Hacker News Reader

Comment by sangnoir | Hacker News Reader

> ... the attackers had to perform a "SIM swap" type attack on the users

Minor nitpick: I find your framing problematic as it transfers "burden of security" to the end-users over a process that did not involve them: this was not an attack on the users - it was an attack on the telecoms infrastructure.

I have a similar gripe against "identity theft", which really ought to be "fraud against corporation X, using false identity" - however, that framing is necessary to make consumers accept, by default, the burden of clearing debts they were never party to simply because the defrauded party did not have adequately verify perpetrators identity.

View on HN

I agree. From Coinbase's perspective, they ought to defend their infrastructure against fraud, whether that is a direct attack on the users, an attack on the users' telcos, or insider activity directly.

From the telco's perspective, they have a responsibility to stop SMS and SIM fraud, and our regulations have failed to properly hold them accountable in this domain.

I would add that the users have some responsibility for losing their emails/passwords, but my initial framing insufficiently demands responsibility for the service providers in this instance. The service providers should be expected to take all reasonable steps to prevent fraud on their platforms, and that should include extra scrutiny of SMS-based authentication mechanisms (e.g., identity verification). This is why Coinbase paid them back, accepting some responsibility for the fraud.

I fully agree that users are not absolved of all responsibilities or vigilance (e.g. over passwords/devices). I think the legal framework has to be overhauled to clarify the culpability of all parties involved, rather than the current "Sucks to be you" attitude towards consumers, who are the least powerful, and have the least agency in these issues.

Telcos have no responsibility to stop SIM fraud. Telcos have communicated the last 30 years SMS is not secure (travels as plain text) and should not be used for 2FA. If companies have ignored this advise then it is on them.

SIM swapping also allows you to intercept voice calls, which are encrypted and supposed to be secure. The idea that telcos have no responsibility to stop people from taking over the telephone number that customers pay for is completely absurd. Moreover, often the SIM swapping is done by employees of the Telco itself using company infrastructure.

No you are not correct. The whole underlying mobile phone network infrastructure is based on (failed) trust and is not secure. Though it is slowly being replaced.

https://www.theguardian.com/technology/2016/apr/19/ss7-hack-...

https://www.firstpoint-mg.com/blog/ss7-attack-guide/

replaced by a system which is similarly secure against all classes of attackers that anyone gives a crap about.

Can you elaborate? I'd like to learn more about this. The only initiative I know about is STIR/SHAKEN.

I feel people who fled Hong Kong and Belarus care, so it would be rude to call it crap.

The incumbent telcos would love a regulatory framework where they must store address info and other personal data of their clients: Clients would then be much less likely to switch.

International tourists will also be less likely to get a local SIM card and then pay exorbitant roaming charges.

(Here in South Africa, clients must provide proof of their residential address. Some telcos even insist on verifying the thumbprints of their clients)

Don't see how that's relevant to the thread at hand. The problem here is that the Telco has an existing paying customer for a number, and has systems that allow other malicious actors to take over that number instead. It's not about verifying the absolute identity of the account owner, they only need to verify that the new SIM using a number has permission from the person who rightfully owns the account. In many cases, this fraud is being committed by employees of the carrier (e.g. at it's retail locations). That means the carrier clearly doesn't have adequate controls to prevent abuse.

And the elephant in the room is... the real purpose, for many corps eg Google, others, is to identify you, track you more accurately.

And your mobile phone number is invaluable here.

coinbase does kyc. it already knows who you are

why sms? because everyone has it. we're not in a otp/u2f only world yet. sms 2fa is better than no 2fa

A point very well made by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E

This is brilliant.

The easiest way to prevent sim swap attacks is to use Google Voice. Google has no customer service, so there isn't anyone you can call up and con.

This isn't really true. Google Voice numbers are managed by bandwidth.com and have been taken by attackers submitting fraudulent number portability requests in the past.

Don't you have to login to your Google account to port a number?

It has been possible in some instances for an attacker to port a number directly from the underlying carrier, in this case, bandwidth.com.

When I saw this happen, Google was not aware the number was gone, so calls and texts from other Google Voice users still worked.

