So don't do that. Always carry some cash and your debit and/or credit cards. Spread out the risk (especially when travelling).
> you lose access to your email/bank/github/etc. accounts protected by 2FA so you may not be able to work;
So don't do that. If you enable 2FA, have backups and recovery codes. Assume the phone will get lost at some point.
> you may lose your airline/train tickets (unless you have a physical copy with you) so you may not be able to travel.
So don't do that. When travelling I always take the printouts of the tickets along, even if I end up not needing them.
Don't turn your smartphone into your everything. Treat it as a tool which can get lost, stolen, or broken.
As an extreme example, my previous workplace had a "smart" lock on the door that could only be opened with a bluetooth-enabled smartphone and a dedicated app. It was immensely dumb and everyone hated it, but the owners thought they could save on keycards by doing this and so they did, because every employee had a smartphone anyways.
There is a massively more inconvenience (cost aside again) in having your phone stolen versus your car. It could upend your life a lot worse than having your wallet or laptop stolen as well.
There are only so much things we can expect from the average consumer and theft of a phone massively changes that persons life.
I’m for increasing the resources put into specifically phone theft.
My laptop was stolen from the airport (inside security!) and I had needle like precision with where the cops could find it. Nothing was done and I simply got back the insured value for it and the items with it. It put me out of work for the trip I was taking but I’m not your average consumer and everything was backed up and I did still have my phone. If my phone had been taken and not on me I would have been in a much larger world of pain (though I have backup codes, etc.).
Arguing for laws that are "tough on crime" is regressive and doesn't even solve the actual problem.
However, what would actually be nice if, like people here have suggested, is that the police would actually bum off to retrieve stolen phones, bikes, etc and then deliver whatever appropriate penalties to the perpetrators if found.
Doesn’t matter if it’s only a small punishment so long as people get their stuff back and the thieves learn they’ll be sought after.
So basically, we don’t need better laws here, simply enforcement of them.
(I think using this argument to justify being soft on crime is ridiculous. I'm just pointing out what the argument is.)
This is the actual problem. Theft is also a problem, but not all that relevant.
"Tough on crime" doesn't really prevent crime when the incentive to commit it is still probably higher than the disincentive no matter how "tough" and getting caught is still unlikely.
A trivial, but more relatable, example of this line of (criminal) reasoning is that people are more likely to enjoy extreme sports vs a high paying "dangerous job" despite working the job being less lethal, less accident prone, and a much greater net positive.
Anyway the regression is adding unnecessary laws.
That's an argument for a phone not being the best 2FA mechanism. The argument for phones as 2FA isn't predicated on them being optimal, it's predicated on them being (1) present in almost all cases and (2) easily used.
Obviously yes, it would be safer if we'd all carry around password-locked yubikeys. But we aren't going to. We do have phones in our pockets, though.
We're talking about the case where the phone is stolen. There's almost no reason to steal an authentication device other than harassment or tactical delay of access.
There are definitely tough on crime laws that would solve or mostly solve the problem. Unfortunately these will mostly be cases of the cure being worse than the disease (e.g. panopticon with facial recognition and use of face coverings leading to jail time).
Same for bike theft…
If they stand there, looking like a drug dealer, and you ask… all good.
If they ask you if you want coke, entrapment.
I'm not sure it's as cut and dry as that, but the gist is "would you have committed the crime regardless of the actor's behavior."
In the 80s and 90s bait cars were ubiquitous in cities https://en.wikipedia.org/wiki/Bait_car
Not necessarily. Even if we didn't catch any more criminals than we do now, you could probably reduce the problem a lot just by making sure the ones we do catch actually go to jail.
Yeah. Or the inclusion of accurate GPS trackers in each and every phone, so law enforcement could track them down. That would be truly dystopian!
> compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication.
