T-Mobile employees across the country receive cash offers to illegally swap SIMs
tmo.report
tmo.report
Or maybe change the terms of use for the employee line discount to allow monitoring SMS content or metadata for security threats to the companies users?
“And give them a home / a little place of their own…”
And Matt Levine every now and then talks about a guy making a few million a year insider insider trading a few thousand and settling.
Honestly what the OP suggested is simply a sting operation.
Your reaction to it is ... more scary.
Until it is.
> It’s no better than selling a gun to a person you know intends to use it to commit a crime.
Though I guess you could be making the case that crime is a legitimate use of guns?
To be clear, my original post only pointed out that what you said is a non sequitur:
> It’s no better than selling a gun to a person you know intends to use it to commit a crime.
> > Just so we’re clear: getting shot is quite a bit worse than having your phone number stolen.
If your phone number being stolen causes your savings to get drained for long enough that you run into problems making important payments like rent, taxes, car payments; That can pretty quickly spiral into even worse situations. In a world/country where many people have too few savings to go even a month without being paid, losing even that can get extremely dangerous. Not to mention the stress of such a situation alone will probably take quite a bit of your life expectancy off.
At least in the United States, we also live in a society where the financial ramifications of getting shot could lead to equally bad financial outcomes (whether directly or indirectly).
I don't think I have much sympathy if you lose your job for doing something this damaging and probably illegal.
SIM swapping? No comment. Trying to catch SIM swappers? Suddenly you have feelings about it!
You can make $15/hr as an entry-level cashier - your first job, zero job history - at CVS and Walgreens, with tolerable health/dental/eye insurance.
And if you're not entirely braindead you can trivially become a pharmacy intern (then tech) and start at $18-$20, with benefits. They'll pay for your licensing. You can make $18-$22 to start as a telemetry or video tech, with zero experience. Hospitals are filled with people sitting in rooms watching video monitors making sure patients don't fall over or hurt themselves, it pays 3x the minimum wage and requires zero experience.
If you're making $7.50 /hr at this point, you're either living somewhere very barren (almost zero economic opportunities), or it's your own fault.
Even so, retail sales jobs are often heavily commission adjusted which makes this not so cut and dry.
Sell sell sell, or you are well below the poverty line and quickly replaced by someone more willing to cut corners on the activities that are not profitable like carefully checking ID.
Almost nobody makes federal minimum wage.
It's gotta be at 2%+ making state minimum wage though.
CA for example has a minimum wage somewhere north of $15, and like 10% of the population makes minimum wage or less. That right there pulls the number for the whole country up to at least 1% making minimum wage, because CA is >10% of the population. (Extreme example, since CA also has the highest real poverty rate in the US (SPM, not the hilariously undercounting OPM)).
I haven’t seen much evidence in the past they would.
T-Mobile blocks my Google Voice calls. They have to run inside a VPN.
Their website says it's $99/month. That seems a bit steep to me considering all they're providing over a regular provider that charges $29/month is that they do a bit more verification when you claim that you lost your sim. It's not even clear whether they protect against a port-out attack, which is probably worth worrying about as well.
That, plus the fact that it's a premium service that is mostly only useful to higher net worth / higher income people, makes it seem reasonable that it would be quite expensive relative to a regular provider.
According to the BLS "Computer User Support Specialists" get paid $30 on average[1]. Whatever training they give to staff to resist sim-swap attacks, I can't imagine they can't be more complicated than the certifications that "Computer User Support Specialists" have to get through, so I think it's reasonable to model their support costs at $30/hr per person. With the premium they're charging over a budget MVNO they can afford two support people per customer. How many fraudulent sim swap attacks could the worst client possibly attract? Is it really that hard to train someone to deny sim swaps until they go through 11 steps of verification like their website says?
[1] https://www.bls.gov/oes/current/oes_nat.htm
>That, plus the fact that it's a premium service that is mostly only useful to higher net worth / higher income people, makes it seem reasonable that it would be quite expensive relative to a regular provider.
I mean yeah that's the more reasonable answer. It's a luxury product and priced accordingly.
It seems like a well-oiled machine.
0: Well, some places don't like using GV for 2FA (and demand a "real" cell phone number), and some other places don't think it can do short-code messages at all, but those aren't issues that anyone at GV could ever solve even if those people did exist.
1: Yeah, sure. I'm the product. Blah blah.
I've still got my .10 Grand Central introductory credit.
Because you can port a landline to Google Voice for $20, and, in my experience, random Internet "phone number lookup" sites still show it as a landline years later.
Is it the most convenient thing ever? No. I have an older iPhone because I'm a cheap bastard so I turn off the other line when I'm not using it, otherwise it will constantly look for a compatible roaming signal which it will never find because I have not authorized any international charges on that account (battery drain).
Some may call, most not even that.
My bank accounts at banks I like have never complained about my Google Voice number and still don't. My bank account at Bank of America had some security check I needed to complete at some point and my Google Voice number that had been in their system for a decade I was told was not eligible anymore and I needed to actually use my real phone number.
I could almost put up with it if it was for things that need to be secure, but my 7-11 rewards account rejected my phone number at the gas pump a few years ago and Target rewards also started blocking my GV number.
"I have cheerfully been using your service in this exact same way for seventeen years."
"FUCK YOU! GET OUT!"
