I know there's still no patch for human stupidity, but I really am concerned that T-Mobile still apparently seems to be the carrier of choice for easy SIM-swap attacks.
For example, I have a foolproof way of preventing sim swap attacks: require 256bits of entropy and never allow a password reset, like in crypto. Lose your password? Account is gone forever.
This is more secure but less user friendly. Except for large accounts, I don’t know that anyone even particularly cares if their Twitter gets hacked. You could pretty easily make the argument that preventing sim swap attacks is an optimization for high profile users at the expense of everyone else.
They've cracked down so hard that the only way to do SIM swaps is to talk to a human who can be (and still routinely is) socially engineered. Self-service changes have been blocked for over a year "to enhance security".
This type of stuff is why I canceled my account with them. It just keeps happening.
Oh, yes. 100%. I remember about 10 or so years ago about people selling guides on how to get access to WATSON (one of the dealer systems that let you provision accounts etc) by basically abusing a common username/password convention and making guesses based on the Store Lookup tool. IIRC it only let you set up new accounts (eg, take a stack of blank SIMs and just make infinite lines) but was still just an absolute WTF that it was... somehow a thing.