Hacker News Reader

Comment by meindnoch | Hacker News Reader

Losing a smartphone today can have a profound impact on people’s lives. You lose your ability to pay for things (unless you have physical cards with you); you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work; you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel.

Maybe it’s time for more severe punishments for phone theft? The slap on the wrist thieves get today doesn’t seem like much of a deterrent, especially compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication.

View on HN

> You lose your ability to pay for things (unless you have physical cards with you)

So don't do that. Always carry some cash and your debit and/or credit cards. Spread out the risk (especially when travelling).

> you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work;

So don't do that. If you enable 2FA, have backups and recovery codes. Assume the phone will get lost at some point.

> you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel.

So don't do that. When travelling I always take the printouts of the tickets along, even if I end up not needing them.

Don't turn your smartphone into your everything. Treat it as a tool which can get lost, stolen, or broken.

But the reality is that we're fast approaching a future where every service assumes you have a smartphone and leaves you SOL if you don't.

As an extreme example, my previous workplace had a "smart" lock on the door that could only be opened with a bluetooth-enabled smartphone and a dedicated app. It was immensely dumb and everyone hated it, but the owners thought they could save on keycards by doing this and so they did, because every employee had a smartphone anyways.

I second this with the caveat that stealing someone’s car simply means they don’t have transportation (cost aside). For many theft of a phone could be losing all the things the OP mentions. Your average consumer has no idea what backup codes are. Your average consumer relies on the no contact pay. Your average consumer relies on 2FA.

There is a massively more inconvenience (cost aside again) in having your phone stolen versus your car. It could upend your life a lot worse than having your wallet or laptop stolen as well.

There are only so much things we can expect from the average consumer and theft of a phone massively changes that persons life.

I’m for increasing the resources put into specifically phone theft.

My laptop was stolen from the airport (inside security!) and I had needle like precision with where the cops could find it. Nothing was done and I simply got back the insured value for it and the items with it. It put me out of work for the trip I was taking but I’m not your average consumer and everything was backed up and I did still have my phone. If my phone had been taken and not on me I would have been in a much larger world of pain (though I have backup codes, etc.).

I don't have a mobile phone and regularly have issues with SMS based auth or a mobile phone regex match being the only option for a multitude of services.

This is precisely why it's constantly argued that a phone is not a good 2nd factor for authentication. The auth data should be on a device that is basically worthless except for the data it holds which in turn is also inaccessible to someone else.

Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.

How are "tough on crime" laws regressive? What do you think is the actual problem?

I think they mean that just passing laws that make it punishable by say 30 years in prison to steal a phone would be regressive, since the punishment is in no proportion to the crime.

However, what would actually be nice if, like people here have suggested, is that the police would actually bum off to retrieve stolen phones, bikes, etc and then deliver whatever appropriate penalties to the perpetrators if found.

Doesn’t matter if it’s only a small punishment so long as people get their stuff back and the thieves learn they’ll be sought after.

So basically, we don’t need better laws here, simply enforcement of them.

Since rich people are less likely to steal phones, increasing the punishment for phone theft affects rich people less, which means it's regressive.

(I think using this argument to justify being soft on crime is ridiculous. I'm just pointing out what the argument is.)

> Losing a smartphone today can have a profound impact on people’s lives.

This is the actual problem. Theft is also a problem, but not all that relevant.

"Tough on crime" doesn't really prevent crime when the incentive to commit it is still probably higher than the disincentive no matter how "tough" and getting caught is still unlikely.

A trivial, but more relatable, example of this line of (criminal) reasoning is that people are more likely to enjoy extreme sports vs a high paying "dangerous job" despite working the job being less lethal, less accident prone, and a much greater net positive.

Anyway the regression is adding unnecessary laws.

Where are people going to keep that second device? In their wallet? The wallet is just as likely to be stolen as the phone.

My employer provides Yubi keys, which have no value other than being an auth mechanism and fit on a keychain. I have one configured as a backup.

> Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.

There are definitely tough on crime laws that would solve or mostly solve the problem. Unfortunately these will mostly be cases of the cure being worse than the disease (e.g. panopticon with facial recognition and use of face coverings leading to jail time).

>e.g. panopticon with facial recognition and use of face coverings leading to jail time

Yeah. Or the inclusion of accurate GPS trackers in each and every phone, so law enforcement could track them down. That would be truly dystopian!

I always wonder why we don’t use decoys more. Have seemingly tipsy girls stand waving their phone around for a cab and a cop a few feet hidden away. Then stiff penalty. It’ll make people think twice about whether their “mark” is legit.

Same for bike theft…

Because, at least in some jurisdictions, this is regarded as soliciting illegal behaviour.

