Slashdot Mirror
Phone Numbers Were Never Meant as ID. Now We're All At Risk (wired.com)
One key lesson from the recent T-Mobile and several other breaches: our phone numbers, that serve as a means to identity and verify ourselves, are increasingly getting targeted, and the companies are neither showing an appetite to work on an alternative identity management system, nor are they introducing more safeguards to how phone numbers are handled and exchanged. From a report: Identity management experts have warned for years about over-reliance on phone numbers. But the United States doesn't offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise. As cell phones proliferated, and phone numbers became more reliably attached to individuals long term, it was an obvious choice to start collecting those numbers even more consistently as a type of ID. But over time, SMS messages, biometric scanners, encrypted apps, and other special functions of smartphones have evolved into forms of authentication as well.
"The bottom line is society needs identifiers," says Jeremy Grant, coordinator of the Better Identity Coalition, an industry collaboration that includes Visa, Bank of America, Aetna, and Symantec. "We just have to make sure that knowledge of an identifier can't be used to somehow take over the authenticator. And a phone number is only an identifier; in most cases, it's public." Think of your usernames and passwords. The former are generally public knowledge; it's how people know who you are. But you keep the latter guarded, because it's how you prove who you are.
The use of phone numbers as both lock and key has led to the rise, in recent years, of so-called SIM swapping attacks, in which an attacker steals your phone number. When you add two-factor authentication to an account and receive your codes through SMS texts, they go to the attacker instead, along with any calls and texts intended for the victim. Sometimes attackers even use inside sources at carriers who will transfer numbers for them.
"The bottom line is society needs identifiers," says Jeremy Grant, coordinator of the Better Identity Coalition, an industry collaboration that includes Visa, Bank of America, Aetna, and Symantec. "We just have to make sure that knowledge of an identifier can't be used to somehow take over the authenticator. And a phone number is only an identifier; in most cases, it's public." Think of your usernames and passwords. The former are generally public knowledge; it's how people know who you are. But you keep the latter guarded, because it's how you prove who you are.
The use of phone numbers as both lock and key has led to the rise, in recent years, of so-called SIM swapping attacks, in which an attacker steals your phone number. When you add two-factor authentication to an account and receive your codes through SMS texts, they go to the attacker instead, along with any calls and texts intended for the victim. Sometimes attackers even use inside sources at carriers who will transfer numbers for them.
For some reason, many of the vendors all but insist I provide them my mobile phone number. I always refuse because I know that once I give out the phone number, my phone will start ringing with telemarketing calls. They vendors say they want the mobile phone number for back-up identification purposes, but I just do not believe them.
Right after he takes us to mars in his electric auto pilot flying cars launched from his boring machine tunnels and armed with portable flame throwers to fend off the martians.
All that will happen right after he secures funding and builds the $35k car he promised.
And that's caused all kinds of problems with identity theft in recent years. I'm not surprised we are making the same stupid mistake with phone numbers.
Planted no-event, non story designed to push for national ID.
Enemy spotted and destroyed.
hey, anything symantec is pushing makes me want to take my chances with my phone number! any coalition with visa, boa, and symantec scares me
Yes, it does, and it's called a passport. Each passport has a unique "book number". The US also issues "passport cards" to passport holders. This is a federally-issued, unique identification card which is considered valid ID.
We also now have Real ID, which is a federal standard for acceptable identification. Real ID-qualified identification cards by definition involve linked databases.
Arguably, however, what is needed online is a uniquely-issued cryptographic signature, which is passphrase-protected. This could actually be used to secure online communications. It could be given out by post offices, which seems logical since they are the place where most people go to process their passport application and because the post office is about communication.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
What? No, this is 1, you must want 2. 2 I say.
Phone number is annoying as hell, but at least you can't open a credit card or rent an apartment in my name with my phone number. I think it's just investors want to know your new users are real unique people, so they make you verify with SMS. Also, the cops like it so when you make a politically incorrect tweet they can kick your door down and haul you into the court of shame.
get a new one ever so often. I do that with my cell phone number.
Also, it keeps debt collectors at bay.
