Leaked phone number of Mark Zuckerberg reveals he is on Signal

Re:Leaked phone number of Mark Zuckerberg reveals he is on S... by dexen on Tuesday April 06, 2021 @05:50AM (#26709980)

Privacy flaw and a security flaw: it is feasible to take over somebody's phone number through social engineering attack on the phone co's tech support. The tech support has ability to issue replacement SIM cards for users, and if an attacker socially engineers them to send SIM card with your number to them, it's a game over for you.

That is aside of the obvious problem of phone numbers being recycled for re-issue after having been abandoned for a stretch of time.

[ Parent | on HN ]

Re:Leaked phone number of Mark Zuckerberg reveals he is on S... by gaius_baltar on Tuesday April 06, 2021 @10:29AM (#26712177)

Not exactly a security flaw, as the new owner of the phone number won't have the original owner's secret keys (they never leave the phone, of course) and Signal will still send the messages to the previously authenticated client.

Taking over a Signal account requires access to the phone number and the password used to register it (or waiting a week). And this will still not give the attacker access to the private keys; When these keys change, Signal will put an alert message on ongoing chats and ask for confirmation.

[ Parent | on HN ]