News for hackers. Stuff that matters.

Nullificus

Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @05:36PM (#34179035)
I will reach out to CSE and CCTS when they open as well.
Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @05:34PM (#34179011)
There's no timing limits but your own, the only limit I could note is 10 per code. You have to guess a lot, but you don't get stopped. There's also nothing you can do as a target, even if you know you're a target. Support cannot disable your account.
Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @04:52PM (#34178533)
I worked with the Office of the Privacy Commissioner of Canada(OPC) on this a few years ago. I don't have credentials and that's enough for them not to take it seriously.

I'm the only reason the 2FA is there. That change was the only change they would commit to. A few days ago is the first time since that I've logged into my account.

I'm planning to contact the Competition Bureau tomorrow with the information. They are currently looking at Freedom's viability under a significantly less powerful company than Shaw Communications Inc.

Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @04:24PM (#34178184)
Getting the correct phone number and pin combo is step one. That's the four digit pin.

Step two is as many tries at the 2FA as you would like. The format is 0#####. It will take some time for sure, but you get to control the phone number as your prize

Alternatively, the 4-digit pin is the security for their support line. You can obtain that without guessing the 2FA. Social engineering takes care of the rest.

Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @04:15PM (#34178046)
It's a five-digit pin you can guess at infinitely.
Re:Freedom Mobile's 4 digit password limit on Thursday December 29, 2022 @03:17PM (#34177362)
It's clear I don't know how to handle this. I'm hoping someone here can pass it along to the correct people and have them actually listen.

Is a 4 digit password with a predictable username secure?

There is a company I am with that has decided to keep my personal information (Full Name, Phone number, Email, DoB, Address, Full phone history, and billing information) behind a web system protected by only a 4-digit PIN.They can't remove this information for 45 days. They can't disable the PIN access.My complaints are met with "This is a standard and secure system"I think that maybe if I show...

( Read More... | 1 comment | 2 points | on HN )