3 ms·

Lets try the same logic everywhere else. Companies embracing password login should be blamed for sticky note thefts. Companies embracing email 2FA should be b

Lets try the same logic everywhere else. Companies embracing password login should be blamed for sticky note thefts. Companies embracing email 2FA should be blamed for email account theft. I dont know if this holds up hey. We see this time and again. An entity that does not break the law, makes itself available to the law, and its customers get hit by a criminal entity that does not follow the law. Because we cant snap our fingers and demand the government make thieving criminals double or triple illegal, people reach for a largely innocent party and want to make their lives worse. Take a deep deep breath and let it go. Theres no unharmful level of punishing the innocent on behalf of the guilty. This is going to sound wild and crazy but the people swapping the sim should be blamed for the sim swapping attack. What? Blame the criminal? I know its a bold stance but its correct.

mx_03 3y ago
Thats a strawman fallacy. You can control not writing your sticky note. You cant control a sim swap attack.
- spenvo 3y ago
  Yup it's a strawman argument. And furthermore, even the rhetoric used to downplay the idea of holding companies accountable is off: The idea of "blame" (with some handwaving) carries weight in court and sways juries. And companies are getting sued for big sums over negligence regarding SIM-swaps, like here https://www.techmeme.com/190723/p15#a190723p15 https://www.techmeme.com/190723/p15#a190723p15
  - Jiro 3y ago
    AT&T won that case: https://blockworks.co/news/att-crypto-sim-swap-lawsuit https://blockworks.co/news/att-crypto-sim-swap-lawsuit
caconym_ 3y ago
> Lets try the same logic everywhere else. The difference between SMS 2FA and the examples you mentioned is that the former is literally impossible to use securely because there is (AFAICT) no (American) consumer mobile provider that implements proper safeguards against unauthorized SIM swaps and similar. Any company implementing SMS 2FA ought to know this, and any company knowingly implementing a deeply flawed 2FA system and selling it to consumers as "more secure" ought to be held liable when it fails. And the sooner SMS 2FA dies, the sooner the same old websites that implement SMS 2FA and nothing else will be forced to implement something that's actually secure.
- xxs 3y ago
  Unfortunately, there are already laws that demand sms auth, e.g. online gambling in some US states (new jersey, being one). The persevere practice has been established as 'strong login'.
mcmoor 3y ago
This is what I thought about the 23andMe debacle. They may should have done better, but any attempt to "punish" them really feels like ex post facto law. Make new regulation or something and punish future incidents, but not this one.
balls187 3y ago
And blame the carriers.
- protocolture 3y ago
  Carriers can certainly carry an amount of blame. IIRC in Aus its gotten harder to activate a new sim for these reasons. The attacks haven't stopped entirely but its gotten more rare. It now relies on a very persistent social engineering attack to pull off. That said number portability is a really deep well. And theres utility in keeping it somewhat liquid for the many many many people it benefits rather than making it terrible for everyone to prevent a number of attacks.

mx_03 3y ago

Thats a strawman fallacy. You can control not writing your sticky note. You cant control a sim swap attack.

spenvo 3y ago
Yup it's a strawman argument. And furthermore, even the rhetoric used to downplay the idea of holding companies accountable is off: The idea of "blame" (with some handwaving) carries weight in court and sways juries. And companies are getting sued for big sums over negligence regarding SIM-swaps, like here https://www.techmeme.com/190723/p15#a190723p15 https://www.techmeme.com/190723/p15#a190723p15
- Jiro 3y ago
  AT&T won that case: https://blockworks.co/news/att-crypto-sim-swap-lawsuit https://blockworks.co/news/att-crypto-sim-swap-lawsuit

caconym_ 3y ago

> Lets try the same logic everywhere else. The difference between SMS 2FA and the examples you mentioned is that the former is literally impossible to use securely because there is (AFAICT) no (American) consumer mobile provider that implements proper safeguards against unauthorized SIM swaps and similar. Any company implementing SMS 2FA ought to know this, and any company knowingly implementing a deeply flawed 2FA system and selling it to consumers as "more secure" ought to be held liable when it fails. And the sooner SMS 2FA dies, the sooner the same old websites that implement SMS 2FA and nothing else will be forced to implement something that's actually secure.

xxs 3y ago
Unfortunately, there are already laws that demand sms auth, e.g. online gambling in some US states (new jersey, being one). The persevere practice has been established as 'strong login'.

mcmoor 3y ago

This is what I thought about the 23andMe debacle. They may should have done better, but any attempt to "punish" them really feels like ex post facto law. Make new regulation or something and punish future incidents, but not this one.

balls187 3y ago

And blame the carriers.

protocolture 3y ago
Carriers can certainly carry an amount of blame. IIRC in Aus its gotten harder to activate a new sim for these reasons. The attacks haven't stopped entirely but its gotten more rare. It now relies on a very persistent social engineering attack to pull off. That said number portability is a really deep well. And theres utility in keeping it somewhat liquid for the many many many people it benefits rather than making it terrible for everyone to prevent a number of attacks.