A personal anecdote: I have a GMail account I use at home, everything works well enough (despite the awful interface).
I sometimes want to use it at the local hackerspace, I try to log in, and after I enter my password it tells me "we don't recognize this computer, give us your phone number and we'll send you an SMS message to continue"(*).
I absolutely do not want to give Google my phone number, but there's no way around this.
My account is not compromised, I've got a respectable password, and this didn't used to be a requirement.
Basically, they've lured everyone in with a free service, and now they're drawing in other personal information in order to continue to use it. I fear that one day they will simply decide to require a phone number from my home computer, and then I'll be fucked because I will have to give it to them or else lose all functionality of GMail.
It sucks. They don't tell you how to get around it, they only give explanations of "this is for *your* security!".
Giving google my phone number doesn't increase security, but they've drawn everyone in with the free service.
(*) Also, I have no idea how they "recognize" my home computer, since I regularly delete cookies from my system and re-login. Perhaps the "delete cookies" feature doesn't do what they say it does.
Well, at least you easily can change your phone number if you need to - like an identity theft. Good luck with that if you happen to live where I live where the most common used identification number is our equalient of the American social security number. A number that is more or less impossible to change and that is considered public information by the government.
Jenny, Jenny, who can I turn to?
You give me something I can hold on to
I know you'll think I'm like the others before
Who saw your name and number on the wall?
Jenny, I've got your number
I need to make you mine
Jenny, don't change your number
Jenny, Jenny, you're the girl for me
You don't know me but you make me so happy
I tried to call you before but I lost my nerve
I tried my imagination but I was disturbed
Each passport has a unique "book number". The US also issues "passport cards" to passport holders.
I was under the impression that most U.S. citizens who do not travel internationally do not carry a U.S. passport. The United States has a lot more area in which one can legally travel on ground without a passport than somewhere like Europe, whose countries are closer in size to the several states of the U.S. So what should a service that requires a passport "book number" do for U.S. subscribers who do not carry a passport? Require them to obtain one? I was under the further impression that the cost in time and money of getting a passport just to use one private-sector service was beyond "impulse buy."
what is needed online is a uniquely-issued cryptographic signature, which is passphrase-protected. This could actually be used to secure online communications. It could be given out by post offices
But is US Postal Service enough of a private-sector company that the small-public-sector wing of the majority party currently in office would allow it to issue client certificates for citizens?
Because of the Chinese character set, most websites in China use phone numbers and SMS for logging in. This has the added bonus of tieing the account to a government tracked user as you need ID to get a phone number to begin with.
Due to my lifestyle I change phone number every 2 months so always get burned by companies requiring SMS for 2FA. If itâ(TM)s genuinely for security websites would use Google Authenticator, Authy or an RSA dongle etc.
The use of mobile is purely for marketing and tracking.
"the United States doesn't offer any type of universal ID"
Well, they do ( SSN ) but technically its unconstitutional. So would be any 'secure extension' of that.
Anyone intercepting the messages in-transit cannot learn the contents of these messages. Your public key (or rather, your ability to decrypt messages encrypted with your public key, since only you hold the corresponding private key) serves as your ID.
Unfortunately, the entire process is rather unwieldy, and you can't memorize your private key. You have to keep it written or stored somewhere, making it vulnerable to theft. (The public key can be indexed in a public database, so you can give it via an index number.) The easiest-to-use solution I've seen to the problem is Chip & PIN used on newer credit cards. The Chip stores your private key and handles the encryption and decryption. Your PIN helps to prevent the Chip from being used without your knowledge, but isn't foolproof. It hopefully works long enough for you to get a new Chip in the event you discover it's lost or stolen. In this case, the Chip would serve as your ID, and the PIN your private passcode to access the ID. Using the ID requires both the physical Chip and your memorized PIN. (The process is still vulnerable at the "replace a lost/stolen Chip card" stage - the longer it takes to confirm your ID and issue you a new Chip, the more time a thief has to figure out your PIN.)