There was a time many years ago when Google Voice would intermittently fail to ring or even forward calls to another number when I tried that, and then give no indication that a call was ever made to your number that you missed (I verified it by asking when people I knew called me and said I never got back to them), which is pretty bad when you're expecting to receive important calls sometimes. This went on for months. I received bare minimum support which didn't even come close to helping the issue even though my issue was voted to the top of the support boards because many other people were having the same issue at the time. I'm glad you personally haven't had an issue but you should be prepared to have one at some point and get essentially no help.
No human to talk to, no appeals process. Don't trust Google, they are indifferent.
I feel like it should be required reading to protect against "automate all the things" hubris.
Google Plus failed for many reasons but I doubt that one was a big factor.
God forbid I chargeback a purchase on Google Pay (or whatever their PayPal is this year) and trip some anti-fraud system that locks me out of my 20 year old email account. We all know their support is either automated or nonexistent, so it’s not worth the risk.
And you effectively can't even run your own system, as has been discussed here many times.
Pretty much just an apple thing as far as I can see.
It's probably a tiny chance it happens to many people but it's something to consider. I had nobody to talk to. No store to go to. I lost cell service for a week until I migrated everything off of google.
Just something to be wary of.
edit: I tried to dig it up it's about a year old and .. oof yeah i'm not going through pages and pages of paginated yn comments. Moral of the story is what I said above
This one seems to fit. Happy I've never had reason to write one like it.
https://hn.algolia.com/?dateEnd=1700092800&dateRange=custom&...
This is less traumatizing than when I found irclogs of me from 10-14 thankfully.
A well paid attorney worth their salt will likely tell you that you don't want to test that theory with a court and the various employment watchdogs.
Engaging in such a plan and through happenstance and human fallibility ending up actually creating harm to an actual customer could potentially expose you to a tort claim.
We call it concentration camp here. Because of all the thinking.
I don't see a big difference between this, and sending fake phishing emails to employees to see if they bite, which is a fairly common practice.
In this case though, it doesn't necessarily have to be T-mobile that does it. It could be local law enforcement, and they could potentially trade immunity for information on real bribers.
Likewise, CEO can not instruct the accountant to steal money from company account as a test.
1. require two employees PLUS an agent on the phone to do it.
2. call the desired number and speak to whoever answers and ask if they're aware the number will be ported
3. have a 24-hour period to try to reach someone at that number before the swap occurs.
4. Offer a very large bounty ($10,000 or more) for providing evidence that a co-worker is taking bribes
I'll have to google a bit and see if they are restricted.
T-Mobile’s New SIM Protection https://tmo.report/2022/12/t-mobiles-new-sim-protection-is-n...
The news here is the intersection of a data breach with SIM swapping: criminals are using the employee phone numbers from a recent T-Mobile breach data dump to text tons of employees at once, offering $300 per swap.
Previously, criminals would develop the inside agent either through personal connections or by applying and getting hired themselves. With the breached data, they can automate and scale.
In other words, the "old way" isn't just about cultivating an insider agent, but also about establishing that the insider can trust the requestor.
2. They don’t think they’ll be caught so it’s more like free money. Getting caught doesn’t factor in to the decision.
I was hit back in the late 2000’s, maybe 2008 iirc.
I think ideally there would be some kind of verification that the customer was indeed present and that their ID had been verified, but I don't see how you can do that in the US as there aren't ID cards or similar forms of universally available ID. I also think you should be able to get a phone number without ID at all, which would preclude verification in those cases.
The issue is that people's phones are essentially the roots of trust for our digital lives. Passkeys being built into the OS are good because they push that problem away from carriers, but the fundamental issue still remains. Bootstrapping trust is hard.
webauthn
I use it myself, but I do also understand companies and people that don't want to make it their only way back into their account as it is.
Except for that one giant issue, passkeys are gonna be great.
They should still have proper SPF/DKIM/DMARC so you can verify the sender even if it was relayed
Unlike passwords, you can have multiple passkeys associated with an account. Accessing from an iPhone? Use your Apple passkey. From Android? Use your Google passkey. Want cross-platform? Use your 1Password passkey. Etc.
I wonder if hassle means there will be more use of OAuth but that means trust.
There needs to be a way to e.g. share the secret seed in one passkey securely with another and put that in a safe deposit box, with a friend etc. without needing access to both keys whenever a new account is added.
It's a real shame that most stakeholders in FIDO/WebAuthN have moved on to passkeys as the canonical path forward over hardware-based solutions like this. Passkeys are definitely better than passwords, but they shouldn't be the only option out there as-is.
In terms of user experience, they could sell pre-linked "Yubikey pairs" or offer a user experience of e.g. plugging both into the same computer and resetting them via a long press to "entangle" the pair cryptographically.
The overhead and time I expend to do audits throughout the year and track what account/services are protected by which keys is in equal measure worth it and maddening. If I could just have a few new keys and "cross entangle" all of them, I would sleep as well as the Yubico promise, well, promises.
I am not sure that passkeys are any more secure than random password stored in password manager. I'm suspicious about password managers used to store passkeys. I guess they are better since have to unlock the password manager.
I have had idea for place that can verify identity. Walk into store, they take biometrics to verify identity, and then give you card. That can be used to unlock accounts if locked out. It does have risk of employees being bribed. But banks don't seem to have that problem. Making sure it is done in person should help.
I don't want a Google or Apple backed phone to be the only hardware token secure enough to protect my key.
I want these devices to, RIGHT NOW support copying their keys to another device that neither party can control. I want an open standard that people can implement in a less-than $50 secure hardware device that I can duplicate these keys into. I think the UX of a "Key Safe" that is offline, physically securely stored, and can manually + securely have keys copied into, or copied off without Apple or Google's intervention would solve a lot of concern about the very real lock-in that's in play right now.