There's ways to intercept SMS messages without sim-jacking or number porting too.

https://arstechnica.com/information-technology/2021/03/16-at...

That is smart, funny and sad, all at the same time.

Coinbase and other sites (especially those that deal in money) should stop using SIM cards as a form of authentication. While carriers should probably do more to secure SIMs and phone #s, it has always been known that the system was never designed to be used as a security mechanism, and Coinbase using it as such is a security flaw that they are responsible for.

Okta architect here. It's hard enough getting MFA to work in a large organization where technically illiterate people are surrounded by coworkers to ask who have all figured out their RSA tokens or Okta Verify enrollment. Trying to manage this for the general public would be an incredible undertaking.

The cost benefit analysis probably does not make sense for a gazillion low balance users. It may make sense to enforce strong factors for high balance users. You have to balance that against them taking their business elsewhere.

In Europe all banks are using 2FA, and it's usually based on TOTP (and enrolling the first phone is a pain usually requiring QR codes and whatnot). 17 years ago some were using smartcards as 2FA. It's doable and secure, to the point that identity theft is almost unheard of (and usually used more as a synonym of catfishing than in the American sense).

SMS is handy but it should be a last resort rather than the main second factor.

I bank with a major European bank, and they still rely on SMS for 2FA for every online transaction, except for logging into their website. They offer 2FA through their app, but that only works with iOS or Android with full Google Play services---for non-Google folks running LineageOS or /e/ OS, they're stuck with SMS 2FA.

If you can use sms as a factor, you can use sms as a factor. The only way to win is not to play at all

Yeah what I meant is that companies should propose other methods than SMS.

SMS can be good enough to confirm a password reset link that was sent by email (so you will not really do anything without access to an account's linked email address), but not as the main second factor for login.

This. Nerdy people don’t understand how much people struggle with this.

RSA enrollment is probably the single most challenging end user issue our IT folks deal with. After password reset it’s the #2 call, and lots of time, training and engineering effort has been expended to improve the experience. (And those efforts were very effective!)

So to sum up, an organization promising to take people's money and keep it safe can't afford to do it except for people with a great deal of money. However, they're still going to accept smaller amounts of money. Did I get that right?

Depends on how you define "keep it safe". If I give you $100 to keep safe, I don't care how many times you get robbed as long as I get $100 back when I want it. If I can get my money, it's safe.

When I went looking for an online brokerage in the USA with a reasonable login process (i.e. 2FA, not by SMS ever) it seemed pretty hard to find one. (Maybe that's changed?) These brokerages handle amounts much greater than a software engineer's retirement savings.

I think the difference for me is the extent to which transactions are traceable, revertable, and regulated. The median reaction to theft in the cryptocurrency world is somewhere between "caveat emptor" and "ha ha, buddy, you fucked up".

For traditional finance, it's pretty different. E.g., "If fraudulent electronic withdrawals are made from your bank or credit union account but your ATM or debit card is not lost or stolen, you are not liable if you write to let the bank or credit union know about the error within 60 days of when they send you the account statement showing the fraudulent withdrawals." https://ovc.ojp.gov/sites/g/files/xyckuh226/files/media/docu...

Fidelity has the option to use OTP only (although its unfortunately a shitty Symantec app)

But could one simply take the secret when initializing the app and stick it in another, like andOTP? My employer told us that the corporate intranet required we use Google Authenticator, but when I try other OTP apps, it still works.

It’s based on risk. TOTP tokens only provide moderate assurance.

If you have a lot of money, most brokers will ship you a hardware token.

Unfortunately, yes.

A decent point. It scares me to imagine all the security checks that would be required to make SMS actually secure against these kind of attacks, and then getting everyone to actually follow them.

Then we need to do a better job making the UX easier. I'm sure Okta is working on that?

I feel I should clarify, I do not work for Okta, but play the role of Okta architect on TV.

> I have a similar gripe against "identity theft", which really ought to be...

... bank robbery by unknowing proxy. If we reframed the narrative, I bet banks and financial institutions would bust their asses to make things better.

They already do for the most part though right? That is, they lose a huge amount of money to "identity theft" and have ample incentives to stop/prevent it.

Reply on news.ycombinator.com