Re:SMS is not 2FA-secure
by Pxtl on Saturday January 11, 2020 @08:58AM
(#22019867)
Seems straightforward, all these phone companies have endless kiosks and offices. Legislate that a phone number can only be transferred by making a confirmation call to the old phone or in-person with a salesperson who is checking ID.
[ Parent
| on HN ]
In Europe, neither of these is viable without a complete overhaul.
- There are online-only providers. E.g. Giffgaff in the UK, Mobile Vikings in Belgium, etc. - Many European countries offer prepaid SIMs that aren't tied to ID. Instead, you can just buy them in the supermarket the same way like you would a gift voucher.
Re:SMS is not 2FA-secure
by ChuckNorris89 on Saturday January 11, 2020 @10:42AM
(#22020389)
On the contrary, in most European countries, due to anti terror regulations, you now need an ID to buy a SIM card or if you've bought one before this new law came into place you have to send a picture of your ID to the Telecom operator or your sim card gets deactivated.
Not saying I like this or that this is good way forward but it's a reality that contradicts your assumption.
This will do nothing to deter malicious SIM swaps. Someone who's happy to take over your number and then steal your money is also happy to present a fake ID and pretend to be you.
What kind of ID is it? A proper barcoded photo ID that corresponds to a government database? Because with that you can verify that the ID picture matches the one in the government database.
I don't live in Europe, but with Orange, I had to upload a photo of my EU passport (they didn't accept a non-EU passport to extend the lifespan of the SIM card).
Offtopic: those laws seem kind of silly if you can still get a valid SIM for 10 days without any ID. Seems more to be about surveillance than about anti-terrorism.
Assuming that ID gets logged in a database accessible to customer service people, it seems like a database check for IDs and IMEIs would be workable as a way to confirm "sorry, we can't port that number to your new SIM card, the ID card registered to its IMEI doesn't match your old phone number's ID card". You could still do it over the phone, then, since an ID was logged against your sim card when you bought it.