For goodness sake, push back! I didn't even allow for the presumption I have a phone to read QR codes for restaurant menus, because of where I saw that was heading. Never allow anyone or any place to presume they can rely on your smartphone for something they should be responsible for.
I noticed places I work for started to try this, and put a stop to it right from the beginning by asking if they were going to start paying for my phone contract, and buy the phone from me, so I could buy another private one. Putting it in black and white makes it clear what's going on; which is work trying to get (a) free hardware, services, and (b) free work out of hours.
A phone at least has the benefit of being backed up. In theory, I could log into a couple accounts on a brand new phone and have access to everything within tens of minutes. Contrast to the hours of phone calls and weeks of waiting it takes if I lost my driver's license, passport, etc.
And though a phone can be used for payments, it must be unlocked. Not true of the physical credit/debit cards (swipe or tap) or cash found in a wallet/purse.
If you have non-backed-up 2FA tied to your phone, you should fix that. Batteries die, and phones can be physically damaged, bricked for some software reason (they're computers, after all), dropped into the ocean or off a cliff, or just legitimately lost (ie: falls out of pocket into the cracks of a car seat and battery dies).
I won't weigh into the punishment-deterrent argument at all, I'm merely pointing out that in theory there's actually a lot less disruption having your phone stolen vs having a wallet/purse stolen. Both suck, of course. Replacing a phone is almost certainly more expensive, but it should be significantly faster to recover from. And backup your 2FA.
Which is becoming less and less often in my experience. I was recently at an event that used SeatGeek for ticketing, and the only way they'd give you tickets was digitally through an iOS or Android app.
- I have a cellular equipped Apple Watch and iPad that both independently get regular SMS messages along with my phone.
- I can sign into my Mac and get text messages.
- I have a second wallet in my bookbag with a few lesser used credit cards, a little cash and my passport card for ID
- my wife is my backup recovery source if I get locked out of my account.
Doesn't this actually depend on relaying the SMS from the phone? I don't think delivery works if your phone isn't in range of the laptop.
Even the watch seems to require the relay to work for receiving [1]:
> To receive SMS, MMS, or push notifications from third-party apps on your cellular Apple Watch, your paired iPhone must be powered on and connected to Wi-Fi or cellular, but it doesn't need to be nearby. You also need to be signed in to iMessage on your iPhone to use Messages on your watch.
The worst part is, I know this is a terrible idea, and yet I carry all my eggs in the very same basket.
At least I've had the good sense to leave my physical driver's licence in the car I use 99% of the time after we got a driver's licence app - I can now simply show the police my cellphone with a QR code and a control animation on it, and they can verify my licence class and expiry date on the spot.
I wonder if apps like Microsoft Authenticator are better for this. They sync 2fa codes to your Microsoft account. Naturally, the question becomes "Doesn't that make Microsoft a single point of failure? If someone know's your Microsoft password, they can get into your Authenticator and all your other accounts basically don't have 2FA anymore"
From what I can tell it doesn't look like Microsoft has an answer to this, unless there's something obvious I'm missing. On the bright side, though, if you lose your phone, your 2FA codes aren't lost.
Choices, choices.
This seems like a large amount of trust to be placing in Microsoft, since anyone with access to your account would also have access to your shared secret for every site. I would wager that they also would have access to your communications medium and password stores as well, in most cases, since you'd likey have bought in to the wider ecosystem.
Or do they encrypt it client side?
The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)
The Authenticator apps store keys in Secure Enclave (or at least I hope so). Which in themselves are 2fa by not being copyable thus requiring direct access to unlocked phone before using.
Of course that also comes with bigger risk of you locking yourself out, by forgetting Lock Screen password or phone getting bricked for some stupid reason. Printed paper don’t have that problem, except can also easily be lost.
Maybe it’s time for more severe punishments for phone theft? The slap on the wrist thieves get today doesn’t seem like much of a deterrent, especially compared to the outsized harm this kind of crime causes to the victim as we rely more and more on smartphones for authentication.