News for hackers. Stuff that matters.
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @03:56AM (#13408892)
Author here. I dont have a fixed telephone number anymore. How to handle that? I dont see why i would need one except for authentification purposes ether. My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong.

Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution.

On the other side i control my email address, my private key, my home address to a degree, but never my telephone number.

Re:Phone numbers are not proper verification by Freak_NL on Monday January 16, 2017 @04:13AM (#13408948)
In 2008 I moved to Japan from The Netherlands for a year as a graduate student. I didn't want to bother with my Dutch phone number there, so I looked for alternatives. My bank uses one time codes that are normally sent to you via SMS when you perform a transaction. These can also be pregenerated and sent to you via mail. The online banking environment simply asks me to enter code number x.

I never changed back, so now I receive a new sheet of numbered codes whenever I've used a certain number of them. Nowadays I scan this sheet of codes, run an OCR task, and import the codes in my password manager¹. So when the bank asks for code 519:

    pass -c bank/ing/tan/519
And I have the code on my clipboard.

I wonder how long ING (my bank) will allow this method to exist… The alternative used by Dutch banks is a small token generating device they provide to all customers (I think only ING mentioned above doesn't do this yet). This requires no phone number either, just the (tiny) physical device.

I wonder what happens if I tell my bank that I no longer have a phone number I can be reached at?

1: https://www.passwordstore.org/

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @04:18AM (#13408970)
Same. I also use paper tan right now and one bank account which i have to call if i want something (which i dont care much about, because its not ment to be accessed anyway) but yeah its just a question of time the bank does not send out TANs anymore.

My bank (or both of them) had no solution when i told them that i dont plan on having a phone number anymore. The one accepted it that they cant call me and send paper TANs, the other did not do paper tans for a few years now.

Btw: Your solution to store them sounds nice. Probably gonna adapt that

Re:Phone numbers are not proper verification by nom on Monday January 16, 2017 @04:54AM (#13409106)
Here in Germany we get a Digipass 2FA device from our bank (something like this [0]). For every transaction, you put your banking card in, hold it up to the flashing pattern on the screen, and it creates a TAN for you. Very convenient and secure.

I thought this is more common in Europe, but apparently it's not? Although, our banks are increasingly pushing towards App-based 2FA because it's cheaper.. but I'm very confident they'll continue to support as it is the common way to do online banking.

0: https://www.vasco.com/products/two-factor-authenticators/har...

Re:Phone numbers are not proper verification by wjdp on Monday January 16, 2017 @07:47AM (#13409652)
UK here, quite a few banks have used calculator style[0] devices for 2FA. You insert your chip card, enter the PIN and receive a code. The devices themselves, while branded, seem identical across banks and accounts (I can use one I got from bank A for bank B and vice versa).

Banks now have introduced app based versions of the above, useful if you've not got the calculator or your card handy, but I don't believe they're looking to phase out the physical device just yet.

Seems similar to your device, but instead of an optical sensor to receive a code from the web browser you enter the account code and money amount of a transfer manually.

[0]: https://upload.wikimedia.org/wikipedia/commons/thumb/0/05/Ba...

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @05:12AM (#13409158)
One of my banks does this, paper TAN is more confident for me as i dont have to carry a additional device and worry about driver support. But i surely will change to that as soon paper tan is over.

The other bank only offers different phone based solutions. Clearly my fault for not checking first, and also not a issue for me as i dont actually access that account.

If i could use that with other websites, Twitter, Github, whatever, i would happily carry that device with me :)

Re:Phone numbers are not proper verification by Freak_NL on Monday January 16, 2017 @07:28AM (#13409597)
> I thought this is more common in Europe, but apparently it's not?

It is. Most of the other Dutch banks do use such a device (I haven't seen devices that try to read your screen yet though).

Re:Phone numbers are not proper verification by Sparq on Monday January 16, 2017 @05:12AM (#13409160)
The ING smartphone app can now also be used to approve payments (https://www.ing.nl/particulier/mobiel-en-internetbankieren/i...), but that doesn't exactly remove the phone dependency.
Re:Phone numbers are not proper verification by lmm on Monday January 16, 2017 @07:07AM (#13409527)
> My point is that depending on people have a phone number, and even more one that is widely supported (which my current numbers are not) is simply wrong.

Maybe the bank is not interested in serving people like you - and why should they be? A bank needs to be able to loan money to fulfil its function - everything else they do is about enabling the loan business. To be able to make loans they need to be able to have some hope of being repaid, so they need a reliable way of contacting someone tied to that person's identity and expensive to mess with. Emails are ignorable and untraceable. Home address fulfils those functions but isn't really practical as a sole means of contact - would you like them to place suspicions transactions on hold while they send you a letter and wait for your reply?

