Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

In some cases the account officially belongs to a company so the real person is only an agent in any case.

Also there are attorneys: a real person acting on behalf of a different real person. Currently many financial institutions seem to be unable to cope with this situation. When talking to a call centre, in practice it's much easier, and probably not illegal, for you to impersonate the person you're representing rather than attempt to explain the actual legal situation to the confused employee in Bangalore.

Is that allowed by the network? Can 2 devices share one number?

Twitter uses SMS as a single factor, because you can reset the password with only access to the text message. If Twitter was using SMS only as a 2nd factor, this attack would not have worked without also knowing Jack’s password or having access to his email. Twitter’s password reset function could require an SMS code and then send a password reset email to complete the process.

Number porting should require an SMS to the existing SIM with the ability to respond NO to cancel the process and flag the request as fraud (e.g. whoever made the request on the carrier side should be flagged, to fish out compromised support reps).

A mandatory time delay (12 or 24 hours) could be imposed. This would slightly inconvenience people who lost their SIM and need to setup a new one. This seems like a reasonable cost/security trade-off for losing a SIM card. Mission critical numbers should be implemented as forwarding services that separately route to the cell phone anyway, so “this number must be live right now” is not a reasonable excuse to compromise everyone’s security.

You could also mandate a short delay (4 business hours) and high value targets that sometimes take international flights could opt-in to longer (24/48 hour) waiting periods. The expectation should be that 99% of users keep the default.

Using SMS as a second factor has trade-offs. This isn’t news because every single authentication mechanism presents a unique set of trade-offs in terms of cost of provisioning, ease of use, possibility of loss, possibility of spoofing, replay, etc.

SMS is an extremely powerful authentication factor due to its availability, cost, and accessibility. It’s worth it to shore up protection against SIM swaps not in the least because it would improve the security posture of SMS as an authentication factor. It would still not make SMS perfect. Nothing is.

> TOTP is bad for people who don't have smartphones.

This only true if you're willing to define everything beyond the most mundane "dumb phone" as a "smartphone". One of my friends has a long list of exciting problems which ends up meaning he doesn't own what anyone these days would consider a smartphone.

But it's not like he uses carrier pigeons. His phone does have a (monochrome) screen and is quite capable of running software, it's just the software has to be crappy mobile Java from last century. However TOTP is trivial, you probably can't do it in your head but you definitely can do it in a Java 1.0 implementation and so sure enough it can be run on those phones.

On a brand new Pixel of course you vaguely wave your phone near the screen, it reads a QR code and sets everything up, he has to instead laboriously transcribe a secret value using T9 input, but the same effect is achieved - a changing code that he can input to prove he knows the shared secret.

It likely would have made tracking the perpetrators easier if there was a paper trail in the markets.