Which is just as ridiculous as saying that rape victims solicited illegal behavior by dressing provocatively.

AFAIK, in the US, it's only considered entrapment if the officer (or other actor) explicitly entices you to perform an illegal action.

If they stand there, looking like a drug dealer, and you ask… all good.

If they ask you if you want coke, entrapment.

I'm not sure it's as cut and dry as that, but the gist is "would you have committed the crime regardless of the actor's behavior."

Perhaps phone theft is too petty a crime to make it worth it?

In the 80s and 90s bait cars were ubiquitous in cities https://en.wikipedia.org/wiki/Bait_car

I could buy a used car for the price of an iPhone 14 Pro Max.

> Unfortunately these will mostly be cases of the cure being worse than the disease (e.g. panopticon with facial recognition and use of face coverings leading to jail time).

Not necessarily. Even if we didn't catch any more criminals than we do now, you could probably reduce the problem a lot just by making sure the ones we do catch actually go to jail.

> a phone is not a good 2nd factor for authentication

That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't predicated on them being optimal, it's predicated on them being (1) present in almost all cases and (2) easily used.

Obviously yes, it would be safer if we'd all carry around password-locked yubikeys. But we aren't going to. We do have phones in our pockets, though.

Since phones are now the primary computing device for most people, is it really a "2nd factor" though?

As conventionally defined, yes. The "first factor" is traditionally a password (or in the modern world, maybe password+working_email_address).

You are techincally correct, the best kind of correct, but just for balance I should mention that cavaliers like me end up merging the factors by having all their logins saved on their phones (modulo fingerprint prompts etc.).

Something you have and something you know, yes. But isn't the thing you have supposed to be separate from the client you're using to authenticate?

We're talking about the case where the phone is stolen. There's almost no reason to steal an authentication device other than harassment or tactical delay of access.

Good lord, no. I don't lose any of those things, not even the 2FA.

> compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication.

For goodness sake, push back! I didn't even allow for the presumption I have a phone to read QR codes for restaurant menus, because of where I saw that was heading. Never allow anyone or any place to presume they can rely on your smartphone for something they should be responsible for.

I noticed places I work for started to try this, and put a stop to it right from the beginning by asking if they were going to start paying for my phone contract, and buy the phone from me, so I could buy another private one. Putting it in black and white makes it clear what's going on; which is work trying to get (a) free hardware, services, and (b) free work out of hours.

Anticipating the nightmare a lost phone would cause me means I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it. As for MFA, I have to grit my teeth every time my phone is the backup. Losing your phone is like losing your sight now.

> I do not use my phone for payments, banking apps, or tickets/passes whenever I can get away with it.

Which is becoming less and less often in my experience. I was recently at an event that used SeatGeek for ticketing, and the only way they'd give you tickets was digitally through an iOS or Android app.

Hence why a person basically needs to be cyborg to function in modern society, via phone. You are not a person unless you are effectively part machine. So stretching the analogy as far as it will go, phone theft should be considered dismemberment, or organ harvesting or trafficking.

You can pretty much say the exact same thing about stealing someone's wallet or purse. There's a lot of travel advice to the effect of "don't keep everything in one place". A phone is no different.

A phone at least has the benefit of being backed up. In theory, I could log into a couple accounts on a brand new phone and have access to everything within tens of minutes. Contrast to the hours of phone calls and weeks of waiting it takes if I lost my driver's license, passport, etc.

And though a phone can be used for payments, it must be unlocked. Not true of the physical credit/debit cards (swipe or tap) or cash found in a wallet/purse.

If you have non-backed-up 2FA tied to your phone, you should fix that. Batteries die, and phones can be physically damaged, bricked for some software reason (they're computers, after all), dropped into the ocean or off a cliff, or just legitimately lost (ie: falls out of pocket into the cracks of a car seat and battery dies).

I won't weigh into the punishment-deterrent argument at all, I'm merely pointing out that in theory there's actually a lot less disruption having your phone stolen vs having a wallet/purse stolen. Both suck, of course. Replacing a phone is almost certainly more expensive, but it should be significantly faster to recover from. And backup your 2FA.

My wife and I are doing the digital nomad thing flying across the US and staying in hotels. I’ve thought about what would happen if I lost my phone and/or my wallet.

- I have a cellular equipped Apple Watch and iPad that both independently get regular SMS messages along with my phone.

- I can sign into my Mac and get text messages.

- I have a second wallet in my bookbag with a few lesser used credit cards, a little cash and my passport card for ID

- my wife is my backup recovery source if I get locked out of my account.

> I can sign into my Mac and get text messages.