1Password is dead to me the second I can use a passkey everywhere. I’m already removing them from my life.
At any rate it’s not needed. If I have an apple passkey and am on PC (or a work mac) I can just scan with my iphone or ipad.
Are you really unaware if the password vault highjacking 1Password is and has been trying to do for 5+ years now?
Fair enough! I'm also subscription-avoidant generally, but 1Password's yearly $60 family plan works for me. Thanks!
Sharing passwords between families is definitely a problem for me still, like sharing 401k accounts with my wife. Hopefully passkeys and the respective family accounts with the majors can solve this eventually.
It also kinda sucks having google as your email and your phone when they want to use email to verify your account settings and you can't get into your account. This happened to my wife, and they essentially have no support on the fi side and the gmail side support isn't super helpful. She was eventually able to recover her gmail account and fix her fi activation but it a huge pain and took a couple of days.
How so? Aren’t there multiple options available?
(1) buying alcohol / entering bars
(2) flying
(3) voting (in certain states)
(4) a doctor's appointment
(5) picking up a prescription
(6) withdrawing cash at a bank
(7) touring an apartment you might lease (for the leasing agents' safety)
(8) returning items at a store if you don't have a receipt (as an anti-fraud measure)
Requiring government issued photo ID for identity verification is not at all an uncommon policy for various purposes in the US, and AFAIK all states have universally available ID cards (they are generally not free of charge, but they are universally available.)
Maybe the free IDs could be issued by police departments? Either way this is a good time for someone to register as a voter too, WA state has a simple checkbox for that and other states can too.
When you get your phone they should hand you a pamphlet saying that when you lose your phone this is the process, these are the risks, and offer you the option to upgrade the security to require, say, a passport to restore your account.
There exist services for ID verification, usually by video call. They exhibit the same limitations though.
I'm not sure this is the right comparison, in general, although I agree with your point (below). I suspect that one benefit of accepting domestic driving licences as ID, but not most foreign non-passport documents, is due to familiarity. That's probably as important a factor in spotting forgeries as the security features embedded in the document, which aren't very useful if the person checking isn't familiar with an authentic version of the document.
In practice, I tend to agree that someone is likely to not be familiar with many driving licences, such as (in the US/Canada) those from distant or low-population US/Canadian states, provinces, or territories, or (in much of Europe) a smaller European country's driving licence or national ID card, so a foreign passport is far from the main concern.
I have a US Passport Card that I present as my photo ID when asked, because I don't want my address presented to just anyone who might have a valid need to ask for ID. Federal employees look at it and waive me on, but outside that I get a mix of "I've never seen this" (and every time it's still been accepted) and a lot of careful scanning of the card.
Then a corrupt employee needs something they won’t have to execute the swap.
While I agree with you, this is already not the case in much of Europe where an ID is required to obtain a sim card.
I just hope SMS authentication won't go away completely for other parts of world where risk balance is different than in USA. Until things change, I trust more my local birocracy to work their birocratic ways and always check ID where needed then I would trust myself not to lose some auth device.
Bank transfers are often, but not always, reversible, and sometimes finality is a feature desired by all participants and explicitly designed into systems, e.g. RTGSes. CEO fraud is on the rise and wouldn't be possible without these systems.
That's one reason why these are often not directly available to private consumers without a banker and some level of ceremony in between.
Simply require that a SIM can only be swapped if it is disconnected from the mobile network for 48 hours. And if it isn't disconnected, the original SIM will be called/texted to ask if they really want the SIM swap to happen.
If someone has both devices in hand, there isn't even need for a delay. The only time you need a delay is when the original device is missing. In that case, sending a message to that SIM and having a mandatory delay (ideally, customisable by the customer) seems reasonable.
> You have requested a replacement sim card. To proceed with the replacement now, reply "Yes". To keep this sim card, reply "No". If you do not reply, a replacement will be mailed to your billing address: 54 Wolverton Gardens in 7 days, and this sim will be deactivated.
An attacker now has to overcome the time delay, and the fact that the replacement sim card must be mailed to the billing address. For those people who have an outdated billing address and lose the sim card, require the sim to be offline for 7 days, or demonstrate access to an email address or credit card on the account.
Not putting phone providers in charge of access to our digital lives.
> that the customer was indeed present and that their ID had been verified
Present where? My MVNO does not have any branches. And even if they did, why should I ever have to go there? I don't go to bank branches either if I can at all help it.
Sometimes you can't help it, you need a phone today, and need to go into a store for your phone company. No, buying a phone from Walmart or Best buy and waiting for a sim or doing some eSim thing won't work, you just need to get into a branch today. If an MVNO with no branches works for you, great, but some people need to be able to go into a branch of their cell phone provider/bank/utility.
If someone convinces both Person A and Person B of their legitimacy, even if they're not legitimate, this doesn't solve anything.
If Person A and Person B trust one another personally, then _idealistically_ you're vulnerable to collusion (intentional) or abuse (unintentional).
If Person B trusts Person A because of some policy or technical attestation, that means the policy or technical criteria needs to be robust against abuse.
If you're in-person at, say, a T-Mobile store, then it's not likely that Person A and Person B don't work together, but even if they don't, the first issue still applies.
I've watched T-Mobile store employees just pass an iPad to a manager and say "can you type in your code?" Depending on the employee or what process was requiring approval, the manager might or might not have asked "what are you doing?" "Can you justify this?" etc.
