3 ms·
And still, the entire bank account is still vulnerable to a $15 silent borrowing of your phone number for a day, bypassing all normal protections. The system is
by hansvm 1y ago
And still, the entire bank account is still vulnerable to a $15 silent borrowing of your phone number for a day, bypassing all normal protections. The system is only harder to access for the rightful owner.
- krior 1y agoHow would that attack work?
- VoidWhisperer 1y agoSIM Swap attacks are what they are referring to, I think.
- m3galinux 1y agoOr SS7 attack to intercept SMS messages, no SIM swap required.
- xyst 1y agoDoesn’t this require physical access to a compromised mobile network?
- chainingsolid 1y agoRequires that someone has physical access, that they can then sell digital access to.
- krior 1y agoDo banks really use SMS as an auth method these days?
- einarfd 1y agoThis is only true in some countries, and tbh. having this as the state of the art, sounds a bit dystopian. I've been using my BankID, which is a Norwegian electronic identity solution, to log into banks and such, for decades now. With these type of solutions, there is no way that taking control over phone numbers make any difference when trying to get access to a bank account. Btw. this type of electronic identity solution are not Norway specific, I know all the other Nordic countries have them, and they are, as far as I know fairly popular in the rest of Europe as well.
- ozgrakkurt 1y agoOr if you get your line cancelled for some reason and have no access to your phone number and you are abroad. You’ll have trouble with banks and many other things that use phone number for verification. Really wish they worked on removing phone number verification before doing any other security/password thing.