12 ms·
What's the solution here? Can we practically expect employees at retail stores to not be permitted to change a person's phone over? What if the person who needs
by noodlesUK 3y ago
What's the solution here? Can we practically expect employees at retail stores to not be permitted to change a person's phone over? What if the person who needs the swap has said their phone is lost/stolen?
I think ideally there would be some kind of verification that the customer was indeed present and that their ID had been verified, but I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID. I also think you should be able to get a phone number without ID at all, which would preclude verification in those cases.
The issue is that people's phones are essentially the roots of trust for our digital lives. Passkeys being built into the OS are good because they push that problem away from carriers, but the fundamental issue still remains. Bootstrapping trust is hard.
- jupp0r 3y ago> What's the solution here? webauthn
- mantra2 3y agoSure wish more places would allow you to turn off SMS if you’re using something like a Yubi.
- lxgr 3y agoWebAuthN is an excellent alternative to passwords, but a relatively poor access recovery mechanism, given that it just kicks the can down the road to another provider at best (usually Apple or Google), and to a single physical object that's easy to lose at worst. I use it myself, but I do also understand companies and people that don't want to make it their only way back into their account as it is.
- jasonjayr 3y ago... away from carriers and into the hands of Google/Apple/Microsoft, who can kill your account for any and no reason at all. Except for that one giant issue, passkeys are gonna be great.
- patmorgan23 3y agoThere are several 'boutique' email providers (fast mail, proton, etc) that you can use instead of the big 3. You can even host your own MX server but use a relay service so you don't have to deal with IP reputation issues.
- Avicebron 3y agolol relay services have reputation issues, I was talking to someone today about trying to whitelist some vendor this company uses because they use a relay service and it looks sketch as hell when emails show up seeming to pretend to be someone else
- nijave 3y agoSketchy relay services have issues. Haven't had issues with AWS SES or Sendgrid They should still have proper SPF/DKIM/DMARC so you can verify the sender even if it was relayed
- CharlesW 3y ago> Except for that one giant issue, passkeys are gonna be great. Unlike passwords, you can have multiple passkeys associated with an account. Accessing from an iPhone? Use your Apple passkey. From Android? Use your Google passkey. Want cross-platform? Use your 1Password passkey. Etc.
- jasonjayr 3y agoRight. Relaying Parties (RPs) need to have beaten into their implementations that multiple keys for each identity is normal + correct behavior, and the number of multiple keys should not be unreasonably limited.
- ianburrell 3y agoAfter the trouble of adding multiple keys, I think there needs to be way to easily add multiple keys. Like uploaded file or service that has list of public keys. Something like cross-sign the keys and then authenticate one of them. I wonder if hassle means there will be more use of OAuth but that means trust.
- brightball 3y ago> but I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID. How so? Aren’t there multiple options available?
- patch_cable 3y agoThere are many available but people are not required to have one (unless driving, etc.)
- desert_rue 3y agoYeah when I lived in NYC, I came across a lot of people who didn’t have licenses but used other IDs from local government agencies.
- throw10920 3y agoInteresting! What other kinds of ID are there?
- tekknik 3y agoIn many states you can use a library card from a public library for ID in some instances.
- adrianmonk 3y agoIDs are used for many things other than driving, like: (1) buying alcohol / entering bars (2) flying (3) voting (in certain states) (4) a doctor's appointment (5) picking up a prescription (6) withdrawing cash at a bank (7) touring an apartment you might lease (for the leasing agents' safety) (8) returning items at a store if you don't have a receipt (as an anti-fraud measure)
- patch_cable 3y agoYes. Those are all excellent reasons to have an ID.
- dragonwriter 3y ago> I think ideally there would be some kind of verification that the customer was indeed present and that their ID had been verified, but I don’t see how you can do that in the US as there aren’t ID cards or similar forms of universally available ID. Requiring government issued photo ID for identity verification is not at all an uncommon policy for various purposes in the US, and AFAIK all states have universally available ID cards (they are generally not free of charge, but they are universally available.)
- mjevans 3y agoID REALLY should be paid for by taxes and 'free' for everyone obtaining their proof of identity. Now, a 'drivers' license might have an extra fee on top of that. Maybe the free IDs could be issued by police departments? Either way this is a good time for someone to register as a voter too, WA state has a simple checkbox for that and other states can too.
