Hacker News Reader

I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number.

They said the best they could do was to add a note to my file to check id in store before transferring.

This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it.

And more importantly, it does noting to stop someone asking another provider to port my number to them. Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it.

Running it through google voice will make it subject to your google 2fa.

Could you please elaborate about google thing you mentioned? I am interested in making my ATT sim morr secure..

It replaces the SMS 2FA with a Google prompt app on the phone for Gmail verification.

So it doesn't make the SIM more secure but the SIM get hacked it doesn't allow the attacker to gain access to Gmail.

Also if your public SMS reset number is in google voice, a hacker can't port it off of Google easily because you need to log into your google account to port it, which requires 2fa. They have to figure out your real number, but you never give that out to anyone or you just use google hangouts SMS instead of forwarding text messages to your insecure phone.

> Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it.

"Phone number" is truly the most dysfunctional social network.

T-Mobile has put in place some protections to prevent unauthorized transfers of your account to new SIM cards, I just had to deal with them last night - actually. Swapping SIM cards for a line must either be done in-store where your photo ID can be verified, or over the phone but only after confirmation of a OTP sent to account managers via SMS.

I know T-Mobile actually had some issues with this in the past, so even though I miss the convenience of going to t-mobile.com/sim to swap a card out I feel it's a much better solution security-wise.

The lack of security of cell phone providers is absolutely infuriating considering the sheer number of people who are paid $20/h that have ability to see and manipulate records at the likes of AT&T, Sprint, TMO and VZ not to mention those who work for resellers like BestBuy that are authorized to make activation and porting related changes.

It reminds me of MJR confidently stating that the maximum cost of gaining access to any secure network is min:

1) A yearly salary of the lowest paid employee who has access (i.e. someone's secretary)

2) A price of a Desert Eagle

Ah just FYI the pay is around $10-$11 an hour.

In my country you can’t transfer your sim or number without signing the transaction with our national two-factor digital identity that is provided by the government.

You also need to supply your secret social security number in a safe validation form.

So to me it’s much safer than a token auth that I’ll accidentally wipe whenever I buy a new phone. At least Authy allows SMS restore.

There definitely needs to be more stringent protocols in place for transferring numbers, but I have to disagree with the 72-hour delay idea - it may hamstring those who are porting numbers for legitimate reasons.

For example, I lost my phone on a Thursday a couple months ago and desperately needed it for work the following week. Ordered a replacement phone as well as SIM with express shipping. Received both over the weekend, called the provider to port from the lost SIM to the new one, and was able to work on Monday.

Having an unavoidable X-hour long delay before the port went through would've been awful. I'm sure there's another way to accomplish the same goal - perhaps requiring more info than just account number / PIN / password, implementing physical ID verification, etc.

> Having an unavoidable X-hour long delay before the port went through would've been awful

What if that "unavoidable X-hour long delay" prevented your 2-FA codes from being compromised during a targeted attack?

To be fair, very few people are individually targeted in these types of attacks (statistically).

It would be great to have a 72-hour delay on transfer if it were on an opt-in basis.

(Side note: has anyone tried to disable web access to text messages on a Verizon line?)

That's why I said it should be optional. A lot of people wouldn't want this. Some would. I definitely would.

For me the potential delay in the event of a lost/stolen/upgraded device is well worth it when the flip side is the potential nightmare resulting from the damage done if the person gets into an important account.

It seems to me like requiring some secondary form of authentication can always be bypassed at the discretion of the agent helping you because there will always be a possibility that the customer lost/can't remember the secondary key or ID.

Although, now that I think about it… UPS does something interesting to verify your account. They ask you to input a unique set of numbers that appear on your last invoice to link your account and verify your ID. Not foolproof by any means, but it's enforced for every authentication by design. Definitely more secure than the current PIN.