This whole two person security thing being untrusted seems silly however, as that’s what nuclear missile silos typically use to avoid rogue actors. Why it won’t work here seems odd, if you put the right punishments in place.
To engage the comparison nevertheless, at least regarding silos, the two person rule is physically enforced using space itself. You could collude, but the likelihood of two people getting to that point and then going through with it is so infinitesimally small as to be, essentially, purely academic.
The risks to one or two actors fraudulently SIM swapping someone’s line are much, much different.
Proportionality matters as much here as anywhere. What would a sufficient deterring punishment look like in this case that would make others think twice? People have already lost their jobs and been tried under existing law for this and it continues to happen.
SMS might even be okay for 2FA, but it must always be the second factor. "Forgot my password" -> SMS code -> new password is just 1FA. Using SMS as the only factor is really, really bad.
Hell soon with biometrics and public key crypto you’ll be able to attest that your physically sitting in front of a computer and have an ID issued by a state that matches.
You're speaking out of a position of extreme ignorance. There are ID cards - drivers' licenses and passports - that are near-universally available, and are regularly used as identification.
The other big problem with Twitter security is you can have your account taken over even if you use non-sms 2FA! If you have your phone number on your account it can be used for recovery completely bypassing 2FA. They've had this security flaw for years and still haven't fixed it.
The number of sites that actually let me never provide a phone number, or at least not have it be a recovery method, is tiny.
Even things like a simple time lock (e.g. SMS-OTP "2"FA recovery only being possible after 24 hours, combined with sending a blast of "careful, your account is about to be recovered by somebody that might not be you" and a way to stop that for the legitimate accountholder, would go a long way.
Time-constrained 2FA codes can be broken with sim swaps or targeted phishing which are less widespread than a wide-net spam-based phishing campaign.
Now don’t get me wrong I hate SMS 2FA with a passion but still :)
It's literally a worse version of regular TOTP. And they're in the minority even having 2FA!
You best audit the shit out of that code if you actually use it. Every. time. they. update.
Unfortunately one can claim to "forgot my password" and use SMS OTP to reset it. Now it becomes a single factor authentication with a compromised phone.
Password + SMS OTP is strictly worse than a password. At least you cannot SIM swap your password.
Everything based on username + password alone today should be replaced by passkeys. The problems they don't solve are 2FA and account recovery.
https://www.fcc.gov/consumer-governmental-affairs/fcc-announ...
Edit to add: there was an episode of "Forensic Files" where a suspect injected someone else's blood sample (at great personal risk) to evade a DNA test for a sexual assault charge. So just acknowledging that DNA methods can be attacked too. Hence the necessity of multiple random samples.
I'd also say people shouldn't be able to advertise MFA if they only support a single token per method.
I am trying to escape that awful ecosystem, not dig myself further in.
Not to mention your 3.5” floppy drive!
Do you understand the advantages that headphone jacks have? If not, you could start there.
Otherwise I'd call that lock-in as well.
Last time I did, I only got passwords out, not passkeys (not that there is an interoperable standard for them anyway).
This seems bogus. I'd rather simply use a random per-site password; looks like passkeys are the same except non-interoperable.
There's some movement in that area in the related FIDO working groups, but I think we'll (by design) never see something like CSV export, and it'll be more like a standardized account migration.
> I'd rather simply use a random per-site password; looks like passkeys are the same except non-interoperable.
They're significantly better than a random per-site password since they can't be compromised on the server side (due to being based on public key cryptography), unlike regular passwords and TOTPs.
You're asking for Apple to introduce a vulnerability for your convenience.
Which is a thing I regularly do, e.g. every time I switch computers...?
And also I think this is why the passkey standard is bad, it sets rigid hardware requirements and the manufacturers will use this to drive planned obsolescence. If Apple and Microsoft have their way we will throw away $1000+ phones and laptops because someone found an exploit in the TPM that requires physical access.
Most customer service representatives are on very low incomes (especially in other countries) and it’s not hard to find one who will take actions for a (western) small amount of money. CSRs often have powerful capabilities and access to sensitive information. With poor access controls.
Solve the SMS/MFA issue and they’ll attack the next thing in line
Afaik SMS 2FA is the easiest to compromise of all the methods. At least with, say, email, you need a password and potentially a different 2FA first.
Another reason to implement my proposal of a law requiring all customer service serving US customers to be located in the US, UK, Ireland, Canada, Australia, or New Zealand.
An *opt-in* option to require that lines on your account can not be moved to a new SIM unless the current SIM is offline as far as the cell grid is concerned.
This could even be made into something that customer service could be blocked from overriding.
If someone steals your phone, they try to get it into airplane mode as fast as possible to avoid activation locks. If you drop your phone in the ocean or off the side of a cliff, it's probably not going to remain working for long. If you're concerned about losing it somewhere where it'd remain active but you'd never find it, then don't opt in to this.
If you don’t respond then it takes 48 hours to move.
If you say “yes” then it moves
If you say “no” then whoever asked for the move has some questions to answer
So, I lose my phone (maybe it's sitting on the side of the road somewhere) and need a new line. Since I can't reply to it my line will transfer after 8 (?) hours of no response to the challenge.
Typically, teenagers ranging from 14 - 19 will select targets, or “targs” to conduct a “Sim Swap” on.