"But the United States doesn't offer any type of universal ID"
That's intentional and even desirable. Creating a centralized and authoritative database of citizens identities is a surefire way of accelerating the surveillance state even faster than it is currently going. It also sets up a controlling authority that most likely can't be escaped and WILL be abused, for example if you become an "undesirable" all the government has to do to vastly curtail your freedoms (apartment, driving, flying, etc) is deny you an ID or invalidate your current one.
Says the anonymous coward.
It worked for Hitler.
Setting up Google Authenticator or another TOTP app requires first setting up either SMS, U2F, or Google Search prompts, and printing backup codes. From "Install Google Authenticator":
The phrase "2-Step Verification turned on" links to "Turn on 2-Step Verification", which implies that you'll need to have one of these:
A. A mobile phone to receive SMS.
B. A USB security key implementing FIDO U2F and a desktop or laptop computer running a compatible version of the Google Chrome browser. I haven't tested whether Chromium from a GNU/Linux distribution works as well or whether U2F is one of the proprietary extras included only in Google Chrome. In addition, the U2F key has to have been manufactured in batches of at least 100,000.
C. A phone or tablet with the Gmail or Google Search app installed (which works only on iOS or Android with Google Play, not AOSP alone or Windows Phone). This was introduced fairly recently, and I began using 2FA on Google once it was introduced.
You'll also need to own a second phone as a backup or a printer to receive backup codes.
You could just spend $2 a month on your own fucking email account.
>"But the United States doesn't offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise."
Well, they do, it is the SSN (Social Security Number)... which was never supposed to be or meant to be some type of general-purpose, national ID number. In any case, it is not desirable to have a national ID number, anyway. Why? Because it destroys freedom and privacy by making being anonymous difficult and encourages tracking and cross-referencing.
Biggest problem ever was when "credit scores" got linked to SSN and now businesses use that as an excuse to REQUIRE SSN for many transactions, even getting a phone, gas, electricity, mortgage. And the IRS uses for taxes, another huge mistake- so now every employer and bank and lender "must" have it. And your employer shares it with numerous insurance companies and other "partners" without your permission nor knowledge (been there, done that).
Impersonating me? Get a life already, freak!
APK
P.S.=> Unbelievable anyone wastes their life + time the way you do impersonating me & for what - Does it STOP me from posting?? No... apk
New upcoming technology is going to solve that pretty soon.
Search for "Steve Gibson SQRL" and see for yourself. I also recommend you listen to Steve on the SecurityNow podcast where he explains it.
Rejoice!!!
" But you keep the latter guarded, because it's how you prove who you are. "
nooOoo: when you type in a password, it authenticates the *username*. it does *not* authenticate the *user*.
Their main complaint that "phone number were not meant to be used as IDs" is that they are not secure and someone could hijack your number using a hacked SIM or whatever. So, instead of making the federal government blow billions of dollars creating a new ID numbers when we already have SS, not just force companies to make the SIMs more secure? This is probably Oracle backed FUD, since any massive new government database means more money for them, although IBM got the original SS contract along with other big government tracking projects like the ones they did for Hitler around the same time.
Name or Phone or Email or face or finger prints are all equal.
None are private and none should be used for any account access without at least 2 other non-public validation questions.
As someone who hasn't had a phone number for the last 15 years, I don't understand. Please explain how a phone number is a form of ID.
Impersonating APK is almost as big of waste of time as being APK. He's complete garbage and he shills harmful software in an off-topic way.
If /. admins weren't feckless losers they would have permanently banned that spammer-troll degenerate.
ZIP
P.S. => APK is the original ne'er-do-well. He serves no purpose other than to harass and annoy good people with his incessant ramblings.
It's a simple matter of Identification vs. Authorization, phone numbers (like fingerprints) are great for identification but horrible for authorization because of the ease they can be used fraudulently, i.e. generate false positives. I'm always amazed at how so many security "professionals" can't seem to grasp this simple concept.
"Grab them by the pussy" -- President of the United States of America
All those stores with "rewards" programs, tiny discounts on their inflated prices...
They sell your purchase data to marketers... Easy enough to connect ALL your "rewards" purchases, and everything else you do...
