Hacker News Reader

Comment by anticensor | Hacker News Reader

Or do it like Turkey, and require central clearance with physical SIM replacement (this is required both for ownership and porting transfers). One of the few things we got right.

View on HN

I feel like a time delay would help with this too. If it takes an extra 24 hours and you get notifications by SMS and email during that period with the chance to call "fraud" it stops most of these attacks which take control of e-mail and phone simultaneously.

I get that makes life much more difficult when you are travelling and have your phone (and therefore SIM) stolen, but given the severity of the current issues it seems minimal disruption. You get a burner phone for 24 hours?

Porting takes over a week in Russia.

You get a new SIM instantly, but it has a temporary number. Then you get notifications via SMS on your old SIM, you usually get a call from your old carrier trying to get you to stay, offering discounts and shit. Then after 7-14 days the new SIM gets the old number and the old SIM stops working.

The U.S. system sounds horrifically irresponsible.

// Replacement with the same carrier is quick, but requires physical presence with government ID (passport)

In the UK it is usually 24-48 hours but both numbers gets texts about the impending switch to a new SIM.

Same in Turkey (takes 2-6 days), but you get your replacement SIM after the transfer is cleared, you still use your old carrier and SIM during porting porting. Old one simply gets inoperable by a remote command.

Yeah, you can use the old SIM during porting here too, but you can also use the new one with a temp number.

> I feel like a time delay would help with this too.

It used to take a long time and the carriers caught grief for making it hard for people to port out to another carrier.

That's the problem. We are lazy and demanding. We want an exact replacement phone in 10 minutes. This is a consequence.

How does this work? You have to send in your old sim before you can receive a new one? What if you lose your old sim?

> What if you lose your old sim?

I'd say it's pretty simple then: you can't transfer your number and just need to get a new one.

I mean at some point you have to draw a line; losing your password and resetting it via email is already a pretty gracious thing, and most support desks will help you beyond the default password reset as well if necessary.

But at some point you have to draw a line - key's lost? Access is lost.

I think this is going too far. It's easy to lose your SIM - in particular, whenever you lose your phone (you left it somewhere, it fell into a river, etc.).

Why not just require that if you don't have your old SIM on you, you have to jump through extra hoops involving physically showing government-issued documents and otherwise leaving enough paper trail for the police to find and jail you if it turns out you were a fraud?

That still doesn’t help. Who are you showing your physical ID to? The store clerk at the carrier store? There have been cases where the clerk was in on the fraud.

The last time I got my SIM reissued (the old one was too big for my new phone), I had the old SIM with me and I still had to show government-issued documents matching the registered SIM owner.

> Why not

Maybe the laws don’t consider that a serious enough crime to even investigate the cases?

That kinda ruins the main utility of the system for most people. People aren't switching service providers often or SIM sizes at all these days (the latter especially with larger SIMs just being the same nanoSIM but with an adapter of sorts around it).

For the average person, the best utility of it is being able to retain your number on losing your device. Usually you aren't expecting to lose your device, so imagine how much more complicated everything gets when not only do you have to worry about getting a new one unexpectedly, but then also have to get a new number, inform everyone you know about that, and then update all your accounts.

All of that just to protect people from being targeted by fraud that is not only very unlikely to happen to them unless they're well known, but is also better resolved by making authentication systems smarter.

We keep keys safe at home in the closet or under the mattress. We take our phones everywhere. Such a policy would be a usability nightmare.

Even if someone's phone is locked and useless, you could steal it, dispose of it, and cause a lot of grief.

I would so much rather lose my twitter account where:

a) I don't use twitter, so it's a loss of minimal proportions

b) It's twitter's fault and easily prevented by them

Sure, a) won't be applicable to all services because there are services I actually use that my life revolves around. However, the only service I can think of that would disrupt more of my life than losing my phone number is verified 2FA secured and does not have this vulnerability.

I would actively avoid a carrier that promotes this policy and think it's naive to assert that it's even remotely viable.

That's ridiculous to suggest as a solution and that's why it won't be adopted. Better to work on an alternative solution that has a better chance of adoption.

Reply on news.ycombinator.com