Desired targets are often individuals with “rare” or “OG” handles on social media platforms, as they’re worth a lot of money. Or, individuals with large crypto wallets (Think: Coinbase, Binance, Etc)
* The Pizza Problem
* Tennessee
Carriers should have procedures in place to ensure that the identity of someone who presents themselves with this situation is verified, but it can often be bypassed.
In the case of the article, corrupt employees of the carrier are being bribed to bypass the ID and security checks that should take place in the above situation.
In other attacks, there are social engineering ways of bypassing the ID checks - such as claiming to be the victim of a robbery where both the phone and wallet were taken - so they don't have any ID, credit cards, or phone to prove who they are and that getting a new SIM would really help them out.
I was able to verify that it worked because an employee in a store literally could not transfer my SIM with it enabled. Their iPad app just gave an error of "customer has SIM lock enabled".
Interestingly the T-Mobile employee had never even heard of this feature, which suggests that basically no one uses it.
> Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers. We’re not sure yet which employees are impacted, but based on comments online it seems at least a few third-party employees are affected, and we’ve independently confirmed current corporate employees have also received the message.
Sadly, the idea that phone numbers of people are private should be considered laughable at this point. There is LinkedIn, and even if you're not directly connected to someone it would be easy to correlate publicly available LinkedIn data to phone number data.
Also, note that TMobile explicitly provides a "SIM Protection" feature, https://www.t-mobile.com/support/plans-features/sim-protecti.... Why this isn't enabled for everyone by default I don't know.
What happens if I legitimately need a new SIM?
SMS and calling was blocked during that entire time (~24-36 hrs) since the backend teams are likely operating in offshore timezones.
I guess what I'm asking for is a cellphone plan with no human customer service, similar to how there is basically no one I can call if I have a problem with a gmail account. Remove the source and the temptation of this attack in one go.
I appreciate not every customer would like or want this, but could be offered to more security conscious users as an option. It's not unheard of to get a discount for pre-paying or enabling auto-payments on cell plans around the world, perhaps you could even get a few bucks off a month for choosing to not have option to call a contact center too.
If I want to get a new cell phone number, I am absolutely fucked on everything. This isn't sustainable.
Am I missing something?
Probably hundreds, if not thousands, of low level employees that work for carriers in retail positions.
If employees can be bribed, that's the problem.. there must be a human element somewhere, otherwise we'd have to be permanently locked out if we lose all 2FA devices
If they do, you'd just use that.
If your bank can be "talked out of" requiring the second factor, then what good is 2FA? Hopefully they would at least require actual identification.
Most banks I've interacted with fit in this category, except for online only banks. If you need a bank with a local presence, switching might not be an option.
The only services that I use with SMS 2FA are honeypot accounts.
Pay peanuts and everyone and their dog will apply, pay appropriately and you'll get higher quality applications that you can afford to actually vet.
Minimum wage, as demonstrated by the pandemic, is nowhere the level of pay.
Of course everyone can be corrupted, but the probability diminishs greatly with just basic care.
https://old.reddit.com/r/verizon/comments/1bnnsbc/kick_out_t...
Common to see people get approached on communities like carrier subreddits if they post that they work at a store and be dangled offers like that.
SMS is actually a perfectly good channel for 2FA for most customers in most cases. Because most customers, most of the time, are not under a targeted or even semi-targeted attack. SMS 2FA protects quite well against large-scale brute force or credential stuffing attacks. If someone is checking 10k accounts against the 3 top passwords (yes, this is a very common attack type), those customers will be very well served by having SMS 2FA.
SMS is a terrible channel if anyone is trying to target you directly though, that's absolutely true.
edit: also, in case this wasn't clear - I'm not talking about any services that allow password reset through SMS alone - that's beyond idiotic, obviously.
In that case I could see someone attempting a sim swap attack for accounts where they pass a password check for higher value stuff like primary email or anything that is probably linked to a spending account
SMS is bad at protecting one account, it's good at protecting 10000.
What would you say is an advantage unique to SMS that would be lost if text messages were switched to another model? I'm asking sincerely. There aren't many people arguing in favor of SMS here, so you seem like the right person to ask.
(In reality, some users don't even have SMS (no cell phone) - so automated voice calls can be offered too. Those without any phone at all...will not be considered as valid customers, in most cases.)
Given the funnel there, it might well be worth it for me to put some energy into figuring out who the person at the other end of that account is. Phone numbers aren't secrets.
Generally, I think services should offer TOTP, email, and SMS, and strongly encourage TOTP. But not offering SMS just means some segment of customers won't have a second factor at all.
If someone wants to rubber hose me, they have to physically come to my area and that doesn't scale except for high value targets. Tolerating SMS as 2FA is absurd with built in passkey capabilities backed biometrics/code built into a device you can buy for $100 and already carry with you 24/7.
Real-world activities (kidnapping, rubber hose, fingerprint stealing, whatever) aren't worth it for medium-value targets, true - but my point is that SIM swaps aren't either - for low-value targets.
From the article, they're offering $300 per - so the expected value from these specific compromised accounts must be more than that (I'd guess $1k min). This makes it pretty clear that if you're protecting accounts worth ~$50, SMS is probably "good enough". And for some users that's the right trade off.
You might have different definitions of both "perfectly" and "good" than the researchers who found in every case with every major phone provider, the SIM could be stolen.
See: https://www.issms2fasecure.com/ ...
- We examined the authentication procedures used by five prepaid wireless carriers when a customer attempts to change their SIM card, or SIM swap.
- We found that all five carriers use insecure authentication challenges that can easily be subverted by attackers.
