Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NY Man Pleads Guilty in $20M SIM Swap Theft

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 176 posts

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#111

Post by SavantIdiot »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

That's part of the reason why I like having my money with an RIA that I have a relationship with: I can't make big withdrawals on the account without verifying with several people. That's a sigh of relief.

I think there is a need for authentication, especially among people that are in and out of poverty.

The catch-22 is that you can't get a job without an address, and you can't get an address without a job, so you cannot be authenticated by means available to most people! Hard to bootstrap yourself when you can't prove you exist. Having some kind of authentication that doesn't require an easily lost-or-stolen asset (ID card, birth certificate) would be helpful, as long as it is voluntary!

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#112

Post by AnthonyMouse »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

> How about turning them into a kind of value-added identity verification service where any company wanting/needing an identity verification could rely on the Post Office to accept someone in person to prove who they are (through fingerprint, document, etc) and be the 3rd party to make this proof easy?

Consider how you would like the Post Office to verify your identity and then ask why someone else, e.g. the person you're trying to prove your identity to, couldn't do the exact same thing.

One advantage of an ID is that it's a physical token, so they can't just guess your password, they'd need to physically have it. Unless they can forge one, so you'd really want to use some kind of cryptography. You've just reinvented a YubiKey.

The actual problem isn't that we don't know how to solve this. It's that people prefer insecurity to minor inconveniences. Especially when the liability is on someone else.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#113

Post by sokoloff »

SavantIdiot wrote: post #111
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

That's part of the reason why I like having my money with an RIA that I have a relationship with: I can't make big withdrawals on the account without verifying with several people. That's a sigh of relief. I think there is a need for authentication, especially among people that are in and out of poverty. The catch-22 is that you can't get a job without an address, and you can't get an address without a job, so you ca…

Many people have addresses without having a job. Kids, stay-at-home partners, roommates, college students, retirees, and likely others.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#114

Post by AnthonyMouse »

jjcm wrote: post #50
pjc50 wrote: post #43

Earlier quoted context omitted.

cough national id scheme, anyone? Thinking of E-Estonia here.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0]. The obvious reality here is that in the wa…

I don't understand why people think religion is the main reason to oppose this.

The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#115

Post by shakna »

AussieWog93 wrote: post #100
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

I don't know about other countries, but here in Australia post offices are open Monday-Friday, 9-5 (with the exception of some smaller ones being open until noon on a Saturday) and there are massive queues around lunchtime. And that's assuming there is a post office near you (or you have a car), and you're able-bodied enough to get there independently. I can say from personal experience that I have point blank refuse…

You may not like AusPost, but, the actually do offer the suggested service. [0] (As well as being somewhere you can apply for Police Checks and other identity services.)

[0] https://auspost.com.au/business/identity/voi-solutions-for-c...

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#116

Post by woodruffw »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

We could even cut out the middle man and allow the USPS to offer banking services, the way it did for nearly 50 years[1]! The original implementation didn't include checking or savings accounts, but it looks like they're slowly looking into that[2].

[1]: https://en.wikipedia.org/wiki/United_States_Postal_Savings_S...

[2]: https://federalnewsnetwork.com/agency-oversight/2021/10/usps...

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#117

Post by selimthegrim »

noahtallen wrote: post #21
dudus wrote: post #13

Earlier quoted context omitted.

Going through some processes on DMV and USCIS recently I noticed both of them were using Id.me Seems like a private company providing services to these gov agencies on authentication. Seems like a better solution than showing up at the post office.

That’s actually fascinating, because this official login solution exists, and it seems very nice: login.gov. It’s from the GSA which seems to be doing some good work. I wonder how id.me differs, and how we haven’t centralized on one solution yet

You record video message for example and state unemployment office can verify it against DL photo

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#118

Post by ghaff »

kevin_thibedeau wrote: post #84
ghaff wrote: post #53

Earlier quoted context omitted.

>social security numbers have been used instead Historically that was sort of the case. I'd argue today that we mostly rely on state-issued IDs (especially but not necessarily driver's licenses) which are now overlaid with RealID requirements. As a practical matter it's probably indistinguishable from what a federally-issued ID would be and I'm mostly content with not adding any more layers of identity verification t…

Some states allow use of SSNs for drivers license numbers.

It’s generally decreased over time though.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#119

Post by ghaff »

OrsonSmelles wrote: post #103
ghaff wrote: post #53

Earlier quoted context omitted.

>social security numbers have been used instead Historically that was sort of the case. I'd argue today that we mostly rely on state-issued IDs (especially but not necessarily driver's licenses) which are now overlaid with RealID requirements. As a practical matter it's probably indistinguishable from what a federally-issued ID would be and I'm mostly content with not adding any more layers of identity verification t…

>RealID requirements This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

There are non-trivial documentation requirements for RealID though. I had to go back in a second time. If someone has no need to fly it’s probably reasonable to offer them a lower bar.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#120

Post by podgaj »

mbesto wrote: post #102
paulpauper wrote: post #56

I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only t…

> 2/3 the market cap of Ethereum alone The idea of equating to crypto market cap needs to stop. $265B in actual real dollars is exchanged between two parties every year for gambling. That means a business pays a salary to someone and then that someone gives that money to someone else. Crypto market caps doesn't necessarily mean that someones earned currency is transferred to another one and it doesn't representing an…

Bitcoin, like casino chips and stocks, only have value when you trade them in for a currency that can pay your taxes. That is the real market value.
Post reply on HN