News for hackers. Stuff that matters.
Re:Google is going to turn on 2FA by default by forgotpwd16 on Saturday May 08, 2021 @07:29PM (#27091757)
In my country I've been required to go with my ID to a carrier shop to get a new SIM. How does that work elsewhere?
Re:Google is going to turn on 2FA by default by tialaramex on Sunday May 09, 2021 @02:10AM (#27093653)
Even if your carrier actually enforces such a policy, the actual implementation is trusted to that part-timer on minimum wage you showed the ID to. They push "OK" on the ID check step, and it's done.

What do you suppose happens when the hot guy in the club who bought them and all their friends a round of drinks says they can make a month's salary in ten minutes if they allow a few of his mates to skip that "annoying" ID check?

And I'm sure that afterwards, once the carrier figures out who was responsible, they'll get fired. But meanwhile your accounts were taken over and leveraged for some scam or (if you own "cool" things like a short Twitter handle or that rare drop in a video game) sold to the highest bidder.

Re:Google is going to turn on 2FA by default by ztcfegzgf on Sunday May 09, 2021 @02:40AM (#27093781)
you do realize that the same can be done for a bank-account, right?

at the end of the day someone is sitting at a computer and given an id-card from a stranger and clicking the "yes, i verified their id card".

Re:Google is going to turn on 2FA by default by tialaramex on Sunday May 09, 2021 @08:13AM (#27095352)
The bank account is the responsibility of the bank, the employer of these "strangers" you're talking about.

Whereas, of course, the reason we're discussing SIM attacks isn't that some bad guys might use your monthly download credits, or make a phone call that you pay for (the phone company would of course undo these charges once it was apparent that their employee caused the problem) but instead that this can be leveraged to gain access to all sorts of accounts your phone company has no responsibility for whatsoever.

The security was totally appropriate for the scope in which it was intended to be used, but that doesn't make it magically appropriate for all possible scopes.

Re:Google is going to turn on 2FA by default by reaperducer on Saturday May 08, 2021 @07:54PM (#27091900)
In some countries you can buy a SIM card, or even a dozen SIM cards, with no more hassle than buying a loaf of bread.