Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NY Man Pleads Guilty in $20M SIM Swap Theft

krebsonsecurity.com

Post reply on HN
Print view View original

101–110 of 176 posts

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#101

Post by totetsu »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

I was going to say that this was done in New Zealand, but either the post office stopped doing it or I miss remembered. https://www.realme.govt.nz/how-apply/ now it seems that the Drivers license centers are the only place to get photo verified.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#102

Post by mbesto »

paulpauper wrote: post #56

I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only t…

> 2/3 the market cap of Ethereum alone

The idea of equating to crypto market cap needs to stop. $265B in actual real dollars is exchanged between two parties every year for gambling. That means a business pays a salary to someone and then that someone gives that money to someone else.

Crypto market caps doesn't necessarily mean that someones earned currency is transferred to another one and it doesn't representing an annual value. In other words `income != net worth` or `revenue != asset value`

Example of how this works: https://news.ycombinator.com/item?id=29471847

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#103

Post by OrsonSmelles »

ghaff wrote: post #53
jjcm wrote: post #50

Earlier quoted context omitted.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0]. The obvious reality here is that in the wa…

>social security numbers have been used instead Historically that was sort of the case. I'd argue today that we mostly rely on state-issued IDs (especially but not necessarily driver's licenses) which are now overlaid with RealID requirements. As a practical matter it's probably indistinguishable from what a federally-issued ID would be and I'm mostly content with not adding any more layers of identity verification t…

>RealID requirements

This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#104

Post by bootwoot »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

Aren't you describing a notary public? A person registered with the government who asserts with their stamp that documentation and IDs are verifiable in person?

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#105

Post by psychlops »

fnord77 wrote: post #29
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

the USPS could be doing this and so much more for citizens. But lawmakers in this country are allergic to having the government manage anything

Remind me why we need a post office again.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#107

Post by lawtalkinghuman »

lph wrote: post #96
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

It's a good idea. The flaw is in thinking USPS is even slightly interested in innovating. They're not. But then we also have a notary public system, which is already in the business of verifying identification for official purposes. That could do it too.

> The flaw is in thinking USPS is even slightly interested in innovating. They're not.

If the political system stops public sector organisations innovating, they won't innovate. See, for example, BT in the UK, who were looking into investing in fibre optic rollout in the 80s and 90s until Thatcher snuffed that idea out and we're only now starting to get fibre to the premises rolled out in significant numbers.

https://www.techradar.com/uk/news/world-of-tech/how-the-uk-l...

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#108

Post by hellbannedguy »

supernova87a wrote: post #49
mindslight wrote: post #17

Earlier quoted context omitted.

There are already standard ways of doing brick and mortar identity verification, and in somewhat surveillance-resisting ways even! The most common is "notarization" - a state-deputized "notary" verifies that you are who you say you are, and then endorses your signed document with a special stamp and a signature. Another common one used for financial transactions is a "medallion stamp", wherein not only do they verify…

Yes, but notarization feels like a much more cumbersome process, designed for more like "once in a lifetime" transactions (house purchase, will, etc). It also feels more like a proof, only needed if a transaction is disputed in court etc, it can be investigated back to the source. I mean the every day kind of verification that fuels our daily transactions and benefits from instantaneous info being transmitted back an…

In the USA, you don't need a will motorized, but you need two witnesses.

A trust, you need notarized.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#109

Post by gnopgnip »

kube-system wrote: post #19
chinathrow wrote: post #12

Earlier quoted context omitted.

> but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do? Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. If you really need to keep that account for reason X, move out all your assets to another bank and keep enough funds to fund X there.

> Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. Have any suggestions for a bank that supports TOTP? I have yet to find a decent bank in the US that supports this.

https://web.archive.org/web/20200202222301/https://twofactor... has a list of large banks and 2fa methods.

Charles Schwab and USAA use TOTP but aren't exactly main stream banks. Both use a Symantec client and don't officially support third party authenticator apps.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#110

Post by SavantIdiot »

lph wrote: post #96
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

It's a good idea. The flaw is in thinking USPS is even slightly interested in innovating. They're not. But then we also have a notary public system, which is already in the business of verifying identification for official purposes. That could do it too.

> It's a good idea. The flaw is in thinking USPS is even slightly interested in innovating. They're not.

That's because it has been a target of right-wing attack for decades starting with the republican-led 2006 bill that effectively bankrupted it overnight by requiring a massive 50 years of health benefits to be funded.[1]

So when you have a service (not a business) that is constantly being picked apart and hamstrung from completing its most basic functions, you can't possibly blame them for not innovating. Well you can, but it is not in good faith.

https://www.politifact.com/factchecks/2020/apr/15/afl-cio/wi...

Post reply on HN