6 ms·

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), lo

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services actually decrease the security of my account.

isykt 3y ago
You’re absolutely right on that last part. Making phone numbers required for signing up was only nominally to improve security. Overall, it’s a net negative for privacy and security, and only benefits the service provider by allowing them to track you (they can buy data on that phone number and create a profile on you) + reducing the number of people calling/emailing them because the user is locked out of their account.
gruez 3y ago
>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.
- ajsnigrutin 3y ago
  Don't sim cards have PIN authentication enabled by default?
  - gruez 3y ago
    Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.
    - ajsnigrutin 3y ago
      Interesting... i usually buy prepaid sim cards outside of EU (due to "fuck-you" roaming prices), and every time I bought one, in multiple countries, I had to scratch off the silver "paint" to get to the random pin written on the sim card (the large plastic part, the one that you break of the mini/micro/nano sim from).
  - andrewl-hn 3y ago
    Yes, but as I moved between countries and bought SIM cards from many carriers all carrier employees offered me to disable the pin "for convenience". Let's say your phone died, and you put it on a charger. A phone would eventually turn itself back on, but if your sim is locked you. wouldn't be able to accept incoming calls until you unlock the phone and unlock the phone. Without a sim pin once your phone turns on you become available again. People like that. Also, even if you want to keep the pin on many people would set it to something convenient like 1111 or 9999. In fact, one of the carriers I used had 1111 s a default pin code for all their SIM cards. So, while security is there in theory, in practice it's rarely in place.
- elzbardico 3y ago
  This is the main reason I changed my SIM to an e-SIM
- everybodyknows 3y ago
  > pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number. Can they do this without connecting to a cell tower? Otherwise, the carrier would notice the pairing of your SIM to the new IMEI, and further security steps would be possible.
  - gruez 3y ago
    While what you described is theoretically possible, I've never seen any mobile provider implement it. The reason is fairly simple: if you cared about the security of your sim, you'd set a sim pin. If you don't, you don't set a pin. Requiring reauthentication every time your IMEI is going to cause a massive increase in support calls for very little security gain.

isykt 3y ago

You’re absolutely right on that last part. Making phone numbers required for signing up was only nominally to improve security. Overall, it’s a net negative for privacy and security, and only benefits the service provider by allowing them to track you (they can buy data on that phone number and create a profile on you) + reducing the number of people calling/emailing them because the user is locked out of their account.

gruez 3y ago

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

ajsnigrutin 3y ago
Don't sim cards have PIN authentication enabled by default?
- gruez 3y ago
  Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.
  - ajsnigrutin 3y ago
    Interesting... i usually buy prepaid sim cards outside of EU (due to "fuck-you" roaming prices), and every time I bought one, in multiple countries, I had to scratch off the silver "paint" to get to the random pin written on the sim card (the large plastic part, the one that you break of the mini/micro/nano sim from).
- andrewl-hn 3y ago
  Yes, but as I moved between countries and bought SIM cards from many carriers all carrier employees offered me to disable the pin "for convenience". Let's say your phone died, and you put it on a charger. A phone would eventually turn itself back on, but if your sim is locked you. wouldn't be able to accept incoming calls until you unlock the phone and unlock the phone. Without a sim pin once your phone turns on you become available again. People like that. Also, even if you want to keep the pin on many people would set it to something convenient like 1111 or 9999. In fact, one of the carriers I used had 1111 s a default pin code for all their SIM cards. So, while security is there in theory, in practice it's rarely in place.
elzbardico 3y ago
This is the main reason I changed my SIM to an e-SIM
everybodyknows 3y ago
> pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number. Can they do this without connecting to a cell tower? Otherwise, the carrier would notice the pairing of your SIM to the new IMEI, and further security steps would be possible.
- gruez 3y ago
  While what you described is theoretically possible, I've never seen any mobile provider implement it. The reason is fairly simple: if you cared about the security of your sim, you'd set a sim pin. If you don't, you don't set a pin. Requiring reauthentication every time your IMEI is going to cause a massive increase in support calls for very little security gain.