3 ms·

So many companies are insisting on adding the extra vulnerability of sim-swapping. I imagine on the aggregate level there might be less fraud? Or is it just th

So many companies are insisting on adding the extra vulnerability of sim-swapping. I imagine on the aggregate level there might be less fraud? Or is it just the need to harvest more and more data? The way things are going, I wouldn't be surprised to see PayPal insist upon a mobile app install next.

slv77 3y ago
Malicious bots have gotten sophisticated enough that SMS verification and velocity controls are one of the few ways to manage Sybil attacks. Device and IP based systems can’t cope with the onslaught.
- toomuchtodo 3y ago
  We really need some smart card cryptographic mechanisms for those without a smart phone, similar to Estonia’s smart card digital ID system. Asking everyone to have a smart phone to be identity proofed is simply not reasonable.
  - UncleMeat 3y ago
    SMS works with dumb phones.
    - toomuchtodo 3y ago
      SMS is not a secure authenticator for identity proofing due to SIM swapping/hijacks/etc.
- donmcronald 3y ago
  I’ve always assumed bad actors buy SIM cards and mobile numbers in huge quantities. Isnt that a lot cheaper than having to buy devices? Regardless, requiring phone numbers impacts a lot of real customers in a negative way.
  - slv77 3y ago
    The bad actors do buy SIM cards in large quantities and there are services that will rent out the numbers for SMS verification. It substantially raises the cost for someone that wants to register 100,000 fraudulent accounts without linking accounts based on phone numbers.
landemva 3y ago
Some concert venues are requiring axs.com mobile app to show the ticket QR code for entry and parking. I found out after I had purchased tickets.
- mips_r4300i 3y ago
  This is also true for all venues through Ticketmaster (which is probably over 2/3 of them). A couple years ago, they moved from static barcodes to live, rolling 2d barcodes that expire every 30 seconds. It does work pretty well to prevent duping/fraud, but it absolutely requires a phone to enter the venue.

slv77 3y ago

Malicious bots have gotten sophisticated enough that SMS verification and velocity controls are one of the few ways to manage Sybil attacks. Device and IP based systems can’t cope with the onslaught.

toomuchtodo 3y ago
We really need some smart card cryptographic mechanisms for those without a smart phone, similar to Estonia’s smart card digital ID system. Asking everyone to have a smart phone to be identity proofed is simply not reasonable.
- UncleMeat 3y ago
  SMS works with dumb phones.
  - toomuchtodo 3y ago
    SMS is not a secure authenticator for identity proofing due to SIM swapping/hijacks/etc.
donmcronald 3y ago
I’ve always assumed bad actors buy SIM cards and mobile numbers in huge quantities. Isnt that a lot cheaper than having to buy devices? Regardless, requiring phone numbers impacts a lot of real customers in a negative way.
- slv77 3y ago
  The bad actors do buy SIM cards in large quantities and there are services that will rent out the numbers for SMS verification. It substantially raises the cost for someone that wants to register 100,000 fraudulent accounts without linking accounts based on phone numbers.

landemva 3y ago

Some concert venues are requiring axs.com mobile app to show the ticket QR code for entry and parking. I found out after I had purchased tickets.

mips_r4300i 3y ago
This is also true for all venues through Ticketmaster (which is probably over 2/3 of them). A couple years ago, they moved from static barcodes to live, rolling 2d barcodes that expire every 30 seconds. It does work pretty well to prevent duping/fraud, but it absolutely requires a phone to enter the venue.