the latter would have such a huge impact if the attacker starting recovering accounts via SMS.