Hacker News Reader

Comment by aww_dang | Hacker News Reader

So many companies are insisting on adding the extra vulnerability of sim-swapping.

I imagine on the aggregate level there might be less fraud? Or is it just the need to harvest more and more data? The way things are going, I wouldn't be surprised to see PayPal insist upon a mobile app install next.

View on HN

Malicious bots have gotten sophisticated enough that SMS verification and velocity controls are one of the few ways to manage Sybil attacks. Device and IP based systems can’t cope with the onslaught.

We really need some smart card cryptographic mechanisms for those without a smart phone, similar to Estonia’s smart card digital ID system. Asking everyone to have a smart phone to be identity proofed is simply not reasonable.

I’ve always assumed bad actors buy SIM cards and mobile numbers in huge quantities. Isnt that a lot cheaper than having to buy devices?

Regardless, requiring phone numbers impacts a lot of real customers in a negative way.

The bad actors do buy SIM cards in large quantities and there are services that will rent out the numbers for SMS verification. It substantially raises the cost for someone that wants to register 100,000 fraudulent accounts without linking accounts based on phone numbers.

Some concert venues are requiring axs.com mobile app to show the ticket QR code for entry and parking. I found out after I had purchased tickets.

This is also true for all venues through Ticketmaster (which is probably over 2/3 of them). A couple years ago, they moved from static barcodes to live, rolling 2d barcodes that expire every 30 seconds. It does work pretty well to prevent duping/fraud, but it absolutely requires a phone to enter the venue.

Reply on news.ycombinator.com