41–50 of 71 posts
I read these things and realize that statistically there must be 'non idiot' criminals out there. And I am guessing that they just profit day in and day out.
Earlier quoted context omitted.
> What really needs to die is giving privileged access to underpaid monkeys. This in uncalled for.
You might reconsider this opinion once you or someone you know loses money and/or time because of some CS idiot. I’ve had my fair share of such incidents (so much that I’m paying 10x more for an enterprise-grade leased line just to not have to talk to them ever) and I no longer have any sympathy for those people.
(Nobody at big tech companies ever bothered to even phone screen me for SWE roles)
Also your enterprise account managers often are clueless and just ask the support team - certainly what happened in my experience.
Earlier quoted context omitted.
(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.
Unfortunately Google Fi has its own set of issues that make it unpalatable as a primary mobile phone service: https://onemileatatime.com/google-fi-review/
It’s crazy that critical infrastructure providers (cell carriers) aren’t even using U2F internally, where they can mandate the rollout. Public utilities in the US need an overhaul.
Using phone numbers for verification is just stupid. I've switched phones a few times over the years and just got a new number rather than keeping my old one and i got locked out of my accounts because i didn't have access to the old number anymore. Stuff like Authy and Google Authenticator exist, I think it's time companies started using them.
Earlier quoted context omitted.
Why are the phone companies not responsible for swapping the number over? In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?
The phone company is giving you a phone number, it doesn't want to be responsible for providing security for your financial and private life.
Earlier quoted context omitted.
> What really needs to die is giving privileged access to underpaid monkeys. This in uncalled for.
You might reconsider this opinion once you or someone you know loses money and/or time because of some CS idiot. I’ve had my fair share of such incidents (so much that I’m paying 10x more for an enterprise-grade leased line just to not have to talk to them ever) and I no longer have any sympathy for those people.
It's insane to me that the only thing standing between me and having my life ruined is some minimum wage cell phone store employee. Text message based 2FA needs to die.
Using phone numbers for verification is just stupid. I've switched phones a few times over the years and just got a new number rather than keeping my old one and i got locked out of my accounts because i didn't have access to the old number anymore. Stuff like Authy and Google Authenticator exist, I think it's time companies started using them.
Even the US government uses it, such as for logging into your Social Security account.