Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#1

Post by blackbear742 » Wed, Sep 11, 2019, 9:34 AM UTC

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’
nytimes.com

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#2

Post by ecmascript » Wed, Sep 11, 2019, 9:59 AM UTC

Well, MAYBE, just maybe Twitter should stop require new users to enter their phone number in order to validate their account.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#3

Post by mrtksn » Wed, Sep 11, 2019, 10:00 AM UTC

If we want to authenticate a user, what is the best way to do it?

best: a great balance between convenience, security and cost.

Lately, it bothers that we cannot be sure that we are interacting with real people or the people that we are interacting with are not the same people with different accounts.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#4

Post by bengale » Wed, Sep 11, 2019, 10:01 AM UTC

These places need to stop using SMS for 2FA.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#5

Post by aikah » Wed, Sep 11, 2019, 10:03 AM UTC

bengale wrote: post #4

These places need to stop using SMS for 2FA.

You didn't provide a secure and practical alternative, please enlighten people unaware of them.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#6

Post by flixic » Wed, Sep 11, 2019, 10:04 AM UTC

aikah wrote: post #5

bengale wrote: post #4

These places need to stop using SMS for 2FA.

You didn't provide a secure and practical alternative, please enlighten people unaware of them.

Authy / Google Authenticator / 1Password have built-in TOTP generators. They have great UX and are much more secure.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#7

Post by stirlo » Wed, Sep 11, 2019, 10:06 AM UTC

While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed.

The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system like that can never be secure.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#8

Post by tiku » Wed, Sep 11, 2019, 10:07 AM UTC

How does this work? The sim-card is sent to your own address, in a plain white envelope.They have to steal that envelope to gain physical access to the sim.

Why is it so hard to stop sending sim-cards to different addresses than the main address where it was registered?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#9

Post by Svip » Wed, Sep 11, 2019, 10:07 AM UTC

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading an article years ago, about banks combating SIM swapping in Africa, where a lot of transfers are done by SMS, by forcing a cooldown.

But I wonder, besides the US and Africa, where is SIM swapping prevalent? NYT says I'm at risk too. I'm in Europe -- am I?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#10

Post by darkhorn » Wed, Sep 11, 2019, 10:08 AM UTC

This is mobile operator problem, not Twitter. How on earth the mobile operator can hand a SIM card to someone else?!