3 ms·

Which cell phone network would you guys recommend for people who care about security?

by streptomycin 4y ago

bitcoinmoney 4y ago
US mobile has good 2FA.
- zamnos 4y ago
  Heads up that US mobile is an MVNO operating on T-Mobile and Verizon, so how good their 2FA system is irrelevant if hackers get deep enough into tmobile.
  - comte7092 4y ago
    “Deep enough” would be true of any mobile carrier, to date all of these attacks are SIM swapping, with social engineering/phishing being the attack vector. Not particularly deep. Attackers would have to social engineer the MVNO directly, which is certainly easier if they have data they’ve stolen from t-mobile first, but this isn’t a “they’ll get in no matter what because they’ve pwned T-Mobile so bad” scenario.
    - jelled 4y ago
      https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... This article says that Google Fi customers were SIM swapped due to a T-Mobile breach. Even though "[t]here was no access to Google's systems or any systems overseen by Google."
      - comte7092 4y ago
        > These attacks are conducted using social engineering, where the threat actor impersonates the customer and requests that the number be ported to a new device for some reason. To convince the mobile carrier that they are the customer, they provide personal information exposed to phishing attacks and data breaches. > As the Google Fi data breach includes phone numbers, which can easily be linked to a customer's name, and the serial number of SIM cards, it would have made it even more convincing when contacting a mobile customer support representative. They used the data in the breach to social engineer the Google fi reps. Attackers still needed to get through Google’s customer support system to perform the SIM swaps.
        SkyMarshal 4y ago
        Does Google Fi have real humans for customer support? Last I checked they didn't, but it's been a while.
chatmasta 4y ago
Any network that isn't shared with your personal phone number. That is: if you have a dedicated number for SMS 2FA, it will show up in fewer places where the hackers might find it. It's easier to monitor for breaches, and replacing it is a simple matter of updating your accounts - no need to worry about lost contacts, friends, bills, etc. Although, "bills" reminds me - a lot of companies overload the use of 2FA SMS for both identification and 2FA purposes, not to mention most customer service centers expect the call to originate from the same number that receives 2FA SMS messages for authenticating to the account being serviced.
cypherpunks01 4y ago
Efani is the only carrier I'm aware of that is security-centric, I have not used them myself, but they claim zero SIM-swap attacks have been successful against them. Even though they are an MVNO they claim their upstream networks cannot change their customers' SIMs. Downside is it's expensive, it depends on what you need to protect I suppose.

Which cell phone network would you guys recommend for people who care about security?

bitcoinmoney 4y ago

US mobile has good 2FA.

zamnos 4y ago
Heads up that US mobile is an MVNO operating on T-Mobile and Verizon, so how good their 2FA system is irrelevant if hackers get deep enough into tmobile.
- comte7092 4y ago
  “Deep enough” would be true of any mobile carrier, to date all of these attacks are SIM swapping, with social engineering/phishing being the attack vector. Not particularly deep. Attackers would have to social engineer the MVNO directly, which is certainly easier if they have data they’ve stolen from t-mobile first, but this isn’t a “they’ll get in no matter what because they’ve pwned T-Mobile so bad” scenario.
  - jelled 4y ago
    https://www.bleepingcomputer.com/news/security/google-fi-data-breach-let-hackers-carry-out-sim-swap-attacks/ https://www.bleepingcomputer.com/news/security/google-fi-dat... This article says that Google Fi customers were SIM swapped due to a T-Mobile breach. Even though "[t]here was no access to Google's systems or any systems overseen by Google."
    - comte7092 4y ago
      > These attacks are conducted using social engineering, where the threat actor impersonates the customer and requests that the number be ported to a new device for some reason. To convince the mobile carrier that they are the customer, they provide personal information exposed to phishing attacks and data breaches. > As the Google Fi data breach includes phone numbers, which can easily be linked to a customer's name, and the serial number of SIM cards, it would have made it even more convincing when contacting a mobile customer support representative. They used the data in the breach to social engineer the Google fi reps. Attackers still needed to get through Google’s customer support system to perform the SIM swaps.
      - SkyMarshal 4y ago
        Does Google Fi have real humans for customer support? Last I checked they didn't, but it's been a while.

chatmasta 4y ago

Any network that isn't shared with your personal phone number. That is: if you have a dedicated number for SMS 2FA, it will show up in fewer places where the hackers might find it. It's easier to monitor for breaches, and replacing it is a simple matter of updating your accounts - no need to worry about lost contacts, friends, bills, etc. Although, "bills" reminds me - a lot of companies overload the use of 2FA SMS for both identification and 2FA purposes, not to mention most customer service centers expect the call to originate from the same number that receives 2FA SMS messages for authenticating to the account being serviced.

cypherpunks01 4y ago

Efani is the only carrier I'm aware of that is security-centric, I have not used them myself, but they claim zero SIM-swap attacks have been successful against them. Even though they are an MVNO they claim their upstream networks cannot change their customers' SIMs. Downside is it's expensive, it depends on what you need to protect I suppose.