5 ms·

I don't want to authenticate using something I have, because I won't be able to authenticate if I lose that thing. Phone number is something I legally own and t

by zb3 3y ago

I don't want to authenticate using something I have, because I won't be able to authenticate if I lose that thing. Phone number is something I legally own and this ownership can be enforced because I can get a new SIM card with the same number using my government ID - something I am rather than I (temporarily) have

edf13 3y ago
Not sure you legally own a phone number... isn't more of you legally have the right to use it whilst the telco allows it/and you pay your bill?
- red_trumpet 3y ago
  Isn't the telco contractually required to let me use it? Not sure about the US, but in Germany I think you even have the right to keep your phone number when changing telcos.
- easyThrowaway 3y ago
  I guess it depends on the jurisdiction, but in Europe (at least, France and Italy I'm certain of) the phone number is treated as personal sensitive data[1] and "owned" by the contract owner, not the telco. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en https://commission.europa.eu/law/law-topic/data-protection/r...
  - ThePowerOfFuet 3y ago
    No, this is not ownership.
world-set-free 3y ago
Just to warn, social engineering attacks can get sims transfered without your involvement. There were some stories about it here somewhere a very long time ago.
- zb3 3y ago
  Yes, I know - my method isn't perfect. But at the same time I don't want to rely on some "irreversible" purely technical solutions to the complex problem of (human) authentication.
  - deleted 3y ago
    [deleted]
shortcake27 3y ago
This is not exactly true for many countries. In Australia, for example, telcos get punished heavily for delaying ports but don’t get punished for unauthorised ports. This disincentivises telcos to perform any due diligence whatsoever. Up until a few years ago, anyone could walk into a telco and port any random number onto a new sim. These processes are improving, but sim swapping is still trivial. Not to mention SMS is also an unencrypted medium. I avoid using my phone number for MFA unless I’m forced into it (which sadly happens quite often).
- ggm 3y ago
  This is counter to my understanding. I've always believed SIM porting attacks are both harder and less frequent in Australia compared to the USA
  - shortcake27 3y ago
    I can’t speak to USA vs Australia as I don’t know what the process is like in the USA, but this is how Australia works. The regulation originated from good intentions - in the 90s telcos would make it difficult for people to port their number, so ACMA stamped that out by prohibiting the losing telco from denying/delaying a port. It was up to the gaining telco to verify the identity of the owner, which was rarely done. You could just walk into a telco, give them your number, and get it ported to a new phone/sim immediately. I did it plenty of times in the 2000s. Unfortunately these regulations now hurt the consumer more than they help. Imagine if you could transfer a domain name without a transfer code or confirmation from the owner or current registrar. That’s what phone numbers are like in Australia. I absolutely want my telco to deny a port without my permission, but regulation prevents them from doing this. Instead, I have to rely on every other telco in Australia doing their due diligence if someone tries to port my number. It’s a losing battle because my identity has been leaked several times in the past few years. I have to assume that at any moment my phone number will be ported away by a bad actor. I believe this is being reformed to require explicit approval from the owner. But this is very late and inferior compared to other countries such as the UK with PAC codes etc.
    - 3y ago
krmbzds 3y ago
You might get pwned by (1) the government, (2) your mobile carrier, or (3) a hacker that can social-engineer your mobile carrier's tech-support (SIM jacking / SIM swap attack).
- zb3 3y ago
  Yes, that's true, but it's not an argument in favor of authentication based on something I have. I don't think we can prevent everything, but I at least want there to be some way to undo the damage (things like courts, chargebacks and so on).
  - krmbzds 3y ago
    I think the argument for something you have is cyber-physical security. No matter how advanced malware is it won't be able to extend a finger through your monitor and tap the capacitive touch sensor of your Yubikey.

by zb3 3y ago

edf13 3y ago

Not sure you legally own a phone number... isn't more of you legally have the right to use it whilst the telco allows it/and you pay your bill?

red_trumpet 3y ago
Isn't the telco contractually required to let me use it? Not sure about the US, but in Germany I think you even have the right to keep your phone number when changing telcos.
easyThrowaway 3y ago
I guess it depends on the jurisdiction, but in Europe (at least, France and Italy I'm certain of) the phone number is treated as personal sensitive data[1] and "owned" by the contract owner, not the telco. [1] https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en https://commission.europa.eu/law/law-topic/data-protection/r...
- ThePowerOfFuet 3y ago
  No, this is not ownership.

world-set-free 3y ago

Just to warn, social engineering attacks can get sims transfered without your involvement. There were some stories about it here somewhere a very long time ago.

zb3 3y ago
Yes, I know - my method isn't perfect. But at the same time I don't want to rely on some "irreversible" purely technical solutions to the complex problem of (human) authentication.
- deleted 3y ago
  [deleted]

shortcake27 3y ago

This is not exactly true for many countries. In Australia, for example, telcos get punished heavily for delaying ports but don’t get punished for unauthorised ports. This disincentivises telcos to perform any due diligence whatsoever. Up until a few years ago, anyone could walk into a telco and port any random number onto a new sim. These processes are improving, but sim swapping is still trivial. Not to mention SMS is also an unencrypted medium. I avoid using my phone number for MFA unless I’m forced into it (which sadly happens quite often).

ggm 3y ago
This is counter to my understanding. I've always believed SIM porting attacks are both harder and less frequent in Australia compared to the USA
- shortcake27 3y ago
  I can’t speak to USA vs Australia as I don’t know what the process is like in the USA, but this is how Australia works. The regulation originated from good intentions - in the 90s telcos would make it difficult for people to port their number, so ACMA stamped that out by prohibiting the losing telco from denying/delaying a port. It was up to the gaining telco to verify the identity of the owner, which was rarely done. You could just walk into a telco, give them your number, and get it ported to a new phone/sim immediately. I did it plenty of times in the 2000s. Unfortunately these regulations now hurt the consumer more than they help. Imagine if you could transfer a domain name without a transfer code or confirmation from the owner or current registrar. That’s what phone numbers are like in Australia. I absolutely want my telco to deny a port without my permission, but regulation prevents them from doing this. Instead, I have to rely on every other telco in Australia doing their due diligence if someone tries to port my number. It’s a losing battle because my identity has been leaked several times in the past few years. I have to assume that at any moment my phone number will be ported away by a bad actor. I believe this is being reformed to require explicit approval from the owner. But this is very late and inferior compared to other countries such as the UK with PAC codes etc.
  - 3y ago

krmbzds 3y ago

You might get pwned by (1) the government, (2) your mobile carrier, or (3) a hacker that can social-engineer your mobile carrier's tech-support (SIM jacking / SIM swap attack).

zb3 3y ago
Yes, that's true, but it's not an argument in favor of authentication based on something I have. I don't think we can prevent everything, but I at least want there to be some way to undo the damage (things like courts, chargebacks and so on).
- krmbzds 3y ago
  I think the argument for something you have is cyber-physical security. No matter how advanced malware is it won't be able to extend a finger through your monitor and tap the capacitive touch sensor of your Yubikey.