Freedom Mobile's 4 digit password limit | Hacker News Reader

Freedom Mobile's 4 digit password limit

null.pink

44 pointsNullificus25 comments

It's clear the only way to achieve progress in the world today is 'Name & Shame'. Hell, I've got better security for my email then I can get from Canadian Banks! I'm not surprised that Freedom Mobile is so lax.

I've been a customer since they were originally called "Wind" (at the time it was the only company that my N900 would work with). The only thing that they had going for them over the competition was good prices. That's barely accurate anymore. I hate all Canadian telecommunications companies.

Canadian telecoms have to be one of the most oligopolous (is that a word?) set of companies in the country.

Telus, Bell, Rogers all 'competing' with each other, each of them owning several 'budget/flank' brands so they can capture even more of the individual market segments.

It reminds me of tool manufacturers like Black and Decker creating (absorbing/buying out) once reputable brands that capture individual market segments (Dewalt, Craftsman, Stanley, etc.) - now it's been optimized down to cost, market capture, and quality/performance of tools.

Back to cell phones - I understand there's only so much spectrum to go around which limits what companies can afford to license/purchase from the government, along with how much throughput you can throw from those frequencies - but still!

I don't understand why Canadians pay so much for basic features in $/GB for example - they have some of the highest cost cellphone plans in the world!

As somebody who uses the 'budget/flank' brands, they always start cheap but they ratchet the prices up and the features down, so after 2-3 years of using one, I'm looking for the next brand to switch to.

I'm no shill but Mirgin Vobile during Black Friday was actually competitive this year.

What do you mean by competitive?

I haven't seen a plan at the less than 35$ except for public mobile at 25$ with 1gb. I come from Italy and at 5 you get 50 gb.

The pricing is just insane

> Hell, I've got better security for my email then I can get from Canadian Banks

At this point why not switch to a US one?

> I hate all Canadian telecommunications companies.

Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago.

> At this point why not switch to a US one?

As a Canadian I offer two things:

1) it is a pain for people to call you and have to pay long distance every time they call. Yes, long distance to the US is still a major thing in Canada.

2) I recently moved but kept my old phone number / area code. The number of times I call people and they don’t answer but then call me back right away and say “oh I saw an Ontario number and thought it was spam” is probably 4 out of 5 calls I make. People aren’t as accepting of non-local area codes as in the US. Probably because of the ridiculous number of scam calls we get.

Edit: > Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago.

Because Canadian providers are in bed with the competition bureau and other regulators that essentially allow them to twist the rules to ensure the current oligopoly is permanent and allows them to charge the highest mobile rates in the world, by far. Canadian consumers by and large hate the situation but politicians don’t listen and it isn’t a big enough issue for a complacent populace to vote on.

    Seems every thread about telecom ends up with a rant about Canadian providers. Why is the country so backward? They had Nortel and Blackberry not long ago.

Of the major telecom providers, 3/4 of them control news media of various kinds (print, radio, television, streaming services). Politicians seem to bend the country over on behalf of these companies because if you say you're going to do anything else you get relentlessly attacked by the press. The telco regulator (CRTC) has had essentially former execs from one of the major telcos over the past thirty years except for a couple of people who actually tried to make changes.

The lowest telco rates in the country are in the one province that has a provincially-owned provider: Saskatchewan.

Previous governments at the federal and various provincial levels essentially de-incentivized a ton of tech investment that the country used to excel at. Nortel's story is one of espionage being their undoing and I'm not sure anyone could have done anything about that. Blackberry I think just represented a business unable to pivot fast enough when the tides shifted.

It's clear I don't know how to handle this. I'm hoping someone here can pass it along to the correct people and have them actually listen.

Weak security sucks. However, this has been known about for years. People at Freedom Mobile know about it, customers know about it, the parent company knows about it. It's just that nobody has prioritized fixing it. Having seen the insides of several Canadian telco's security branches, it's a mixed bag. Some are better than others, but in general smaller, non-RoBelUs (Rogers, Bell, Telus) carriers tend to have atrocious (or non-existant) security. And even among the big-3, there are marked differences in their security maturity levels.

https://web.archive.org/web/20221229201428/https://null.pink...

It's a five-digit pin you can guess at infinitely.

How? The login screen only allows 4 digit pins, and if you get it right then you have to confirm with 2FA.

Getting the correct phone number and pin combo is step one. That's the four digit pin.

Step two is as many tries at the 2FA as you would like. The format is 0#####. It will take some time for sure, but you get to control the phone number as your prize

Alternatively, the 4-digit pin is the security for their support line. You can obtain that without guessing the 2FA. Social engineering takes care of the rest.

Mobile account authorization is critical for national security because of the rampant requirement to use cellphones as 2FA / password reset for everything else, including GC Key itself. The government needs to step in. The question is what particular person in the government has the power and motivation to do so. Have you tried the CCTS? CSE? They might have some power, but the upcoming potential Cyber Security C-26 act should spell it out for them.

It should be doable to find some big fish to take this on, especially since everyone is vulnerable to SIM swaps assuming every other Canadian phone company has such lax security.

I worked with the Office of the Privacy Commissioner of Canada(OPC) on this a few years ago. I don't have credentials and that's enough for them not to take it seriously.

I'm the only reason the 2FA is there. That change was the only change they would commit to. A few days ago is the first time since that I've logged into my account.

I'm planning to contact the Competition Bureau tomorrow with the information. They are currently looking at Freedom's viability under a significantly less powerful company than Shaw Communications Inc.

I dunno, but it doesn't really seem like Privacy or Competition is the right angle for this, they're luxuries after all, and it's not really relevant for those political maneuverings. Security is more important. The right actors could hack the entire financial system and more with these kinds of vulnerabilities, with targeted sim swaps. Take for example, the currently unfolding Twitter hack that puts 400m Twitter users' phone numbers up for grabs - including every big fish there is.

Call yourself an anonymous Russian hacker and that might get their attention.

I will reach out to CSE and CCTS when they open as well.

Thanks a lot for doing this!

From the article it was not clear that the 2FA was the 5 digit pin.

10 guess every 10 minutes with an expectation that after 5000 guesses you'll have a correct guess is 3.4 days (500*10 minutes).

There's no timing limits but your own, the only limit I could note is 10 per code. You have to guess a lot, but you don't get stopped. There's also nothing you can do as a target, even if you know you're a target. Support cannot disable your account.

Ah wow, no pause after

As a comparison, banks' 2FA will get disabled after too many resets.

Once again the great nation of Canada and Canadian businesses show their absurd levels of mediocrity. Every single business is like this. Filled with low quality, nepotism, low ambition, zero competition and zero hope for the future.

If you are competitive, ambitious, and meritocratic you're supposed to move to the USA and leave the rest of us alone to be mediocre in peace. Brain drain is the Canadian way.

Reply on news.ycombinator.com