Doesn't this actually depend on relaying the SMS from the phone? I don't think delivery works if your phone isn't in range of the laptop.

Even the watch seems to require the relay to work for receiving [1]:

> To receive SMS, MMS, or push notifications from third-party apps on your cellular Apple Watch, your paired iPhone must be powered on and connected to Wi-Fi or cellular, but it doesn't need to be nearby. You also need to be signed in to iMessage on your iPhone to use Messages on your watch.

[1] https://support.apple.com/en-us/HT205547

Well shit you’re right.

Shouldn't you be able to walk into a phone store, get a new one and automatically sync all your files, passwords, etc., then pay for the phone using that data?

Well, you need the phone to prove who you are. Out of luck…

In what country is ID stored on the phone? Do people not carry licenses or IDs physically?

If my own anecdotal experience is anything to go by, we tend to carry IDs in the phone wallet case. Lose one, lose the other. Sigh.

The worst part is, I know this is a terrible idea, and yet I carry all my eggs in the very same basket.

At least I've had the good sense to leave my physical driver's licence in the car I use 99% of the time after we got a driver's licence app - I can now simply show the police my cellphone with a QR code and a control animation on it, and they can verify my licence class and expiry date on the spot.

Maybe I'm weird then, I have a case with all my physical cards and I carry it in the opposite pocket from my phone

I’m one of the only people I know with a wallet style phone case with cards/id in it but I think I’ve just decided to go back to a separate wallet/card case. Will help thin down the phone too since I’ll probably just go caseless.

In NSW we have digital licences. My APEC business traveller card is now digital as well. 2 forms of 50 odd points of ID

At least once we reach the point where we use passkeys everywhere - which as far as I understand is the safest authentication method? Then a new phone will not have the trusted keys since they are stored in the hardware of the stolen phone.

Now you've got two vectors to get all the important data that lives on my phone: steal my phone, or convince a retail associate that you're me

You're assuming the worst possible implementation of that idea.

Well, I don't think I am. I think the easier it is for me to get a clone of my phone, the easier it is for someone else to get it. If at&t makes it really hard to get a clone, okay, but that makes the offering less useful. A seven day waiting period might make fraud less lucrative, but it also means I'm without a phone for a week, so what's the point

> you lose access to your email/bank/github/etc. accounts protected by 2FA

I wonder if apps like Microsoft Authenticator are better for this. They sync 2fa codes to your Microsoft account. Naturally, the question becomes "Doesn't that make Microsoft a single point of failure? If someone know's your Microsoft password, they can get into your Authenticator and all your other accounts basically don't have 2FA anymore"

From what I can tell it doesn't look like Microsoft has an answer to this, unless there's something obvious I'm missing. On the bright side, though, if you lose your phone, your 2FA codes aren't lost.

Choices, choices.

> They sync 2fa codes to your Microsoft account.

This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account would also have access to your shared secret for every site. I would wager that they also would have access to your communications medium and password stores as well, in most cases, since you'd likey have bought in to the wider ecosystem.

Or do they encrypt it client side?

Restoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption going on.

The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)

I don't understand how people recover from unexpectedly losing their phone. How do you get back into your accounts with 2FA?

In a sense, humans already have to be cyborgs to function in modern society.

I guess you'd write an "Ask HN" post and hope that a Google engineer notices. Same for GitHub.

I specifically have multiple phones setup with my Google Authenticator account for this reason. If you don't have a spare phone, I recommend purchasing a used old android phone for $30 just for the peace of mind.

1Password on a laptop can hold google auth keys

Just curious - what's wrong with backup codes?

If you are really paranoid. Backup codes can be copied without you noticing. Even bigger risk if you bring them along while traveling, or worse, leave unattended in hotel room.

The Authenticator apps store keys in Secure Enclave (or at least I hope so). Which in themselves are 2fa by not being copyable thus requiring direct access to unlocked phone before using.

Of course that also comes with bigger risk of you locking yourself out, by forgetting Lock Screen password or phone getting bricked for some stupid reason. Printed paper don’t have that problem, except can also easily be lost.

There's a reason 2FA always gives you backup codes? If you didn't write them down that's on you.

Here's my solution: https://github.com/evanpurkhiser/recovery

Maintain a second device (doesn’t have to be a phone) with your 2FA codes.

You know those backup codes they make you say you've printed before you can complete setup?

My 2FA is all using Yubico Authenticator, so even TOTP codes are on my Yubikey rather than my phone. I keep my backup codes in 1Password in case I lose my keychain.

There should be more severe consequences for unlocking stolen devices, it’s crime on the same level as SIM swapping by phone store employees.

Reply on news.ycombinator.com