5 ms·
Still a major mistake to deploy eSIM; physical SIM is an excellent security feature. Caution: never use eSIM with your real phone number; always get a new phon
by egberts1 3y ago
Still a major mistake to deploy eSIM; physical SIM is an excellent security feature.
Caution: never use eSIM with your real phone number; always get a new phone number just for use with eSIM.
OTP does a way better job giving consumer absolutely control than the eSIM does for mobile providers. (Yeah, re-read that last sentence carefully).
Disclaimer: I do eUICC vulnerability analysis with eIM.
https://www.ericsson.com/en/blog/2023/12/simplifying-iot-innovative-esim-specification-takes-center-stage https://www.ericsson.com/en/blog/2023/12/simplifying-iot-inn...
- TMWNN 3y ago>Caution: never use eSIM with your real phone number; always get a new phone number just for use with eSIM. Yet again, having ported my phone number to Google Voice (GrandCentral back then), and never giving out whatever my current SIM's phone number is, pays off
- TeMPOraL 3y agoHow does this work? I thought GV and other VOIP numbers are becoming universally blacklisted by everyone because "sekhurity".
- asimpletune 3y agoI had a big carrier number that I later transferred to google voice and I've never had any issues with it since.
- oefrha 3y agoIt’s funny, I ported my number to Google Voice, two years later I got kicked off Zelle because VOIP numbers are banned. So how do I send and receive money? Sign up Zelle with email instead. Yes, a VOIP number is a security threat (never mind Wells Fargo has known everything about me financially since forever), but a random email address is A-OK.
- checkyoursudo 3y agoI can get SMS "security" codes from most services to my google voice number, but one of my banks just flat out refuses, and let me tell you it can be a huge pain in the ass if a few circumstances line up so that you cannot receive a "security" clear-text msg on your approved phone.
- NoZebra120vClip 3y agoSending SMS costs $$$, and the gateways are closely-guarded. There are bad actors hammering on logins to elicit SMS codes, and Zelle is charged for the service according to that volume.
- oefrha 3y agoThere’s no separate Zelle login, and Wells Fargo proper hasn’t banned my phone number, so this explanation makes no sense whatsoever.
- yencabulator 3y agoZelle is a separate company that likely operates its SMS sending system separately from Wells Fargo.
- guiambros 3y agoThere are a few stupid sites that ban VOIP numbers, but thankfully it's still very rare. The vast majority (like 90-95%) accepts just fine. Source: GV user since Grand Central days.
- silisili 3y agoI have a ton of accounts. The only ones I know of actively blocking it are Elan Financial(credit card servicer) and maybe Chase. Not sure on Chase, it doesn't block it, just doesn't seem to gets msgs for 2fa. Everything else (including paypal, fidelity, schwab, sofi, discover, capital one, to name a handful) work fine.
- egberts1 3y agoYour act (of going presumably SIM-less) has increased the surface area of attack on your own line by at least a thousand-fold over traditional mobile phone provider but still (probably barely) safer than eSIM. The Internet is more harsh than telco backend infrastructure.
- guiambros 3y agoGenuinely curious about why you believe that. Carriers are notoriously sloppy with handling SIM swap attacks, while Google is notoriously hard to get into an account (even your own, if you happen to lose your password or 2FA).
- egberts1 3y agoOne word: Backend.
- guiambros 3y ago> "One word: Backend." Sorry, I still don't get it. Telco's backend is a mess. It has a profusion of processes and frontend systems for customer service teams to interface with user records, which creates all sort of loopholes. Any sufficiently motivated attacker can pull a SIM swap attack, as it happens frequently, and the weak link is always a variation of: a clueless agent somewhere trying to help a poor "customer" who dropped their phone in the toilet, and needs to urgently to recover the number. Or are you suggesting that Google's GV backend is riskier than the carriers?
- yencabulator 3y agoActually, let's not mince words. SIM swap attacks are also enabled by literally criminal employees getting paid by other criminals for their access to the telco system.
- rsync 3y ago"Yet again, having ported my phone number to Google Voice (GrandCentral back then), and never giving out whatever my current SIM's phone number is, pays off ..." Agreed. My phone number lives at twilio and I couldn't tell you the physical phone number on my SIM card ... I have no idea what it is without looking it up. In addition to the obvious benefits of never caring whether you lose your phone or being vulnerable to a SIM swap there are other "telco superpowers" that come along with this arrangement: - I can text you, from my number, from the command line (curl API) - I can lose my phone and still send and receive SMS (again, curl API) - I can "sanitize" incoming text messages to ascii-256, block attachments, block or alert on silent SMS, etc. - block lists for incoming voice and SMS - CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice). Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A: https://kozubik.com/items/2famule/ https://kozubik.com/items/2famule/
- TMWNN 3y ago>- I can text you, from my number, from the command line (curl API) For SMS, Google Vooice both sends to and receives from email. I have a cronjob set up to `mail` a TextNow number that needs activity every 28 days to stay alive. >- CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice). Oh, I like this. I tend to delete most of my SMS-via-email, and the texts are always searchable in my Google Voice account, but can definitely see the appeal of always archiving all incoming texts with my mail so that I can use `mairix` for search. >Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A: Nice. I do use my phone's SIM (now eSIM) number when (and only when) 2FA won't take Google Voice, but if I decide that is a meaningful security flaw, your approach would work. Speaking of telco superpowers, I don't know if Twilio lets you do this but Google Voice has always supported voice calls by browser. The only time I make or answer a phone call on my phone is when I am away from my computer. When iOS 8 appeared, I'd enjoyed the equivalent of Continuity for years.