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @07:19AM (#13409571)
As mentioned in some other comment my bank was a bad point, i see why its more relevant for banking. While one of my banks is perfectly happy with what i am doing and offers me paper TANs and contacts me via letters the other isnt.

I am more about everything else than banking tho. Things that dont have the need to contact me ASAP and still use SMS for authentification purposes. (Personally i dont even mind verification, i have a number, just not for long)

Re:Phone numbers are not proper verification by SomeStupidPoint on Monday January 16, 2017 @08:57AM (#13409956)
My bank emails me about suspicious transactions.

There's a link for if I authorized it and a link for if I didnt.

In fact, basically everything my bank does is by email, except a few legal documents amd sending replacement cards, which are by mail.

I cant count the number of times they called me on a single hand.

Re:Phone numbers are not proper verification by icebraining on Monday January 16, 2017 @04:31AM (#13409020)
Sure i could call my bank one a month to change my telephone number, which i loose control of shortly after that (only valid for a few months, prepaid). This is hardly a solution.

I don't get it, why are your prepaid cars only valid for a few months? Do people just lose their number regularly?

Around here you can get a prepaid SIM, and you only need to make a single call per six months to keep it active. Even an initial 10€ payment is enough for years of service. Can't you get the same in Switzerland?

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @04:32AM (#13409027)
No thats what i ment. I need to use it within N period to keep it. If i just receive SMS every other month it will die after a while.

Also as mentioned i cant get it again, prepaid is kind of contract less. If i loose the sim i am not entitled to get the same number again.

Re:Phone numbers are not proper verification by sethammons on Monday January 16, 2017 @10:00AM (#13410302)
Could just set a reminder to call someone or an automated service once every period...
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @10:06AM (#13410332)
Thats a very cool idea actually. Would depend on not changing my phone or resetting it and forget about it so probably faulty, but i keep that in mind.
Re:Phone numbers are not proper verification by devoply on Monday January 16, 2017 @04:01AM (#13408907)
Go to VOIP.ms set up a number for $1/mo. So 12/year. Have it forward to your number. Use it for verification as well. It supports SMS, though I have found some services won't allow it.
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @04:03AM (#13408913)
Which i control even less... I dont doubt there are solutions, but the only one i've seen so far that is kind of optimal is Github which allows me to disable lost 2fa access through verifying with a git push like command based on public/private key.
Re:Phone numbers are not proper verification by devoply on Monday January 16, 2017 @04:04AM (#13408917)
I don't know what control means to you. You mean stuff that you don't have to pay for? Stuff that can't be taken away from you? I have had the same number with VOIP.ms for 5 years. Even used it from Mexico. It does not seem to me to be out of my control.
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @04:08AM (#13408935)
Control means i own it. You never own telephone numbers, maybe you do in some countries i dont know, but they usual contract is that you rent them and they can be taken away from you anytime. Sure they usually dont, but building a security system on something like that is obviously suboptimal.
Re:Phone numbers are not proper verification by tyingq on Monday January 16, 2017 @08:41AM (#13409883)
Not sure I understand the difference between renting a telephone number and renting a domain, or email address, or even a home address. All can be taken away for various reasons, failure to pay rent/renewal/mortgage, legal confiscations, etc.
Re:Phone numbers are not proper verification by SomeStupidPoint on Monday January 16, 2017 @09:04AM (#13409995)
As far as I can tell, it's just a whine services don't let you use a preferred rented identity listing (that is arguably less tied to the real world).

There's not a lot of genuine security or legal analysis to be found here.

Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @11:23AM (#13410848)
Some other guy went a bit more into genuine security if thats your thing: https://www.devever.net/~hl/e164
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @09:32AM (#13410134)
According to my telephone contract it can be taken at any time and i am not entitled to my telephone number. This is something you dont find with domains.
Re:Phone numbers are not proper verification by tyingq on Monday January 16, 2017 @09:46AM (#13410218)
They can take your domain away, for example, if you fail to respond to an inquiry regarding invalid contact info. Anyone can initiate one of those inquiries. And, of course, there's the various domain name dispute policies at ICANN.
Re:Phone numbers are not proper verification by herbst on Monday January 16, 2017 @10:04AM (#13410319)
I just checked for details. So far as i can tell its a long, costly and usually failing process to get a domain taken. VS. Just a random thought by a single entity to get your phone number taken.
Re:Phone numbers are not proper verification by keypress on Monday January 16, 2017 @04:11AM (#13408943)
Man in the middle.
Re:Phone numbers are not proper verification by devoply on Monday January 16, 2017 @04:15AM (#13408959)
The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.
Re:Phone numbers are not proper verification by mark242 on Monday January 16, 2017 @02:04PM (#13412062)
"I dont have a fixed telephone number anymore. How to handle that?"

Get a fixed telephone number.