- We reverse-engineered the authentication policies of over 140 websites that offer SMS-based authentication, and rated the vulnerability level of users of each website to a SIM swap attack.
- We found 17 websites on which user accounts can be compromised based on a SIM swap alone. After over 60 days since our disclosure, nine of these websites remain vulnerable in their default configuration.
Yes, SMS 2FA will fail against a sophisticated and targeted attack. It is still drastically better than NO second factor, which is the actual comparison in the real world. There are people without smartphones. There are people without the ability to install/use a TOTP app. My aunt can either use SMS 2FA or nothing. 2MS protects her pretty well against 95% of the types of attacks she's likely to face.
Frankly, a secure password alone, with no second factor, is "drastically" better than a secure password with ability to change that password by SMS, as is frequently the case (a quarter of the time, per that research). So set up LastPass or 1Password for your aunt.
As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world.
Your claim is "Because most customers, most of the time, are not under a targeted or even semi-targeted attack."
On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated.
Obviously password resets shouldn't be possible by SMS alone, I never claimed otherwise. I'm talking about using SMS as a second factor - in addition to having the valid password.
>>As for "protects her from 95% of the attacks she is likely to face", that's a number that doesn't jive with my experiences as CTO of the second largest bank in the world.
In my experience, low-net-worth + technically unsophisticated users are mostly at risk from brute force attacks and/or credential stuffing, and SMS (as an actual second factor, not a "reset the password for free" button) is very effective at stopping that.
>>On the contrary, most customers are under automated attacks, and SMS plus password leaks lets that takeover be fully automated.
If your customers have phone number/username/password all leaked together...sure, I can believe that. Probably you should focus on preventing leaks of that size.
A substantial proportion of your customers' email + password pairs have been leaked before they sign up with you. Email and phone are already paired from data brokers, you don't need the dump.
A majority of SaaS providers and banks fail to check for previously leaked creds. Many of the same ones that think SMS is "perfectly good".
Are you implying there's automated SIM swap attacks in the wild ? Or, maybe you are saying SMS can be phished ? I do agree SMS 2nd factor can be phished, but if phishing is the attack, password leaks is irrelevant since, you usually phish both passwords and SMS 2nd factor together, so password leaks don't make any difference.
Twitter allows this, it's been a security flaw for years they've never fixed, and it's possible even if you have non-sms 2FA enabled! If you have a phone number on your Twitter account you should definitely remove it.
Quite a few high profile very security conscious people (e.g. Vitalik Buterin) have had their accounts hacked because of this.
Actually, I don't. Even completely trivial things like coffee chain apps require SMS-based logins these days, and I hate it. One particularly idiotic one initially accepted my Google Vocie number, only to lock it out for a subsequent login on a new device.
Phone numbers are a horrible user identifier. SMS is a horrible authentication mechanism. The entire industry has regressed from the bad combo of email + password to something almost universally worse in a matter of years, and it's incredibly frustrating.
The only saving grace is that SMS are quite expensive in some countries, so companies there have an incentive to not actually send them out if they can at all avoid it. Unfortunately they're effectively free in the US.
It really disappointing that in 2024, this is the "right" guidance to give, but we still know there's a whole lot of really important stuff that still uses SMS for 2-factor authentication.
I agree with your points, it just feels insanely rate to see a service utilizing phone number requirement for registration the proper way (i.e., the way you describe).
I am completely opposed to services having any PII (Personal Identifiable Information) beyond an email address because the dumbass services keep my PII and then lose it when they get hacked.
If I can go collect a million dollars from a company that loses my PII, I'd let them collect it. SInce I can't, my best option is to refuse.
If you want to verify, take a credit card number. At least I can cancel and change that when some dumbass get hacked and loses it.
Are you relatively confident that these sites actually delete removed phone numbers?
Google Auth is just one of the earlier popular apps, so it's a common example. It kinda sucks though, cuz if you lose your phone you have to reset all your 2FAs.
It's not the best 2FA app though; it makes it unreasonably hard to transfer codes.
If anything hopes to replace SMS, it needs to be as user-friendly as SMS.
I'm flabbergasted every time I switch jobs and some jamook in IT or Security says we have to sue google authenticator and that other authenticators aren't allowed. Then there are constant lockout events generating tickets for those teams when people delete the app or get new phones.
s/garbage/[stronger words]/g
I mean, it's not quite as cheap, but even now I can provision fungible, resellable eSIMs, non-wholesale, for less than $5. Throw a little HS + acceptxmr, sit in front of Airalo/holaSIM/etc, or just figure out who their upstreams are. It's all a complete and utter farce.
Similarly, some 2FA implementations allow human support agents to manually reset the 2FA, sometimes making that the weakest link.
The ruthless alternative is "If you lose your 2FA, you lose your entire account and there's nothing we can do about it". I've rarely seen that implemented in normal apps.
Stop doing this.
First, and a no brainer: offer "continue with ____" sign ins (OpenID Connect / OIDC) for users of Google, O365, Apple, to get out of the account creds business for most users.* (See also: passkeys.)
Second, prefer TOTP as the MFA, not SMS.
Third, if you absolutely have to do SMS for some dark pattern "harvest my customers' phones" reason, use it exclusively as a second step, never as an only factor.
* For most customer firms using M365 or Google accounts, if you couple accepting OIDC with a domain validation to the customer's email address, you don't have to do SSO/SAML, since OpenID connect + domain accomplishes roughly similar goals on both sides without the per client company configuration overhead or "SSO tax": https://sso.tax/
I use it for ~50 sites. It's such a pleasure to use.