Just by the phone number
I have a mobile plan with two numbers. One is my day-to-day number, the other one - used only for authentication / 2FA / recovery purposes and only turned on when required.
this is, of course, a super-fail, as I only log in to other devices when I don't have a logged in device available. Fuck google.
User name and password are good enough. The only need for a universal id is to data mine data about you across companies. Basically so companies can sell each other data about you for money, advertising, profiling, and blacklists.
You must be a millenial, phone numbers were never uniquely tied to individual people. Early on, phone numbers weren't necessarily even tied to a single residence, or have you never heard of a party line?
A phone number is just like a snail mail or email address, it doesn't guarantee that there's only one person attached to that number and it doesn't guarantee that one person doesn't have multiple numbers. Which is terrible as a means of identification. And that's before you even start to think about spoofing and unauthorized access to the number.
When you place a call, send a letter or email, you're just directing the message to a particular place, there may be one person there or you may have to have that person direct you to the intended recipient.
SIMs are very secure. The problem is people calling up your phone company or walking into a store and saying "Hi, I'm X and I lost my phone/SIM card/etc. Could you please issue me a new one?" or the equivalent of "Hi, I'm your customer X and previously was at carrier Y and would like to port my number over." In other words, a social problem.
I get a rush of phone calls sometimes from people saying "Hey, you called me, who is this? Why do you KEEP calling me?" My response is usually dumbfounded and the conversation ends with the caller just as confused, but sometimes they get angry and say "put me on your DO NOT CALL LIST!" So my number is spoofed. Verizon tells me there's not a damn thing they can do about it. Sucks since it is a business line and I take calls from clients every day, but Verizon has their money from me (well, probably millions from my company, as we are pretty damn big) and doesn't give a flying fuck.
Chewbacon
The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
My wife's phone number got hijacked and ported to another provider.
This was used to attack the bank account and open new credit accounts.
We responded quickly and luckily our bank had very safe procedures.
But a lot of banks aren't as good. The police weren't very useful.
We now have extra protections in place.
Go well
I happily give them my phone number. I just don't answer my phone except for whitelisted numbers that have a non-mute ringtone. Solves all manner of problems. A mute ringtone is one that makes zero noise, and that's the default on my phone.
The day of unplanned voice telephone comms from random callers is past for me. You want me, then email me, or text me. We can arrange a phone call if need be; but cold calls? No. Not happening. Telemarketers and various other forms of similar lowlife have shit that bed beyond all recovery.
I don't pay any attention to voice messaging, either. The idea of someone trying leave me a voice message fills me with glee... they just spent some fraction of their life for nothing.
They may wreck texting eventually as well. But perhaps not. The same filtering that works (and very well, too) with email could work with texting. Whitelists, smart filtering... bring it on, I say.
I've fallen off your lawn, and I can't get up.
If you're an American adult with any kind of credit at all, thanks to the breach with Equifax, you're pretty much boned. Your SSN is out there, probably along with a depressing amount of other identifying information.
I really don't have a mobile phone.
What I have discovered is massive amounts of social and economic discrimination because I do not have one.
Just because I do not own a device many "free" services become unavailable to me.
Do I care, not really, because I have always seen the wolf in sheep's clothing that is the technology industry.
However I feel that many people are not aware of the problem.
Ditch your phone/s for a year and take a look.
Don't worry you will not die because you do not carry a corporate tracking beacon.
In fact you will be more free. Freedom is important to you isn't it?
my 2c
"Society needs identifiers" is double talk for "my lobby organization's [Better Identity Coalition] customers [Visa, Bank of America etc.] want the state to pick up the cost of doing our jobs.
And then later:
Taxes? NOOOOO! LEAN STATE!
Know what? Assholes. Were it to me, I'd know what to do with y'all. Expropriation.
Man, young people these days are so ignorant of history. It's really pretty concerning to those who aren't.
There is a REASON people don't want a "universal ID". And it has to do with something called "1984"
But it's not limited to 1984. Our parents (if you're older) and grandparents, and great-grandparents fought tooth and nail against any kind of Federal ID.
It's actually kind of common to think that people in the past were less sophisticated than you are, and therefore not quite as bright. In simpler terms, many people seem to fall into the trap of thinking people generations ago as not ignorant (compared to today's knowledge), but actually stupid.