- gosub100 3y agoEspecially since the recent push for "Real ID" required to fly. Ok if it's so "Real" it should be easily scanned and verified. When you get your phone they should hand you a pamphlet saying that when you lose your phone this is the process, these are the risks, and offer you the option to upgrade the security to require, say, a passport to restore your account.
- datavirtue 3y agoYes, and the police could drive them to the voting booth as well.
- nicbou 3y agoI help people move to Germany. Requirements like this make it really hard for people to settle in a new place. On the other hand you can’t expect a teenager working minimum wage to identify a Thai passport. There exist services for ID verification, usually by video call. They exhibit the same limitations though.
- Salgat 3y agoI use Google Voice for this reason, so that you need to authenticate with my google account to modify anything related to my phone number. It's not perfect since there is still an internal forwarding number they could sim swap on, but it would require them associating the two numbers first, and I don't use my t-mobile number for anything outside being the forwarding number for google voice.
- ec109685 3y agoHaving a pin on your account before a swap (or any other action is allowed) seems like a useful barrier to entry. Then a corrupt employee needs something they won’t have to execute the swap.
- _dark_matter_ 3y agoThere is no way that most people would remember the pin, so employees would need some way to bypass. And voila, back to where we started.
- s007ss 3y agoPpl remember pins for many things E.g. Atm. The additional protection is better than not having it.
- gruez 3y agoThey remember because they enter the pin on a regular basis, and probably share it among all their other bank cards so they're using at least monthly. A pin that they set years ago and never used has zero chance of being remembered.
- lxgr 3y agoEven worse: If the PIN is user-selectable and four digits long, guess what most people will most likely pick?
- hiatus 3y ago> I also think you should be able to get a phone number without ID at all, which would preclude verification in those cases. While I agree with you, this is already not the case in much of Europe where an ID is required to obtain a sim card.
- grujicd 3y agoWhenever I go to mobile provider in Serbia to do anything related to account I have to provide government ID. They even put it in card reader to get relevant data. While SIM swap is certainly a theoretical risk, it's not a practical one around here. Having authentication on a phone or another physical device (without backup) seems to be at least two orders of magnitude higher risk of losing access to everything. Relying to Google or another third party for authentication is not without its risks too. I just hope SMS authentication won't go away completely for other parts of world where risk balance is different than in USA. Until things change, I trust more my local birocracy to work their birocratic ways and always check ID where needed then I would trust myself not to lose some auth device.
- paulpauper 3y agocrypto makes this scam much more lucrative, otherwise paying off an employee not worth the effort usually
- lxgr 3y agoCan you really not imagine any scenario other than crypto where compromising an employee's account could have financial consequences? Thinking about that somewhat large industry other than crypto dealing with people's money...
- paulpauper 3y agothen why did these attacks explode in popularity in 2018 and all involve crypto? Bank transfers can be reversed and can take days to process and have more security checks, crypto is instant and irreversible and the security checks much weaker.
- lxgr 3y agoOne might assume that, but there's still things like the fully digital Bangladesh bank robbery of 2016 [1]. Bank transfers are often, but not always, reversible, and sometimes finality is a feature desired by all participants and explicitly designed into systems, e.g. RTGSes. CEO fraud is on the rise and wouldn't be possible without these systems. That's one reason why these are often not directly available to private consumers without a banker and some level of ceremony in between. [1] https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery
- hot_gril 3y agoI can't imagine so many people paying off employees for SIM swaps only to get involved in a very complicated digital bank robbery. Maybe it'd happen once or twice.
- londons_explore 3y agoA simple time delay can solve 99% of cases. Simply require that a SIM can only be swapped if it is disconnected from the mobile network for 48 hours. And if it isn't disconnected, the original SIM will be called/texted to ask if they really want the SIM swap to happen.
- JumpCrisscross 3y ago> require that a SIM can only be swapped if it is disconnected from the mobile network for 48 hours If someone has both devices in hand, there isn't even need for a delay. The only time you need a delay is when the original device is missing. In that case, sending a message to that SIM and having a mandatory delay (ideally, customisable by the customer) seems reasonable.