KeePassXC Passkeys Without Big Tech! https://www.youtube.com/watch?v=L7uXFJfxf80
I'm tired of it. SMS as "authentication" needs to be outlawed at this point. I'd vote for whatever candidate wants to sponsor this bill.
https://id.atlassian.com/login
Or this:
https://www.xsplit.com/user/auth
These both offer a "your own email" sign in path. That's why I said "out of the business for most users", I didn't say "for all users".
Plus, I'm speaking to SaaS providers here.
Fully 85% of businesses in the USA use M365, meaning for all but 15% of your b2b users, you do not have to host company-user credentials!
TOTP is phishable, and the root secrets are stored in most TOTP apps (including Google Authenticator) in plan text, usually in SQLite, because almost no enclaves support the TOTP algorithm.
The only hardware devices that -do- support TOTP like Yubikeys or Nitrokeys also support WebAuthn in which case just use that.
A hard requirement of Virtual Passkeys and hardware WebAuthn devices should be a bare minimum for auth security in 2024.
Passwords and one time codes are phishable 90s solutions to the problem and it is nuts they still are so dominant.
The truth is that, while it offers superior security, hardware tokens and virtual passkeys are not accessible to the masses one way or other. This is a problem that should eventually be solved but nearly all prior attempts cannot supplant the ubiquity of passwords.
You do not often get a win that clear in security. It is a no brainer to mandate for users today, and stop wasting customer support hours on dealing with accounts compromised by phishing.
Sometimes the customer is not educated on safety and you have to hold a line to protect them and yourself.
Invest in good onboarding UX.
Basic security and safety should not be optional.
OIDC means your digital life is destroyed if Google ever decides to ban you. And they are well known to do so, and there is normally no recourse once you are banned. You have to be either brave or stupid to trust your security to tech giants.
Passkeys, TOTP are vulnerable to your device getting lost or broken, something that can also happen a lot.
Sadly, if you want things to work no matter what, SMS are your best bet.
Thanks but no thanks, the last thing I want is for Google to be in the chain for something as vital as banking. One false signal in Google's AI model and you're permanently fucked. Or someone compromising the email account (not just credential stuffing but e.g. cookie theft).
> Second, prefer TOTP as the MFA, not SMS.
People loathe app-based (or, even worse, RSA token-style) OTP, especially if they lose their phone or it becomes permanently damaged you're fucked unless you made a backup.
SMS in contrast? Even your 80 years old grandma can use that, and most common failure modes (i.e. stuff requiring support from you) are handled by the telco.
I still like it for corp SSO though; you can force corp accounts to SSO only with no recovery, and you can force the corp account recovery to be difficult.
I had a bank that asked for my phone number when I sign up, and I gave them a landline number that is not capable of receiving SMS. Some years later, without any input or authorization from me, they decided to enable 2-factor using this landline number. It was super annoying.
My other bank accepts Yubikey. I wish more banks would do this.
1. Password + SMS one-time-password
2. 4-digit pin + 6-digit TOTP
3. No MFA
They do, at least, offer the option of disabling automatic password-resets via SMS code, but I know from experience that you can authenticate yourself to a CS rep with just name, SSN, and a SMS code, and presumably a CS rep can reset your password.
The Defense Dept already does this: CAC/common access cards [1]. Create a civilian root and do it already. A PIV/CAC can also be used as an auth factor with Login.gov [2].
[1] https://www.cac.mil/common-access-card/
[2] https://www.login.gov/help/get-started/authentication-method... (Physical PIV (personal identity verification) cards or CACs (common access cards) are secure options for federal government employees and military personnel. These cards, with encrypted chip technology, are resistant to phishing and difficult to hack if stolen.)
The databases already exist [2] [3] [4] [5]; because you do not have the physical card does not mean you don't live this reality today. On the contrary, you already don't have the privacy you think you have, without any of the quality of life improvements a national ID card would provide.
> CBP has successfully implemented facial biometrics into the entry processes at all international airports, known as Simplified Arrival, and into the exit processes at 49 airport locations. CBP also expanded facial biometrics at 39 seaports and all pedestrian lanes at both Southwest Border and the Northern Border ports of entry.
> To date, CBP has processed more than 490 million travelers using biometric facial comparison technology and prevented more than 1,900 impostors from entry to the U.S.
[1] https://en.wikipedia.org/wiki/Stop_and_identify_statutes
[2] https://www.dhs.gov/biometrics
[3] https://www.tsa.gov/biometrics-technology/evaluating-facial-...
The government persists because the executive branch takes a lot on itself. The Supreme Court is currently deciding that this may be too much overreach, and the government will grind completely to a halt.
- Social Security
- Passports
- NAPHSIS
- Most states' ID systems using Real ID w/ SPEXS
- The DoD's ID card system
Edit: TIL login.gov is the new hotness
https://news.ycombinator.com/item?id=30430851 ("HN: IRS to adopt Login.gov as user authentication tool (Feb 2022)")
https://news.ycombinator.com/item?id=39691325 (a previous comment I wrote on the topic)
https://cyberscoop.com/idme-irs-identity-verification-congre... ("ID.me misled IRS on processing times for identity verification, congressional investigators found")
https://cyberscoop.com/id-me-ceo-backtracks-on-claims-compan... ("ID.me CEO backtracks on claims company doesn’t use powerful facial recognition tech")
https://cyberscoop.com/id-me-aclu-oregon-states-messaging-fa... ("Documents shed light on ID.me’s messaging to states about powerful facial recognition tech")
https://arstechnica.com/tech-policy/2022/11/id-me-made-basel... ("ID.me lied to IRS about unemployment fraud, average wait times, House Dems say")
"Scan the front and back of your Driver's License."
