6 ms·

U.S. FCC says new rules will curb SIM swapping

66 points by walterbell 3y ago

devaiops9001 3y ago
I second what exabrial said. Any corporate person who asks for SMS 2FA as a condition to use a service should be fined $750,000 per violation.
BIackSwan 3y ago
Perhaps fcc should look at India’s regulatory mechanism for sim swap solution. They disable SMSes altogether for 48 hrs when a new sim is given. This gives enough time for a victim to go to a physical location to resolve the issue. It doesn’t solve it 100% but definitely introduces enough friction to put a dent in the efficiency of the attackers.
mindslight 3y ago
How about just making it illegal to use phone numbers for digital authentication? 95% of the problem solved right there. The current setup feels akin to the longstanding problem of companies using social security and driving license numbers for authentication. Only the industry speedran the creation of this new problem, so they should be expected to get rid of it just as quick.
- otabdeveloper4 3y ago
  What's the alternative? Government-issued FIDO2 keys? Good luck with that.
  - mindslight 3y ago
    I'm quite content with simple passwords on most accounts. But there is also email challenge, non-authority-issued security keys, and authenticator apps. All solutions that are currently being used by consumer-facing companies, and generally considered more secure and often less privacy invasive.
    - amatecha 3y ago
      Yeah, I'd at least like the choice of which one(s) to use, but more and more services are specifically requiring a mobile phone number, and requiring SMS 2FA, which is blatantly ridiculous (and I agree should be outlawed). Thanks for totally locking me out of my account while I'm overseas...
  - Rebles 3y ago
    authenticator apps +1
    - vkou 3y ago
      What about people who don't have a smartphone?
      - amatecha 3y ago
        You could get those little mini RSA token things that are just a battery-powered thing the size of a USB stick. I assume those are still around... haven't used one in years tho.
        jrockway 3y ago
        These are pretty insecure because OTPs are easily phishable. WebAuthn devices are just as inexpensive, but prevent most phishing attacks.
      - xjay 3y ago
        They'll get a government-issued ankle monitor/smartphone..
      - foota 3y ago
        Couldn't you just set up a text service to request a one time token? That way you could fall back to SMS, but it wouldn't be required. (e.g., anyone could create a service that someone could use, which would allow them to request a 2fa code to be issued over SMS at any time after enrolling it via the OTP pairing process)
        vkou 3y ago
        What happens when the attacker uses that fallback to perform the exact same attack that they perform today?
      - crotchfire 3y ago
        There is no smartphone requirement in RFC 6238. Smartphones are simply the device that a lot of people use as their user-agent, but you can use a computer if you prefer. https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238
exabrial 3y ago
How about instead we just make it illegal to use SMS for identity verification? I'm tired of "Your phone is your identity". It's exclusive of certain society members anyway, horribly not-encrypted, not-authenticated, can be intercepted, replayed, spoofed, phished, and a million other reasons. Your phone number should not be your gateway to essential services like banking, investments, or even personal life. The madness has to _fucking_ stop.
- patrick451 3y ago
  Makes sense in principle, but what's the alternative? Do we get rid of 2FA altogether?
  - exabrial 3y ago
    Sms “auth” is doing nothing but piggybacking/hijacking the hard credit pull the carriers ran on you when you got your phone. So something that indicates there’s a real person there paying a bill. Plenty of room for innovation here but my suspicion would be that it be a function of a credit bureau.
    - bensecure 3y ago
      Does sms auth not work with prepaid sim cards? I think the real benefit is that a sim card is basically a trusted computing device, but with a system in place at the carrier to give you back your number if you lose it. In effect, its a digital proof of identity. Since identity is fundamentally the job of the government, the real solution should be id cards with trusted computing chips in them. Though that will open up a can of worms with regards to privacy and government overreach.
      - mindslight 3y ago
        Simple answer: implement a privacy law with teeth. It doesn't even need to be framed from scratch - the GDPR does a fantastic job at preempting most of the flaws that lobbyists would love to slip in.