- londons_explore 3y agoThe message text should say. > You have requested a replacement sim card. To proceed with the replacement now, reply "Yes". To keep this sim card, reply "No". If you do not reply, a replacement will be mailed to your billing address: 54 Wolverton Gardens in 7 days, and this sim will be deactivated. An attacker now has to overcome the time delay, and the fact that the replacement sim card must be mailed to the billing address. For those people who have an outdated billing address and lose the sim card, require the sim to be offline for 7 days, or demonstrate access to an email address or credit card on the account.
- aareet 3y agoThat's precisely what happens with SIMs in India. When a SIM swap happens, text messages are blocked for 24 hours to allow a customer to alert the operator before one time codes resume sending to the new SIM
- datavirtue 3y agoThat's a barrier to switching carriers.
- 3y ago
- lxgr 3y ago> What's the solution here? Not putting phone providers in charge of access to our digital lives. > that the customer was indeed present and that their ID had been verified Present where? My MVNO does not have any branches. And even if they did, why should I ever have to go there? I don't go to bank branches either if I can at all help it.
- fragmede 3y ago> either if I can at all help it. Sometimes you can't help it, you need a phone today, and need to go into a store for your phone company. No, buying a phone from Walmart or Best buy and waiting for a sim or doing some eSim thing won't work, you just need to get into a branch today. If an MVNO with no branches works for you, great, but some people need to be able to go into a branch of their cell phone provider/bank/utility.
- ipqk 3y agoMulti person approval, especially two that don’t work together.
- TheNewsIsHere 3y agoYou're not wrong, but trust is an issue here as well. If someone convinces both Person A and Person B of their legitimacy, even if they're not legitimate, this doesn't solve anything. If Person A and Person B trust one another personally, then _idealistically_ you're vulnerable to collusion (intentional) or abuse (unintentional). If Person B trusts Person A because of some policy or technical attestation, that means the policy or technical criteria needs to be robust against abuse. If you're in-person at, say, a T-Mobile store, then it's not likely that Person A and Person B don't work together, but even if they don't, the first issue still applies. I've watched T-Mobile store employees just pass an iPad to a manager and say "can you type in your code?" Depending on the employee or what process was requiring approval, the manager might or might not have asked "what are you doing?" "Can you justify this?" etc.
- tekknik 3y agoYou can make the higher level person liable for their passcode usage. It’ll only take a few examples to be made for them to change their approach. This whole two person security thing being untrusted seems silly however, as that’s what nuclear missile silos typically use to avoid rogue actors. Why it won’t work here seems odd, if you put the right punishments in place.
- TheNewsIsHere 3y agoNuclear missile launches are a very, very far cry from phone company customer support operations. To engage the comparison nevertheless, at least regarding silos, the two person rule is physically enforced using space itself. You could collude, but the likelihood of two people getting to that point and then going through with it is so infinitesimally small as to be, essentially, purely academic. The risks to one or two actors fraudulently SIM swapping someone’s line are much, much different. Proportionality matters as much here as anywhere. What would a sufficient deterring punishment look like in this case that would make others think twice? People have already lost their jobs and been tried under existing law for this and it continues to happen.
- andix 3y agoEasy solution: Don't use SMS for password recovery. SMS might even be okay for 2FA, but it must always be the second factor. "Forgot my password" -> SMS code -> new password is just 1FA. Using SMS as the only factor is really, really bad.
- amagine 3y agoThe choice of 2fa options isn't under user control. And various non carrier options (Google voice) are rejected.
- andix 3y agoThen don't use insecure services. I think in the EU sms only password reset indirectly violates data privacy laws (not securing private data with industry standards).
- tekknik 3y agoYou should stop using passwords altogether then and move to passkeys. Passwords are on a hot deprecation path. Hell soon with biometrics and public key crypto you’ll be able to attest that your physically sitting in front of a computer and have an ID issued by a state that matches.
- speedylight 3y agoThere should be a security code that’s only known to the owner, can’t swap it if you don’t have the code. Seems like a pretty simple and effective solution imo.
- WillPostForFood 3y agoThis already is in place at T-Mobile, but it seems the it can be overridden.
- throw10920 3y ago> I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID You're speaking out of a position of extreme ignorance. There are ID cards - drivers' licenses and passports - that are near-universally available, and are regularly used as identification.