Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

11–20 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#11

Post by lode »

aikah wrote: post #5
bengale wrote: post #4

These places need to stop using SMS for 2FA.

You didn't provide a secure and practical alternative, please enlighten people unaware of them.

WebAuthn/U2F security keys. No MITM, phishing or duplication possible. Register more than one per account in case the physical key breaks, keep one in a secure place.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#12

Post by jstanley »

mrtksn wrote: post #3

If we want to authenticate a user, what is the best way to do it? best: a great balance between convenience, security and cost. Lately, it bothers that we cannot be sure that we are interacting with real people or the people that we are interacting with are not the same people with different accounts.

You should certainly be able to tell that the person controlling an account is its rightful owner, but it's not obvious to me that you should be able to tell that 2 accounts are controlled by the same owner.

If I have 2 accounts, and you can tell that they're both me, doesn't that compromise my privacy?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#13

Post by StreamBright »

>> "Criminals have learned how to persuade mobile phone providers like T-Mobile and AT&T to switch a phone number to a new device that is under their control."

This is why SMS should be never an option for MFA. You simply cannot rely on a telco employee for the security of your organization or online presence.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#14

Post by tialaramex »

aikah wrote: post #5
bengale wrote: post #4

These places need to stop using SMS for 2FA.

You didn't provide a secure and practical alternative, please enlighten people unaware of them.

The most secure alternative, which should be the choice for anyone who actually cares, and an option anywhere that thinks _any_ of their users might care is WebAuthn (U2F is roughly the same thing but obsolete, no reason to deploy more of it)

WebAuthn uses FIDO Security keys, relatively cheap USB or Bluetooth devices or sometimes just a built-in feature of a smartphone, to authenticate. They are Something-You-Have, but the WebAuthn protocol also offers:

* Optionally a mode where you give the FIDO key a PIN (Something-You-Know) or biometric input (Something-You-Are) to do all the authentication locally

* Phishing proof - there's no decision about whether this is really your bank. WebAuthn is completely happy to log you into https://fake.bank.phishingsite.example/ but the credentials are useless to the crooks who own that site because they won't work on https://your.actual.bank.example/ even if the crooks got the logo just exactly right and wrote a very convincing pleading email from your bank saying they definitely need you to go to the fake bank site.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#16

Post by Svip »

tiku wrote: post #8

How does this work? The sim-card is sent to your own address, in a plain white envelope.They have to steal that envelope to gain physical access to the sim. Why is it so hard to stop sending sim-cards to different addresses than the main address where it was registered?

I think it works like this; people buy a SIM card from the same carrier, and call that carrier and ask them to move the victim's phone number to that SIM card. I know T-Mobile in the US allows you to buy a SIM card in any of their stores. I am sure other US carriers have the same offer.
Post reply on HN