Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NY Man Pleads Guilty in $20M SIM Swap Theft

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 176 posts

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#161

Post by GoblinSlayer »

tdeck wrote: post #130
sleepy_keita wrote: post #122

Earlier quoted context omitted.

Japan Post provides this service, except the postman goes to your door and asks for ID and verifies it on the spot. It's very easy, and an extremely cheap way for services to verify identities (it's just +100JPY on the regular postal fare)

This seems like like it would only work in a country like Japan where the mail carrier would be on time. What if you're not home when they arrive? In the US they'd give you a 4 hour window and then show up 2 hours after the end of it.

They leave a notice that you received a verified letter, then you go the post office.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#162

Post by GoblinSlayer »

SavantIdiot wrote: post #123
sokoloff wrote: post #113

Earlier quoted context omitted.

Many people have addresses without having a job. Kids, stay-at-home partners, roommates, college students, retirees, and likely others.

I'm talking about homeless people: You can't have an address if you don't have a job because you can't pay rent. Unless you live in a city with adequate public housing. Duh.

In some regions, particularly in Africa, there is no door to door delivery of mail; for example, in Kenya. Renting a PO box has traditionally been the only way to receive mail in such countries. Another use case is when the mail box at your doorstep is not very secure, you rent a po box in the post office and mail is delivered to that po box instead of your address.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#163

Post by GoblinSlayer »

AnthonyMouse wrote: post #114
jjcm wrote: post #50

Earlier quoted context omitted.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0]. The obvious reality here is that in the wa…

I don't understand why people think religion is the main reason to oppose this. The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

We already have phone numbers for a low friction ID system used for surveillance.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#165

Post by PeterisP »

masonic wrote: post #154
OrsonSmelles wrote: post #103

Earlier quoted context omitted.

>RealID requirements This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

>it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees That's not why. States like California have dragged their feet for a decade with RealID compliance because they want to keep IDs for people in the US illegally indistinguishable from those for citizens, permanent residents, and others here legally.

That's interesting, I can imagine why certain groups would want that but not really why the state itself would want it; and if they would, why can't they just explicitly pass a law granting those people whatever rights they want to grant.

Can you elaborate on this for us non-USA people?

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#166

Post by PeterisP »

AnthonyMouse wrote: post #114
jjcm wrote: post #50

Earlier quoted context omitted.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0]. The obvious reality here is that in the wa…

I don't understand why people think religion is the main reason to oppose this. The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

IMHO the difference is that the status quo (a high friction non-universal government ID system + almost universal private "ID"/tracking systems) has all the same disadvantages anyway, but simply fails to realize the possible benefits.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#167

Post by PeterisP »

ndesaulniers wrote: post #9
krebsonsecurity wrote: post #4

Earlier quoted context omitted.

That's nice to hear. So the SIM swappers have to double their bribes. I think the best solution is to cut the mobile providers out of the equation altogether. I've long advised removing your phone number from anything you can, or at least substituting a voip service that can't be social engineered over the phone. Some services don't let you use voip services for multi-factor or signup, so your mileage may vary. Also,…

One thing I don't understand about the suggestion to remove my phone number from 2FA is that 1FA seems worse. I'd prefer something like Google authenticator, but none of my banks offer that. Did I misunderstand the suggestion? Is there something else I should do?

The problem is that often adding the phone number just says "2FA" but in reality becomes as another single authentication factor (e.g. in credential reset workflow) - and, given the risk of SIM swap, it may be weaker than proper 1FA e.g. a good password.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#168

Post by PeterisP »

dbancajas wrote: post #28
krebsonsecurity wrote: post #4

Earlier quoted context omitted.

That's nice to hear. So the SIM swappers have to double their bribes. I think the best solution is to cut the mobile providers out of the equation altogether. I've long advised removing your phone number from anything you can, or at least substituting a voip service that can't be social engineered over the phone. Some services don't let you use voip services for multi-factor or signup, so your mileage may vary. Also,…

> one number on file for the account. Which means anyone who SIM-swaps you then can reset the passwords on those accounts that allow SMS resets (which is a lot, still). > reply Why not use a special phone number for 2FA? How do hackers know your phone number?

If you use a special separate phone number for 2FA in multiple places, then it likely has both been exposed in some data breach, and also been sold for marketing/tracking purposes; attackers can get access to both these types of sources.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#169

Post by xxpor »

noodlesUK wrote: post #95
xxpor wrote: post #71

Earlier quoted context omitted.

Or we could just have a modern ID card that already has a cert embedded in it, and skip the whole go to the post office step. Most big companies and the US Federal government have already figured this out for their own employees. Keep the post office option for the folks that don't have an ID, but for most people, this would be the most straightforward option.

This does work for certain things, but for some things you don’t just want proof of possession of a particular person’s ID card, you want to see that a particular person matches the document they are presenting in addition to verifying that the doc is real.

I'd have to imagine that's exceptionally rare though. It would be semi-solved with a second factor to unlock the card.

Re: NY Man Pleads Guilty in $20M SIM Swap Theft

#170

Post by AnthonyMouse »

GoblinSlayer wrote: post #163
AnthonyMouse wrote: post #114

Earlier quoted context omitted.

I don't understand why people think religion is the main reason to oppose this. The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

We already have phone numbers for a low friction ID system used for surveillance.

People can reasonably get multiple phone numbers. A good countermeasure against this would make this easier and less expensive for people to do, e.g. you buy one phone plan and the phone company gives you two phone numbers, either of which you can change at your leisure. Then you give one to your friends and the other to your enemies, and change the second one every time you encounter a new enemy.
Post reply on HN