Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

131–140 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#131

Post by DCKing »

mmaunder wrote: post #113
DCKing wrote: post #100

Earlier quoted context omitted.

The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better th…

Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is. A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key. SMS does not verify this and the factor is not something…

Although I agree that in some cases SMS 2FA provides a false sense of security, this argument misses the economy of the attacks here. It's not that black and white.

Any attacks on phone numbers are spearphishing, almost my definition. Some form of identity fraud - no matter how easy it is for an attacker - must be performed in phone number stealing. Even if it's very easy, that's a significant cost for an attacker and not an easily scalable attack. I agree that SMS 2FA must never be presented as an effective means to thwart spearphishing, where attackers are willing to put in this effort.

Now in the real world, password reuse attacks are far more common, and an commonly bigger concern for a random online accounts system. SMS 2FA can be of really big help there.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#132

Post by elliekelly »

tialaramex wrote: post #89
distances wrote: post #65

Earlier quoted context omitted.

2FA has always been a requirement in my country, as far as I remember all the way from the start. The new EU legislation made things worse : one-time pad paper key list isn't accepted any more. My second factor now needs to be my phone (app or SMS).

The written list of one-time passwords (not a "pad" the One Time Pad is a specific crypto design that largely exists to compare things to rather than as a practical gizmo) fails the requirement in 2018/389 because it doesn't end up verifying the specific transaction. Suppose you have password '47BF-38AP-3M99' on the list. You get a plausible email from your friend Barry saying he needs €40 urgently. You send €40 usin…

Any idea what the keypad device is called? Are you expected to carry it with you at all times? Is that feasible? Is there some sort of threshold for its use? For example, transactions under $X, even if fraudulent, might not be worth the inconvenience to the customer of having to go through the extra steps.

If you don’t mind my asking, is your banking institution geared towards HNW clients? The amount verification sounds very similar to what most banks in the US do for inter-bank transactions but I’ve never heard of something like that implemented on a bank account from the consumer’s side.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#133

Post by JoeAltmaier »

theandrewbailey wrote: post #127
cdumler wrote: post #119

Please do not allow people to call SMS 2FA. For it to be 2FA, it must be: something I know alone, something I possess alone, something I am alone. Otherwise, it's just another account identifier (and likely spoof-able). SMS and phone numbers are none of these. In same vein, I wish security questions would die in a fire. Always treat them like additional passwords: use nonsensical words and store them in your password…

Don't forget to change your birthday, mother's maiden name, fingerprint, and face regularly.

Exactly. "Things I own alone" are no good as passwords, if they cannot be changed. They are account identifiers only.

And if a password has sufficient entropy (not likely to ever be duplicated) then the account identifier is pointless. Just use the password as sufficient authentication.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#134

Post by c22 »

mmaunder wrote: post #113
DCKing wrote: post #100

Earlier quoted context omitted.

The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better th…

Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is. A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key. SMS does not verify this and the factor is not something…

Demonstrating that passwords are also a poor factor doesn't make using SMS as an additional factor a "bad idea". A physical cell phone is also something that is loosely associated with you, transferable and vulnerable to social engineering attacks.

It turns out there are no really good ways to authenticate individuals at scale. The answer is not to deride and blacklist arbitrary bad options from the pool, but to add even more factors so that their differing contexts present a more formidable holistic challenge.

Obviously, as GP points out, supporting multiple factors but allowing any one of them to be used in isolation is just building a chain with a weakest link. Better to build a chain-link fence.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#136

Post by jschwartzi »

stirlo wrote: post #7

While companies definitely need to move away from SMS two factor it’s so entrenched (and simple) that more is needed. The government agencies that setup the mobile number portability system need to realise the seriousness of this flaw and allow a “Never transfer my Number” flag to be set in their databases. Until then even the lowest rung service desk agent at any telco has the ability to transfer numbers. A system l…

T-Mobile lets you set a PIN that you have to present if you want to port your number or get a new SIM. They sent out mass texts about it a couple of years ago.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#137

Post by scarface74 »

c22 wrote: post #134
mmaunder wrote: post #113

Earlier quoted context omitted.

Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is. A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key. SMS does not verify this and the factor is not something…

Demonstrating that passwords are also a poor factor doesn't make using SMS as an additional factor a "bad idea". A physical cell phone is also something that is loosely associated with you, transferable and vulnerable to social engineering attacks . It turns out there are no really good ways to authenticate individuals at scale. The answer is not to deride and blacklist arbitrary bad options from the pool, but to add…

A physical cell phone is also something that is loosely associated with you, transferable and vulnerable to social engineering attacks.

SIM swapping is not always the result of social engineering attacks. There are bad actors that work for carriers who will knowingly fraudulently swap sims.

At least with something like Google Authenticator that can be done at scale, someone has to have your physical device and has to get past your hopefully secure pin code/finger print sensor/face id or use rubber hose decryption.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#138

Post by rmtech »

georgeam wrote: post #110
tialaramex wrote: post #72

Earlier quoted context omitted.

Sure, you could have a national "reality" TV show, everybody who lost their SIM has to go on the TV show for six months with it showing on screen which number they claim is theirs - so this way there's no chance they're a crook. Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on. But, I put it to you that this all seems very disproporti…

I'm a strong believer in solving problems at the single point of failure. If you solve it at the Twitter level, what about any other internet/cloud based service that is designed just like Twitter? It would still be a problem. If you solve it at the phone company level, all the companies that operate like Twitter are protected. Even better still, solve it at both levels, but definitely don't let phone companies off t…

Yeah, I think it should be solved in both places TBH. Defense in depth.

But it won't happen because people are dumb and don't care about the issue until the exact moment it bites. This basically applies to every security problem: everything is perpetually broken and therefore nefarious actors can always find a way to achieve their goals. Most people's best defence is to not have any enemies.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#139

Post by scarface74 »

TeMPOraL wrote: post #62
Cthulhu_ wrote: post #55

Earlier quoted context omitted.

> What if you lose your old sim? I'd say it's pretty simple then: you can't transfer your number and just need to get a new one. I mean at some point you have to draw a line; losing your password and resetting it via email is already a pretty gracious thing, and most support desks will help you beyond the default password reset as well if necessary. But at some point you have to draw a line - key's lost? Access is lo…

I think this is going too far. It's easy to lose your SIM - in particular, whenever you lose your phone (you left it somewhere, it fell into a river, etc.). Why not just require that if you don't have your old SIM on you, you have to jump through extra hoops involving physically showing government-issued documents and otherwise leaving enough paper trail for the police to find and jail you if it turns out you were a…

That still doesn’t help. Who are you showing your physical ID to? The store clerk at the carrier store? There have been cases where the clerk was in on the fraud.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#140

Post by jschwartzi »

tialaramex wrote: post #45
Svip wrote: post #9

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading an article years ago, about banks combating SIM swapping in Africa, where a lot of transfers are done by SMS, by forcing a cooldown. But I wonder, besides the US and Africa, where is SIM swapping prevalent? NYT says I'm at risk too. I'm in Europe -- am I?

Yes. Of course it works, if it was not possible for you to move your phone number to a different device then you'd be trapped and of course the mobile phone companies would take advantage of that to gouge you. The problem is your cell provider doesn't have a very good way to be sure it's Svip asking them to do this transfer. They are mostly going to rely on low paid call center or shop floor staff to decide. Fortunat…

> They are mostly going to rely on low paid call center or shop floor staff to decide.

Actually retail sales at AT&T and T-mobile stores(not third-party retailers) can make mid to high five figures if they're competent salespeople. Maybe low six figures at a high-volume store. Most of the money is in commission but it's there.

Post reply on HN