Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why did smartphones become a single point of failure?

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 289 posts

Re: Ask HN: Why did smartphones become a single point of failure?

#271

Post by Spooky23 »

BLKNSLVR wrote: post #129
Spooky23 wrote: post #63

Earlier quoted context omitted.

Phone isn’t a secure factor in 2022.

If this is due to the vulnerabilities in the SS7 protocol, then it hasn't been secure since 1975. Or at least 2008 when a set of vulnerabilities were published. https://en.m.wikipedia.org/wiki/Signalling_System_No._7

MFA is supposed to be something you have in most cases, the phone is a weak proof of a line of phone service that has decreasingly diminished meaning over time.

NIST describes a framework for required authenticators for different levels of trust. It’s a good starting place for understanding what represents secure practices vs theater.

Re: Ask HN: Why did smartphones become a single point of failure?

#272

Post by Gazoche »

dsr_ wrote: post #23

Go through the whole list and figure out which of these services really requires your phone, and which you have set up on your phone because that seemed the easiest path. Tell your workplace you're about to switch from carrying a phone to a landline: what is their fallback option? (It's about 50/50 whether they have one, but they definitely should.)

Tell that to the Australian government. You literally need to install an app to use some of their services.

https://www.mygovid.gov.au/

Re: Ask HN: Why did smartphones become a single point of failure?

#273

Post by simonblack »

i can't log in to any of my banks without my phone.

Check with your bank. Most banks have another capability of verifying who you are on login. That usually consists of a random-number generator that is in lockstep with a similar one within the bank's system. The random-number supplied by your 'token' should be the same as the one generated by the bank that is associated with your account or login.

We have three of these. One for each of the banks we deal with.

https://pic.pimg.tw/abcwithyou/1348639177-1831387207.jpg

We don't use any of the bank smartphone apps. I dislike intensely trying to do broadsheet work on tiny phone screens. It's akin to trying to do 'keyhole surgery'. I much prefer my 3840x2160 view and at a non-microscopic scale on my computer screen.

Re: Ask HN: Why did smartphones become a single point of failure?

#274

Post by simonblack »

nicbou wrote: post #18

This is a big problem for me as a traveller. If I travel long distance and I lose my phone, I lose access to both my personal and business bank. I once dropped my phone in a lake (I'm clumsy) and was locked out of most things for a few weeks. I prefer TOTP for most things. Keepass supports them across platforms, but Aegis has a better experience on mobiles.

See my comment elsewhere on this page.

Most banks can supply 'tokens' that generate a random-number that acts as a one-time verification.

https://pic.pimg.tw/abcwithyou/1348639177-1831387207.jpg

They are invaluable if you travel internationally as sometimes verification codes sent by text will be hopelessly out of date by the time you receive them. (If you receive them at all, that is.)

Re: Ask HN: Why did smartphones become a single point of failure?

#275

Post by nicbou »

2-718-281-828 wrote: post #230
nicbou wrote: post #202

Earlier quoted context omitted.

I travel by bicycle or motorcycle, so space and weight come at a huge premium. And of course my bank only lets me pair one phone per account.

> I travel by bicycle or motorcycle, so space and weight come at a huge premium. sure, but being protected from losing your digital prowess comes at a high utility per weight ratio. > And of course my bank only lets me pair one phone per account. that's a bummer. I can pair several. just need to scan some qr code.

Replacing the smartphone isn’t the problem. It’s regaining access to things for which the smartphone is the key. If I lose the sim card I’m back to square one.

This is a big part of my threat model.

Re: Ask HN: Why did smartphones become a single point of failure?

#276

Post by southerntofu »

guywithahat wrote: post #153
Dr_ReD wrote: post #148

Earlier quoted context omitted.

> There's also something to be said for how modern financial capitalism has > squeezed redundancy out of everything. Supply chains are just-in-time, Hence the automotive/chips and other recent shortages...

Are you implying we should have wasted billions manufacturing extra chips just in case there was a shortage and consumers didn't want to wait a year before buying a new car/truck?

I'm personally ashamed that auto manufacturers are destroying the environment and making life difficult for all electronics manufacturers because they want to embed literally hundreds of micro-controllers into cars, just so that they can make it break when one single component fails.

This MCH speaker suggests 3 micro-controllers is all it takes to build a fully functional and road-safe electric car, and explains the current situation about auto manufacturing:

https://media.ccc.de/v/mch2022-77-electric-vehicles-are-goin...

Re: Ask HN: Why did smartphones become a single point of failure?

#277

Post by childintime »

By chance I saw this:

    https://support.google.com/fi/answer/6330195?hl=en
It allows the data to be used on a second device, on the same SIM/number. Not SMS though, so this is going to be a limited solution. I also don't know how this works across the globe.

Re: Ask HN: Why did smartphones become a single point of failure?

#278

Post by wizofaus »

winternett wrote: post #267
wizofaus wrote: post #248

Earlier quoted context omitted.

That your IP address is used as part of delivery customization isn't surprising (though why it would make sense for platforms you need to log into I'm not sure). As far as YouTube/TikTok/Twitter sharing tracking info - unlikely, I'd say just the fact that you are the same person using all 3 services which all picked up on your personal preferences from your initial usage of each site would be enough to explain being…

I've frequently noticed that when I watch a youtube video, it suddenly shows up somehow on my twitter feed, or a connection thereto... Often I'm recommended to follow the artist from the song I discovered. It happens so much for me that it can't be coincidence, Perhaps my browser is the connection, but I've worked in tech for a while now, and could def could believe that artists meet with big tech regularly to run in…

Often I watch a youtube video, then the song suddenly starts showing up on the radio, at shopping malls, the latest Netflix series, you name it. It happens so much for me it can't be coincidence...

Re: Ask HN: Why did smartphones become a single point of failure?

#279

Post by drstewart »

nicbou wrote: post #203
bzxcvbn wrote: post #160

Earlier quoted context omitted.

I have traveled a lot over the past few years, including several times through hostile customs (eg USA). I have never had any of them go through my phone or even ask to see it. And to be quite frank, I don't see what use a border agent or the government would use from my phone that they couldn't get in a different, simpler, less blatant way. I'm not sure what threat model you're fighting against, but it may exist onl…

Same. 50+ countries and I only had to turn my laptop on for the TSA.

The TSA only cares that the laptop is operable (e.g. not masquerading as something else), not the contents

Re: Ask HN: Why did smartphones become a single point of failure?

#280

Post by pif »

falcolas wrote: post #183
pif wrote: post #135

Earlier quoted context omitted.

Exactly, and the incentive is that customers do not care. Build quality, keep redundancy, and in the next pandemic your business will flourish... unless you'll have had to close it before 'cause of people buying cheap and not good!

I assert that customers do care. Customers were quite annoyed that they couldn't buy vehicles, regardless of the price. Or do you just not remember the complaints? On the business side, Toyota - the progenator of JIT manufacturing who still warehoused chips to deal with a shortage exactly like what happened - flourished at a time where others floundered. As an added bonus, they were still able to remain profitable pr…

> I assert that customers do care. Customers were quite annoyed that they couldn't buy vehicles

This is not what I meant. Customers did not care, before the pandemic.

Post reply on HN