News for hackers. Stuff that matters.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @01:17PM (#32279538)
Hey - That's me. you're right - We're a Secure MVNO. I'll look into the about us page.

We're a MVNO that guarantees protection against SIM Swap . We've additional protections but not able to offer it to public yet.

Re:Show HN: Doxx Me – See how doxxable your phone number is by woodruffw on Friday July 29, 2022 @01:23PM (#32279613)
Thanks for responding, and for looking into it.

I don't mean to make too fine of a point from it; the combination of missing pages and slightly "off" formatting (mixed capitalization of the company name, other company logos embedded without rounding or blending) sets off my phishing alarm.

Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @01:38PM (#32279783)
Actually you're right in questioning the legitimacy . Will get them fixed. 404 error is now gone
Re:Show HN: Doxx Me – See how doxxable your phone number is by sosodev on Friday July 29, 2022 @02:46PM (#32280422)
Why does your landing page say "100% guaranteed protection" and then follow it up "$5 million in insurance against losses due to SIM swaps"? It directly undermines the 100% claim.
Re:Show HN: Doxx Me – See how doxxable your phone number is by randomguy0 on Friday July 29, 2022 @03:00PM (#32280573)
Because “100% guarantee” doesn’t actually mean anything i.e. they have protection in some shape or form.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:14PM (#32280709)
It's just an additional protection top for peace of mind.

It's like We guarantee it and you get upto $5M

Re:Show HN: Doxx Me – See how doxxable your phone number is by googlryas on Friday July 29, 2022 @02:58PM (#32280550)
It sounds like they're giving a $5M guarantee that you won't be sim swapped.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:16PM (#32280730)
it's additional protection and helps with the liabilities

When I was SIM Swapped 4-times, I only got a courtesy call saying Sorry for the inconvenience caused.

I thought having $5M Insurance on top of guarantee will be better

Re:Show HN: Doxx Me – See how doxxable your phone number is by aaaaaaaaata on Saturday July 30, 2022 @04:15PM (#32289892)
Will you pay out in the event that SS7 is compromised, as opposed to your support people giving the swap to a random attacker?

I think this is cool, but also think it's important to be clear what's being offered.

Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Sunday July 31, 2022 @01:37AM (#32293472)
We do have SS7 level protection but we're unable to offer it to consumers.

About insurance, it's limited to Sim Swap/Port outs

Re:Show HN: Doxx Me – See how doxxable your phone number is by aliqot on Friday July 29, 2022 @01:22PM (#32279600)
> guarantees protection against SIM Swap

Not from a marketing standpoint, but from a procedural level, how is this guaranteed?

Re:Show HN: Doxx Me – See how doxxable your phone number is by woodruffw on Friday July 29, 2022 @01:24PM (#32279627)
I also have this question. My understanding of SIM porting (the legitimate form of swapping) is that it's basically impossible (and undesirable) to prevent if the originating network operator is convinced of the user's identity, which is why phishing is so effective.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @01:40PM (#32279804)
It's just a specific set of procedures that we follow which are skipped by traditional carrier. Think of it as a boutique approach. Every carrier can frankly stop but it's not worth the effort for them due to scale they operate with and mass market they've to cater to
Re:Show HN: Doxx Me – See how doxxable your phone number is by dvtrn on Friday July 29, 2022 @02:14PM (#32280133)
It's just a specific set of procedures that we follow which are skipped by traditional carrier

Are you able to go into detail about this without giving up proprietary/secret sauce? Asking as a former pbx engineer at a couple of CLECs who is intimately familiar with the LNP process.

Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:02PM (#32280608)
Sure absolutely. So about Sim Swap, if some one request we've an internal process to verify - For external ports, a carrier can reject a port out . Just having the right info doesn't qualifies for automatic port out. Most of the companies do it due to FCC requirement of 4 hours. We've the resources to identify, reject and approve requests
Re:Show HN: Doxx Me – See how doxxable your phone number is by e-clinton on Saturday July 30, 2022 @07:34AM (#32286010)
Maybe you’re new to HN, but this response should’ve been numerous paragraphs long going into excruciating detail about what how exactly the guarantee works. Additionally, there are basic English typos in your response.. as CEO of a phone company, you want to come off more polished and “on the ball”, else you will have a difficult time building trust.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Sunday July 31, 2022 @07:50AM (#32294929)
English is my 4th language, but this isn't an excuse for typos, so I'll be more careful.

So to answer the original question on how we can guarantee while other carriers are not. There are two common attacks to compromise your account.

