4 ms·

Well, it's a good thing that even those people will still be able to recover their account with just a new SIM or new phone. (Depending on whether they lost the

by jsnell 3y ago

Well, it's a good thing that even those people will still be able to recover their account with just a new SIM or new phone. (Depending on whether they lost the phone completely, or if it just stopped working.)

nottorp 3y ago
So those impenetrable keys can be reset with just a SIM clone? What's the point then?
- jsnell 3y ago
  Unlike what reading HN comments might lead you to believe, SIM swapping is neither easy nor common. It requires an insider accomplice with limited bandwidth and who is running a very real risk of getting caught. That's expensive. Just trading off the phishing risk against that would be an amazing deal for most people. (Of course not everyone, I know you'd never be fooled by a phishing attack.) But also, account recoveries are in principle rare events, as opposed to logging in which is common. So you can and should apply very different security policies to the two cases. A very simple solution to preventing SIM swapping attacks on account recovery is to just add a delay to the recovery, and notify the user about the attempt via other channels. That means that not only does the attacker need to hijack the phone number, they also need to keep control of it for days, prevent the real user from seeing the messages and blocking the recovery attempt, etc. (There's plenty one can do to decrease the friction and to increase the security on top of that, but even that simple solution gets you most of the way there.) That wouldn't be acceptable in a login scenario, you can't tell the user to wait for three days for the login to complete. But for a once per decade loss of all credentials? That's a lot more palatable.
  - namaria 3y ago
    SIM swapping absolutely does not require vulnerable insiders. It is exceedingly easy to impersonate people to corporate employees who are neither trained nor willing to be strict about identity documentation lest a legitimate client get angry and result in their termination.

by jsnell 3y ago

nottorp 3y ago

So those impenetrable keys can be reset with just a SIM clone? What's the point then?

jsnell 3y ago
Unlike what reading HN comments might lead you to believe, SIM swapping is neither easy nor common. It requires an insider accomplice with limited bandwidth and who is running a very real risk of getting caught. That's expensive. Just trading off the phishing risk against that would be an amazing deal for most people. (Of course not everyone, I know you'd never be fooled by a phishing attack.) But also, account recoveries are in principle rare events, as opposed to logging in which is common. So you can and should apply very different security policies to the two cases. A very simple solution to preventing SIM swapping attacks on account recovery is to just add a delay to the recovery, and notify the user about the attempt via other channels. That means that not only does the attacker need to hijack the phone number, they also need to keep control of it for days, prevent the real user from seeing the messages and blocking the recovery attempt, etc. (There's plenty one can do to decrease the friction and to increase the security on top of that, but even that simple solution gets you most of the way there.) That wouldn't be acceptable in a login scenario, you can't tell the user to wait for three days for the login to complete. But for a once per decade loss of all credentials? That's a lot more palatable.
- namaria 3y ago
  SIM swapping absolutely does not require vulnerable insiders. It is exceedingly easy to impersonate people to corporate employees who are neither trained nor willing to be strict about identity documentation lest a legitimate client get angry and result in their termination.