Re:How to bypass Sprint/T-Mobile 2FA in under 5 minutes
by dataflow on Monday August 23, 2021 @10:02PM
(#28284361)
> I have yet to encounter any real solution to this problem
I can think of a number of solutions. One of them might be taking advantage of timing + an external contact:
0. Require a point of contact upon signup.
1. If any change requires bypassing ordinary authentication, ask contact to approve.
2. If they approve within M minutes, authorize.
3. If they don't reply within H hours, authorize.
4. If contact rejects operation, then deny.
5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context).
(You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)
I can think of a number of solutions. One of them might be taking advantage of timing + an external contact:
0. Require a point of contact upon signup.
1. If any change requires bypassing ordinary authentication, ask contact to approve.
2. If they approve within M minutes, authorize.
3. If they don't reply within H hours, authorize.
4. If contact rejects operation, then deny.
5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context).
(You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)