That's a mistaken viewpoint.
There is a reason Social Security was never allowed to pass, unless it was promised that the Social Security number would NEVER be a "federal ID".
And the promise was made, and Social Security passed.
And years later, the government made SSN a valid ID for national credit companies. In other words: betrayal of their promise.
Better wake up, people. I984 is looking you in the face. Right now. If you don't see those encroachments coming down on you, in the name of "convenience", you're just naive.
I have the Google Autenticator for my SSH logins.
This is what I did:
1) Down load the app.I use the one from LastPass, not the one from Google
2) Follow e.g. These instructions. It basicaslly means you install libpam-google-authenticator, configure 2 files and run google-authenticator
3) ssh and it will ask me for the autenticator. No network needed.
I use the same app for Amazon.
Don't fight for your country, if your country does not fight for you.
Why should anyone care?
You need to track connections, accounts, logical device interfaces and logical user instances, but not physical people or physical things. Even a license plate just correlates a registration of a logical notion of a car with a registration of a logical notion of the owner. Not a physical thing.
The physical world is not related to the logical world. You don't need to track physical people and there need not be a 1:1 relationship to logical data. So a logical person entity can be multiple physical people, and a physical person can have multiple logical person entities.
As long as what is needed is present, that's fine. It's also more secure.
We can dispense with the idea of individuals, at the data level, eliminating the need for IDs that correspond to specific things in meatspace.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
[A TOTP app is] not tied to your phone number any more than Google Maps is.
First, Google Maps is in fact tied to your phone number. The Google Maps app requests permission to "send SMS messages", "directly call phone numbers", and "read phone status and identity".
Second, as I wrote in another comment, Google considers TOTP secondary. A Google Account holder must first set up 2sv through SMS, U2F, or Google Search prompts before setting up TOTP, and two of these three options are tied to either a cellular plan or a mobile device running iOS or Android with Google Play.
"But the United States doesn't offer any type of universal ID"
Why on earth would I WANT a universal ID system. Who does that benefit? NOT the consumer, NOT the average person in society. While the lack of one might be some inconvenience, and it certainly increases the chance of crime. The social and political cost of making it easy for any political group who takes power to track everyone and anyone they 'don't like' and to IDENTIFY them easily is not worth the convince. The reality is that sometimes in order for society to progress there needs to be political and sometimes even physical upheaval, but creating a system where each person can be uniquely identified at any given point is 90% of the way to solving the problem of complete and absolute control of actions ( if not thoughts) of an entire society. It is the antithesis of freedom.
Who does it benefit? Not small business who actually meet and know their customers, NOT people working and relating to other people, it befits primarily LARGE and or remote corporations who have no other way of establish trust.
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
I am stupid and I smell my own farts and eat my own poop...apk
"As cell phones proliferated, and phone numbers became more reliably attached to individuals long term"
In the USA maybe.
In other parts of the world people have multiple mobile numbers or dump them every year or so with a change in contract.
As a reliable identification method they were always questionable and showed a marked US-centricism in software that was clearly broken from the outset.
The article seems to be more about pushing a solution of a central ID system as a presumed solution to the identity theft problem, even though it was the requirement that SSN's be associated with financial accounts that began the whole problem. Specifically:
"But the United States doesn't offer any type of universal ID, which means private institutions and even the federal government itself have had to improvise."
What's needed is better anonymity not increased centralized identity. On top of that, to the extent identity is needed, it should be more complex and IDs should be unique from one entity (e.g., bank) to another. If there is any centralized requirement, it should be identity policy and protocols, not the identity!
While it is true that authentication becomes an issue you can avoid despite an identity being public, the proliferating of common identities such as SSNs seems to be a catalyst for identity theft. The last thing I want is another government issued identity I cannot change or revoke that all my valuable assets become tied to.
Did anyone else catch this bias?
The best way to protect our assets is through anonymity. No one who steals identifying information such as SSNs, birthdates and phone numbers should be able to locate and steal the assets belonging to that person. A Universal ID helps thieves, not us.