Hacker News Reader

It's even more ridiculous for a telco CSR to transfer his number to another provider without doing any sort of proper validation beforehand. A simple callback to ensure that the person calling was indeed the owner of the number would have prevented all of this.

In the process of transferring a phone number now and it seems to be universally insecure. Sign a paper and you're done.

A simple automated SMS from your current provider that requires a "YES" response would be a lot securer and shouldn't be hard to implement.

Don't forget number porting is recently new. The FCC started requiring carriers do it in 2003. Since the telco's were forced to do it, you think they are going to put any effort into it unless legally required to do so? They don't care.

Nearly every carrier has a customer provided pin attached to the customer account that is used to verify porting requests.

Stop commenting on things you know nothing about.

Almost all US prepaid providers use the last 4 digits of the phone number or the billing zip code as the PIN.

Many landline and voip providers really do just require a signature.

Landline & VOIP providers rarely have a PIN or security question on file, and CLECs like Level 3 (who supplies Twilio and many others) will approve nearly any port since their customers don't keep customer service records for each number on file with them.

There has literally been hundreds of cases reported in the media in the last few years where the phone company ported a phone number either without verification or with "verification" (easily found information) and the victim had their accounts stolen. This has been a documented problem.

Phone companies seem to be starting to take the issue more seriously as of the last few months due to the aforementioned bad press. Verizon just forced me to create a PIN by Jan 24th, 2017. So I didn't have a PIN until less than a month ago.

The practice has been in place so long, even a lumbering giant like Verizon requires it... Hahaha

I moved off verizon to google fi last summer, there was no PIN, just asked for my phone number and name.

I used to keep putting my phones through the washing machine, so I stuck with cheap prepaids until I got over the habit. This happened several times:

Me: Hi, my phone number is X. I put my phone in the wash, please transfer my number and minutes to this new phone.

Telco: Ok what was your old serial number?

Me: I don't know, my old phone went through the wash.

Telco: Um...ok you're all set.

I worked at a voip provider and we got slammed all the time. Once, another company grabbed a block of a thousand of our customers at once.

Legally there isn't much you can do beyond a snapback either, depending on how the line is classified you have to complete a simple port within 24hrs if the CSR (customer service record) matches.

Generally, if the CSR partially matches what the new provider gives, the port will be approved as the old CLEC doesn't want any escalation of a port.

I've been doing this to get by SMS based two factor in pen tests for years. The only time it didn't work is when I'd forgotten part of the auto process so I'd hang up and try again

Because support teams aren't coordinated with call attempts you can essentially brute force the process

Also the online portals for number transfer are notoriously weak. There was one MVNO i used for years because their website did no server side auth and I could transfer numbers to new SIMs at will

SMS as an authentication transport is beyond useless - nobody should be implementing it

Does the provider that currently holds the number need to release the number when it's transfered? Or can any random provider port out my number from my current provider?

Most countries have number portability laws now that say the current provider has to release the number.

They can't even hold it over an unpaid debt. Worse, a lot of these laws have government SLAs in them that say x% of transfers have to happen within 2-3 hours (usually 90-99%)

There is zero incentive from any party to add friction to the process for authentication purposes

It really got easy when I noticed the process was automated by a lot of providers a few years ago. I really don't think there was any human oversight on many of these transfers (perhaps a rubber stamp from a cheap offshore pair of eyes for compliance purposes)

The last time I transferred my mobile number, the telco wanted to have the IMSI as well. Then what my phone reported was not what they wanted, so it took a while to sort that out.

But it seems secure enough. It is not easy to get an IMSI for a random phone number.

> It is not easy to get an IMSI for a random phone number

This is easy if you have an SS7 network connection. Comparable to the difficulty of resolving a DNS name to an IP address using an internet connection.

Maybe this post will convince namecheap to have an alternative 2FA (other than SMS). They've been "planning" [1] this for 3+ years.

[1] https://www.namecheap.com/support/knowledgebase/article.aspx...

It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number

Why is this ridiculous? Isn't this the same thing that Gmail offers for your own account? If you lose your password, Gmail will only send the recovery info to your friend's phone?

The problem happens if the password can be recovered with the same phone number as used for 2FA since then anyone who steals the phone/phone account can get both the password reset and the 2FA SMS. However, using two different numbers means a hacker has to hack two phone accounts instead of one. At least I hope that's what they have to do.

>I personally have 4 factors for my gmail account

Tack this on to the list of reasons why no normal person will use bitcoin in any quantity.