- aaron695 3y ago[dead]
- LeafItAlone 3y ago> Caution: never use eSIM with your real phone number; always get a new phone number just for use with eSIM. This seems to be impractical advice with the way devices are going. Look at iPhones.
- javajosh 3y agoAs with so many things, like physical media, the wider world will undervalue some devices which is an opportunity for those in the know. It's a consolation prize, to be sure, but it's not nothing.
- eqvinox 3y ago> This seems to be impractical advice with the way devices are going. Look at iPhones. Unfortunately, quite a few security practices are sometimes "impractical". If you go purely by practicality, all computers would always trust you and do as you request — what is that if not the most practical way of interacting with a computer? You always need to decide where to place your personal trade-off, maximize in that direction, and be honest about it to yourself. If you don't care about security to this degree, buy an iPhone. If you don't care about their known shortcomings, use face ID and/or fingerprint sensors. Or buy a different phone. > way devices are going. Look at iPhones. Also, FTR, almost all US people have a distorted view of iPhone market share. It's only the US where they have about half the market. It's far less in the rest of the world. That said, they still have somewhat of a "technology leader" position where everyone else feels like they have to imitate it, so… meh.
- kanbara 3y agopeople (companies) want to emulate apple because they sell devices like hotcakes, and develop or remove features that users eventually like/want/expect/don't miss, which brings down mfg cost and enables new technologies. i don't understand why people say "meh" about companies copying apple, _as if it is apple's fault_. it's samsung, google, huawei, etc. making those decisions. if apple has 20-30% marketshare in most of the world, but has stronger fanbase, makes more money, and pushes tech boundaries, of course other companies will want to follow.
- kenmacd 3y agoI'd much prefer companies actually follow NIST and stop using SMS for any type of authentication. eSIM has the advantage of allowing me to switch to cheaper services without paying $10 and waiting for a physical card to arrive. Is it's security crap? Well so is the security of my mobile provider's kiosk minimum-wager workers.
- Sayrus 3y ago> without paying $10 Reducing delays to near instantaneous is an argument, but having to pay $10 for a physical SIM sounds like a scam. Yet I've seen providers making people pay for eSIM as well so it seems they like to do this. On my provider, physical SIM are free and available under 24h. eSIM are free as well and I haven't seen a single SIM on any local provider more expensive than 1€.
- carlmr 3y ago>I'd much prefer companies actually follow NIST and stop using SMS for any type of authentication. I still like the feature that I keep my number as long as I pay. With other 2FA I'm always one device failure from permanent lockout.
- turquoisevar 3y agoI’d add a caveat. Namely that physical SIMs are an excellent security feature, provided carriers aren’t cavalier about managing them. Nowadays US carriers put up a few more hurdles here and there after some highly publicized issues, but it’s still bonkers that I can ultimately just read off the ICCID of a card in my possession and get a number ported to it. Most European carriers don’t allow you to bring your own SIM and will instead only link numbers to SIMs issued to the customer by themselves. That in and of itself would make things safer, but, and this practice varies from carrier to carrier and country to country, often times they require in-person pickup with ID check or courier delivery with ID scan. Although there are also plenty that just send it to the address on file.
- fkkffdddd 3y agoNever heard before this was possible. Do you have some example which carrier allows to bring your own SIM? Ideally, if you have some support page handy that’d explain the process. Honestly, with normal SIM cards this shouldn’t be possible, as you cannot program the keys into the card. There are some eSIM-on-SIM-cards that you could use if your phone isn’t eSIM capable. But again, would be nice to check.
- hpjxohxoyx 3y agoyou can buy tmo sims off amazon and activate them by id
- eqvinox 3y ago> as you cannot program the keys into the card You don't need to program the keys into the card, you program the card's identity/public key into the network.
- fkkffdddd 3y agoMobile Networks use symmetric keys for mutual authentication. You need the same key both in SIM and the carriers database. What I guess you mean is, you buy an inactive SIM from Vodafone (which has Vodafone-known keys on it), and then you’re telling Vodafone to use that card. By „bring your SIM“ I thought of something non-branded and was surprised. Essentially that is what’s happening with eSIM, hence the need for the provisioning step that also makes transferring hard.