Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NY Man Pleads Guilty in $20M SIM Swap Theft

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 176 posts

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#151

Post by [deleted] »

parkerhiggins wrote: post #149
AareyBaba wrote: post #147

Earlier quoted context omitted.

Unfortunately, the U.S. gov has gone in the direction of using a shady private company ID.me [0] to provide this service. Starting 2022, the IRS is using ID.me to authenticate login to the irs.gov website. Same with California DMV. [0] https://en.wikipedia.org/wiki/ID.me . Millions of American citizen will be forced to provide their info to this private company. Authentication involves you providing your cell phone n…

It’s worse than that. Id.me originally started by providing verification for group discounts. Fair enough needs to verify to provide a discount and facilitate commerce. They’ve now used those groups as a stepping stone to verify the public. They want everyone. Id.me’s Privacy Policy and Terms of Service state that they will not sell your data. Good, but they absolutely can and will sell your demographic cohort. With…

[deleted]

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#152

Post by [deleted] »

schappim wrote: post #75
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

It is a good idea, that is why Australia Post have done just this: https://auspost.com.au/business/identity/voi-solutions-for-c...

[deleted]

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#153

Post by Grimburger »

schappim wrote: post #75
supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

It is a good idea, that is why Australia Post have done just this: https://auspost.com.au/business/identity/voi-solutions-for-c...

Last I looked many years ago it was quite an expensive service. Good for high-value one-off things but not really what GP is talking about.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#154

Post by masonic »

OrsonSmelles wrote: post #103
ghaff wrote: post #53

Earlier quoted context omitted.

>social security numbers have been used instead Historically that was sort of the case. I'd argue today that we mostly rely on state-issued IDs (especially but not necessarily driver's licenses) which are now overlaid with RealID requirements. As a practical matter it's probably indistinguishable from what a federally-issued ID would be and I'm mostly content with not adding any more layers of identity verification t…

>RealID requirements This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

>it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees

That's not why. States like California have dragged their feet for a decade with RealID compliance because they want to keep IDs for people in the US illegally indistinguishable from those for citizens, permanent residents, and others here legally.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#155

Post by masonic »

throwaway946513 wrote: post #74
tantalor wrote: post #67

Earlier quoted context omitted.

Here's my Senator on the subject of postal banking: > “You would have to work very hard to come up with a worse idea than having the government become a national bank executed through the post office,” [Sen. Pat Toomey, a Pennsylvania Republican] said. “Even if the U.S. Postal Service was the most competent, professional and best-run organization on the planet, they should not be in the business of banking. > “We hav…

What's even funnier is that we actually used to have Postal Banking back in the 20th century. But like other things during the 'Regeanomics era', it was cut, along with forcing the USPS to pay pensions 10 years in advance. The context does help to explain the reason why our USPS Grumman vans are well over their service life, and no where near retirement yet.

>forcing the USPS to pay pensions 10 years in advance

This is false, as the factcheck.org reference posted above in this thread makes clear.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#156

Post by pjc50 »

AnthonyMouse wrote: post #114
jjcm wrote: post #50

Earlier quoted context omitted.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0]. The obvious reality here is that in the wa…

I don't understand why people think religion is the main reason to oppose this. The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

As someone who campaigned against UK ID cards 20 years ago, we failed to realise that the ID requirements could be imposed without providing the ID scheme.

Since then the UK has imposed ID (technically "proof of right of residence", but that kind of has to be ID) on having a bank account, having a job, and both buying and renting houses. All without having a coherent ID scheme other than passport or driving license.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#157

Post by erispoe »

supernova87a wrote: post #6

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this co…

All European online banks can verify your identity with a video call in 5min. They check your info, your ID documents, that you are indeed the one holding these documents, and the security features of these documents.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#158

Post by thathndude »

admn2 wrote: post #26

So is it recommended to remove your phone number from your Google account to ensure it's not used to ever reset the password?

Yes. Google will constantly remind you to add one to “secure” your account, but just ignore it. You want no recovery emails and just an authenticator app.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#159

Post by ndesaulniers »

gnopgnip wrote: post #109
kube-system wrote: post #19

Earlier quoted context omitted.

> Yes there is: change your bank. If your bank is still using SMS based 2FA, get the hell out of there. Have any suggestions for a bank that supports TOTP? I have yet to find a decent bank in the US that supports this.

https://web.archive.org/web/20200202222301/https://twofactor... has a list of large banks and 2fa methods. Charles Schwab and USAA use TOTP but aren't exactly main stream banks. Both use a Symantec client and don't officially support third party authenticator apps.

Thanks for the link! A more updated source seems to be hosted at https://2fa.directory/#banking currently.

Not too many banks with physical locations in my area AND 2FA more secure than SMS.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#160

Post by ghaff »

ahazred8ta wrote: post #148
OrsonSmelles wrote: post #103

Earlier quoted context omitted.

>RealID requirements This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

There's a surprising number of people who do not possess a birth certificate document. Their parents lost it, it got thrown out during an eviction, etc, etc. I've witnessed people at DMV stations who brought in their original birth certificates, but the embossed notary stamp had flattened over the years. It takes time and money to get a replacement. If the non-enhanced IDs didn't exist, these people couldn't get a st…

I have a passport so it's sort of academic, but I'm not sure if I could lay my hands on my birth certificate. I'd certainly have to look through some file cabinets to see if I could find it and who knows if it's an original or not.

For people without a passport, it's extremely easy to have lost a birth certificate at some point over the years. And I honestly have no idea how easy or hard getting a new one issued is from some potentially far away city or town.

Post reply on HN