66 points by walterbell 3y ago

I second what exabrial said. Any corporate person who asks for SMS 2FA as a condition to use a service should be fined $750,000 per violation.

BIackSwan 3y ago

Perhaps fcc should look at India’s regulatory mechanism for sim swap solution. They disable SMSes altogether for 48 hrs when a new sim is given. This gives enough time for a victim to go to a physical location to resolve the issue. It doesn’t solve it 100% but definitely introduces enough friction to put a dent in the efficiency of the attackers.

mindslight 3y ago

How about just making it illegal to use phone numbers for digital authentication? 95% of the problem solved right there. The current setup feels akin to the longstanding problem of companies using social security and driving license numbers for authentication. Only the industry speedran the creation of this new problem, so they should be expected to get rid of it just as quick.

otabdeveloper4 3y ago
What's the alternative? Government-issued FIDO2 keys? Good luck with that.
- mindslight 3y ago
  I'm quite content with simple passwords on most accounts. But there is also email challenge, non-authority-issued security keys, and authenticator apps. All solutions that are currently being used by consumer-facing companies, and generally considered more secure and often less privacy invasive.
  - amatecha 3y ago
    Yeah, I'd at least like the choice of which one(s) to use, but more and more services are specifically requiring a mobile phone number, and requiring SMS 2FA, which is blatantly ridiculous (and I agree should be outlawed). Thanks for totally locking me out of my account while I'm overseas...
- Rebles 3y ago
  authenticator apps +1
  - vkou 3y ago
    What about people who don't have a smartphone?
    - amatecha 3y ago
      You could get those little mini RSA token things that are just a battery-powered thing the size of a USB stick. I assume those are still around... haven't used one in years tho.
      - jrockway 3y ago
        These are pretty insecure because OTPs are easily phishable. WebAuthn devices are just as inexpensive, but prevent most phishing attacks.
    - xjay 3y ago
      They'll get a government-issued ankle monitor/smartphone..
    - foota 3y ago
      Couldn't you just set up a text service to request a one time token? That way you could fall back to SMS, but it wouldn't be required. (e.g., anyone could create a service that someone could use, which would allow them to request a 2fa code to be issued over SMS at any time after enrolling it via the OTP pairing process)
      - vkou 3y ago
        What happens when the attacker uses that fallback to perform the exact same attack that they perform today?
    - crotchfire 3y ago
      There is no smartphone requirement in RFC 6238. Smartphones are simply the device that a lot of people use as their user-agent, but you can use a computer if you prefer. https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238

exabrial 3y ago

How about instead we just make it illegal to use SMS for identity verification? I'm tired of "Your phone is your identity". It's exclusive of certain society members anyway, horribly not-encrypted, not-authenticated, can be intercepted, replayed, spoofed, phished, and a million other reasons. Your phone number should not be your gateway to essential services like banking, investments, or even personal life. The madness has to _fucking_ stop.

patrick451 3y ago
Makes sense in principle, but what's the alternative? Do we get rid of 2FA altogether?
- exabrial 3y ago
  Sms “auth” is doing nothing but piggybacking/hijacking the hard credit pull the carriers ran on you when you got your phone. So something that indicates there’s a real person there paying a bill. Plenty of room for innovation here but my suspicion would be that it be a function of a credit bureau.
  - bensecure 3y ago
    Does sms auth not work with prepaid sim cards? I think the real benefit is that a sim card is basically a trusted computing device, but with a system in place at the carrier to give you back your number if you lose it. In effect, its a digital proof of identity. Since identity is fundamentally the job of the government, the real solution should be id cards with trusted computing chips in them. Though that will open up a can of worms with regards to privacy and government overreach.
    - mindslight 3y ago
      Simple answer: implement a privacy law with teeth. It doesn't even need to be framed from scratch - the GDPR does a fantastic job at preempting most of the flaws that lobbyists would love to slip in.