Hacker News Reader

Comment by rmtech | Hacker News Reader

There are still ways to make the system more secure.

For example, you have to physically go to a store to port the number unless you have the old SIM.

Then it's not done immediately - there's a 72 hour period in which multiple texts and calls are sent to the old SIM asking for confirmation. If you physically have the old SIM this is instant, but if you claim to have lost it you need to wait 72 hours and provide a signature and mugshot at the store.

If a member of staff "forgets" to do this stuff, they go to jail.

People don't usually lose their SIM card, so this process wouldn't happen very often.

View on HN

Sure, you could have a national "reality" TV show, everybody who lost their SIM has to go on the TV show for six months with it showing on screen which number they claim is theirs - so this way there's no chance they're a crook.

Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on.

But, I put it to you that this all seems very disproportionate when you remember that you're punishing the phone company and its customers for not securing Twitter. These are the wrong people!

I'm a strong believer in solving problems at the single point of failure. If you solve it at the Twitter level, what about any other internet/cloud based service that is designed just like Twitter? It would still be a problem. If you solve it at the phone company level, all the companies that operate like Twitter are protected.

Even better still, solve it at both levels, but definitely don't let phone companies off the hook.

Yeah, I think it should be solved in both places TBH. Defense in depth.

But it won't happen because people are dumb and don't care about the issue until the exact moment it bites. This basically applies to every security problem: everything is perpetually broken and therefore nefarious actors can always find a way to achieve their goals. Most people's best defence is to not have any enemies.

Being serious, I don't think waiting 72 hours for a SIM number port is an inconvenience.

IF you lose your phone & SIM inside it, you need to go to the store anyway, or have a new phone sent by post (takes a few days usually). One of these things has to happen! You need a new phone!

So what we are adding here is a 72 hour wait for the number port. In the meantime you have a temporary number.

Govt should legislate to make precautions like this compulsory, or to create incentives for good security like steep fines against the phone company for simjacking, together with private red teams probing phone corp's security in this regard and claiming part of the fine.

>Or make anyone who claims they lost their SIM wrestle a bear first before they get a replacement. Won't see many crooks take that on.

Definitely the phone company to go with!

  People don't usually lose 
  their SIM card, so this 
  process wouldn't happen very 
  often.

People lose their entire phone all the time. In most cases, their SIM card is inside the missing phone.

Unless, of course, they anticipated just such an emergency, and preemptively kept the phone and SIM separate because they care that much about faceless, global social media platforms.

Reply on news.ycombinator.com