[upload scan of front of DL @ 200DPI]
"Unable to find a face in the image you uploaded."
[upload scan of front of DL @ 300DPI]
"Unable to find a face in the image you uploaded."
[upload scan of front of DL @ 72DPI]
"Thank you, now please upload the back of your Driver's License."
Hmm, 72DPI worked for the front, so...
[upload scan of back of DL @ 72DPI]
"Unable to read a barcode in the image you uploaded."
[upload scan of back of DL @ 200DPI]
"Unable to read a barcode in the image you uploaded."
[upload scan of back of DL @ 300DPI]
"Thank you for verifying your Driver's License".
An unmitigated turd.
what bothers me the most about unfalsifiable predictions is that their predictive quality can only be retroactively applied, undermining its ability to be predictive at all
it relies on total ignorance of everything prior that fit, and other catastrophes that also looked like the “end times”
how was world war I not? everyone dying of mustard gas followed by famine, plague.
world war II?
the year 536?
other maladies in other countries? for many people it was the end time because their entire family and culture were killed and wiped out
I wonder if America will shake its Evangelical death cult. People are becoming unaffiliated with religion here but I feel like the mysticism is ingrained into the culture either way for another generation or two
But semantics aside, I agree that addressing their actual concerns is more productive. And there is no way to guarantee that.
As someone on the outside, I'm curious if that's true. I've never applied for clearance but I was always under the impression that it was more about how many people could vouch for you. Is it true that it actually just comes down to your bank account?
These all come up during the screening interviews of your peers, family, and coworkers. I have done about a half dozen or so of these for former peers, friends, and colleagues who have moved on to do public sector or join private military companies that needed clearance.
On a topical note, a not-uncommon issue is failing to pay income tax or file a tax return :p the result of those appeals depended on if and how the appellant tried to resolve that.
[1] https://doha.ogc.osd.mil/Industrial-Security-Program/Industr...
It was just a web form with a few boxes to fill out based on customer provided info followed by enter.
Even when ID is checked, a decent fake ID is like $50 these days, and grants access to wealthy bank accounts.
At the time we were heavily incentivized to speed run anything that did not generate a commission so checking ID carefully if at all was not high on our list of priorities.
One would hope it’s not possible to swap unless that is entered, no matter how corrupt the employee.
The former is as bad as SMS.
Which in turn annoys me to no end given that phone numbers are regional. Having no access to banks when moving, let alone traveling, to an area with no cell service or a different country, is infuriating. It’s like “what’s your mother’s maiden name” all over again.
But SMS account recovery is definitely opening the door to attack.
All software providers and the industry should ban SMS based OTPs as a standard practice. Either leapfrogging to a Passkey implementation or just time based OTPs.
I don't think we need a complete sweeping ban to get it to largely fall out of use, just a critical mass to drop it so it's no longer defensible as an industry standard
This is the same reason you want well paid politicians and FBI staff.
The intrinsic overlap of incentives and strengths between utility providers and identity verification organizations (whether private or public) is minimal, and I suspect extrinsically forcing them into that role can't end well either.
Also as others have commented, even well paid people do shady things. TFA isn't an endorsement of higher wages, it's a denouncement of our terrible collective security and authentication protocols.
Yes. Parent comment is literally completely backwards - we've seen from Wall Street that paying people extremely well leads to corruption.
High pay has the opposite effect. Things that work include oversight, transparency, audit logs, removal of human processes, active anti-corruption investigation, and the like.
Slap some actual consequences and you'll see better results.
But couldn't we pressure the telecoms to improve it?
I have an idea that would make SIM swaps way harder to execute. Namely a website that wants to authenticate you should be able query the telecom for some kind of SIM card ID. This would happen before sending a 2FA code.
With such a feature it would be easy to store the SIM card ID in a database when enrolling the phone number. Later when the user tries to authenticate and the ID does not match what saved before, the account is locked out. For enterprise accounts you would need to explain yourself to IT and for personal accounts a fallback 2FA would have to be used. Alternatively the authentication would be delayed for a few days to give the legitimate owner of the SIM card time to react.
Another thing that could be added on top of this is to send a SMS to the old "inactive" SIM, alerting the original owner of the attack.
EDIT: To add to this, here are some advantages of SMS 2FA over time based OTP or passkeys:
1. My grandma can use it with her dumb phone and poor digital skills. 2. Your SIM card will most likely survive if your phone is destroyed due to water or physical damage. (Sadly not true for eSIM) 3. You can dictate an SMS/OTP code over the phone, or forward it to somebody you trust. 4. Banks can append a short description of what you are currently authorizing. It can tip you off in case your computer is infected with malware, or you are victim to one of those TeamViewer scams.
If that’s just impossible, how do I fix the issue? A “fallback 2FA” what is that exactly?
The same issue you mentioned applies to other 2FA methods. Your TOTP codes and passkeys also live on your phone, Yubikeys can be stolen too.
A perfect analogy would be trying to implement security with mac addresses but applied to internet. It just makes a mess of an abstraction layer and then you have to rebuild it because those abstractions were useful (mac address spoofing has legitimate uses because mac addresses were used for security and then people realized they needed to be able to transparently swap things out)