Hacker News Reader

Comment by anaphor | Hacker News Reader

> And lastly, if someone steals your phone, with your a mail client on it, it is way easier for identity theft to occur, not harder.

How exactly is this true? I encrypt my phone's hard disk and I encrypt all of my SMS communications (locally) with https://play.google.com/store/apps/details?id=org.thoughtcri...

It's no harder than if someone steals your laptop. The same measures you would use on a laptop (FDE, TLS) are available on phones. The argument can certainly be made that SMS is an insecure form of 2-factor auth, since they can be easily intercepted in transport (though if you use TextSecure someone who steals your phone can't get them!), but that's why we have the google authenticator app.

View on HN

Because a common tactic kids are using ATM is a simple snatch and grab, right out of peoples hands. Heaps easier than taking a laptop as you might be standing in a crowd, they can approach you with speed, shunt you off balance and are gone.

Phone doesn't lock while they run with it as they are touching the screen, they get away from the user and disable the security features. You are compromised, phone is compromised, thief's win.

Or so the papers say, and several female friends who have had this happen to them at evening events (not identity theft, but the snatch and grab).

I try to minimize how much I hold my phone in my hands in public for this reason sure (It also makes you a more viable target for muggers if you look distracted by your phone). You can also set TextSecure to automatically wipe your passphrase from memory when you're done reading/writing texts. I should probably also be using APG ( https://f-droid.org/repository/browse/?fdfilter=APG&fdid=org... ) to encrypt other stuff for the same reason.

I don't doubt that this is a real threat for sure, but there are measures you can take to prevent it from happening.

If your phone gets stolen, then you block your phone number with the carrier, and the thief can't get your SMS - so 2-factor security still works and protects you.

True, I think most snatch and grabs are sold quick for cash and not identity theft anyway.

But in a worst case scenario how quick could someone determined actually compromise you? minutes? less time than you'd wait on hold during work hours, let alone waiting till the next day?

Reply on news.ycombinator.com