Sim Swap & Port out

In Sim Swap, any employee person can replace the SIM Card without permission by changing the number on the dashboard. Every primary carrier SIM card is available online, so criminals buy 100s of them and then rent logins to change this information. These logins are available for as little as 10k from the dark web.

The port-out attack is when criminal changes your carrier, which requires your account #, Zip Code & PIN in a few cases. Other information can be fake, so it isn't required. Port out must be completed within hours, and carriers have automated the process.

So how does Efani guarantee against it? I've been a victim of SIM Swap and have dealt with hundreds of incidents. No one is perfect, but we're just better at dealing with such attacks.

We authenticate clients using multiple ways and treat every request as fraud. It isn't an automated process & even within the company, it's taken very seriously and has to be approved by multiple resources. Our authentication methods include notary public and video authentication, and clients can also request a unique authentication process. We employ US Citizens who're security cleared and don't outsource support or operations. A lot of our staff isn't public due to security reasons. They are well paid compared to regular CS staff and are well-trained against these attacks. Our SIM cards are not publicly available, eliminating the risk of anyone obtaining them. Information on the account is pseudonymized, so if a client has compromised himself, we're able to stop the impersonation. Cool-off period - In case of high risk, we put a 14-day cool-off period to any request to ensure the client isn't compromised

We follow a few other methods in addition to the above and constantly. We've been able to stop all the attacks so far and are confident in our ability to deliver on the promise; Efani Secure Mobile is also securing clients with $5M Insurance. If you ever get compromised, you'll receive an apology, so we went beyond to ensure peace of mind.

Please let me know if further clarification is required.

Re:Show HN: Doxx Me – See how doxxable your phone number is by aliqot on Friday July 29, 2022 @02:16PM (#32280149)
I appreciate the response, however it is quite vague, and I'm not any closer to a conclusion than when I asked. Would a yes/no type of question get a more straight forward answer?

Have you had a user get swapped, yes or no?

Guarantee is a word that has weight to it, I'm not seeing anything substantiating a guarantee other than the claim. I'm trying to understand the spirit of its use in this context by asking this.

Re:Show HN: Doxx Me – See how doxxable your phone number is by LinkLink on Friday July 29, 2022 @02:40PM (#32280367)
For a mobile carrier to prevent sim swapping assuming they themselves have good enough security policies, is trivial. Most people get sim swapped bc an insider rep sends a request to a local store, or a local store doesn't do their due diligence, or even more likely, that everyone involved is incompetent, overworked, and doesn't care.

The real service being sold here is the idea that in exchange for a premium, a company will train employees correctly and enforce strong security policies. which would be skipped by a normal telco because they want as much profit as possible off the top of your 30$ a month.

Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:05PM (#32280628)
Yeah and that's exactly what we do. We do have enterprise and gov offering with advanced protection but general public isn't the right candidate for that .
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:04PM (#32280621)
No since inception, we had ZERO clients SIM swapped or ported out without authorization. We've a $5M Insurance policy just if incase but luckily never had to use it
Re:Show HN: Doxx Me – See how doxxable your phone number is by budgi4 on Saturday July 30, 2022 @01:14AM (#32284440)
Have you prevented any sim swap attempts?
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Monday August 01, 2022 @05:07PM (#32312042)
At least few dozen and multiple cases where legal notices were sent to claim ownership of the numbers by 3rd parties such as spouses or hostile take over of exotic numbers
Re:Show HN: Doxx Me – See how doxxable your phone number is by adrr on Friday July 29, 2022 @02:49PM (#32280450)
Company doing the SMS/phone verification can lookup to see if the number was recently ported is the only protection that I know. You used to be able go ping E911 location but they cracked down on selling that data.
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:17PM (#32280736)
E911 location tracking is still active unfortunately. We've came up with the solution through our premium offering Black Seal Protection but fairly limited to who we can sell it to
Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @01:42PM (#32279824)
We follow a 11-layer authentication process to block any fraudulent request
Re:Show HN: Doxx Me – See how doxxable your phone number is by snoopy_telex on Friday July 29, 2022 @02:14PM (#32280132)
Can you describe the layers?

I mean, layers could be as simple as:

1. Does last name match?

2. Does first name match?

3. Does middle name match?

4. Does name suffix match?

5. Does country match?

6. Does state match?

7. Does city match?

8. Does street match?

9. Does house number match?

10. Does apartment number match?

11. Does phone number match?

Re:Show HN: Doxx Me – See how doxxable your phone number is by ahaseeb on Friday July 29, 2022 @03:06PM (#32280639)
It's much more than that . It's a manual review and we've our own set of authentication which includes notarization even