Slashdot Mirror
US Carriers Introduce Project Verify To Replace Individual App Passwords (theverge.com)
Four major US carriers -- AT&T, Sprint, T-Mobile, and Verizon -- are joining forces to launch a single sign-on service for smartphones. From a report: The service, called Project Verify, authenticates app logins so that users don't need to memorize passwords for all their apps. The companies say their solution verifies users through their phone number, phone account type, SIM card details, IP address, and account tenure. Essentially, your phone serves as the verification method with details that are hard to spoof. Users have to manually grant apps permission to use Verify, and it works similarly to how you might log into some services through Gmail or Facebook instead of using a unique account password. Of course, these apps also have to choose to work with Verify, and the program hasn't listed any partners or when it intends to launch. The service can serve as your two-factor authentication method, too, instead of an emailed or texted code that can be intercepted. Users might not be totally safe if their phone is stolen. The Verify program automatically logs users in, so long as they have access to their phone's home screen and apps. More details on Krebs on Security blog.
All those are identification, not authorization. They can replace username only. The same as biometrics. Not only they do not verify and intent, they do not allow for distinguishing if the user is real. If I get your phone, I am you...
Moronic.
You can't substitute a machine identity for the user identity. These are two complete distinct identities.
The moment US mobile carriers are able to positively identify individuals by their mobile devices is the moment they resell user data to advertising affiliates.
blog
So long as the usage of this is not mandated by the government — neither directly nor indirectly, such as, for example: "must sign up to get unemployment benefits" — it is Ok. May be a good thing even.
In Soviet Washington the swamp drains you.
So, a one stop-shop for data compromise then? Awesome!
You mean those surveillance programs that require nigh-on full access to everything on your phone for no reason whatsoever?
US Carriers (and US Spy agencies): Please give us access to all of your data whenever we feel like we need it (or want it).
Encryption.....sure.....go ahead!
For the same reason the ubiquitous Facebook and Google login integrations exist, the only purpose of this is to track what apps you're using and when, and do we really trust they won't also know what you're doing in them? If they have the authentication, they have everything.
12:50 - press return.
gets access to my home screen they can open any App I have linked to this "Verify Program" without knowing the individual password for said account. This must be a new feature for criminals and governments, not a bug.
"The Verify program automatically logs users in, so long as they have access to their phone's home screen and apps."
I'm going to go ahead and... uh... disagree with you there...
I'll stick with my password manager thankyouverymuch.
I'm sure 5 years from now Amazon and Google will join forces to help me secure my house by "securely" storing my digitial keys to my house and only unlocking it with my phone making me oh-so-much more secure.
US carriers are Nimitz, Dwight D. Eisenhower, Gerald R. Ford, etc.
Oh, hell no ... because somehow there is the assumption you should be trusting the assholes at a cell carrier.
No, sorry, you don't get to be the gatekeeper for my authentication.
Sorry, they're just trying to grab more control, and there is no way that should happen.
With this, they could login to any account they want, because they pretty much have everything they need to.
And, I'm sure they'd never do anything like access your account for marketing purposes ... nosiree.
This is just a bit fat 'nope'.
Those helpful souls at AT&T, Sprint, T-Mobile, and Verizon don't want to see you bothered by those troublesome passwords any more, so now they'll take care of all that for you.
Aren't they nice?
You are welcome on my lawn.
All that info can be spoofed with off the shelf equipment and a few kiddie scripts. I don't see this being the most secure thing. And if the phone can be unlocked by force (fingerprints) or otherwise then all those apps are unlocked as well. No thanks.
Haven't we already discovered that SMS was an insecure 2FA method because carrier customer service can trivially be convinced to switch someone's phone number to an arbitrary SIM. Wouldn't this attacker then be able to use their phone with Verify.
Isn't that what would happen if someone steals your phone with this type of authentication? Dumb as dirt question I am sure, but still want to know the answer.
Anonymous comments are as pathetic as the anonymous "sources" that contaminate gutless journalism from the New York Time
I'll keep using my inexpensive unlocked phone, and change it, and the carrier, whenever I like. Thanks all the same.
I'll bet they market it with the convenience of using the various *Pay apps.
They can kiss my ass.
So when your SIM card changes do does it count as new identity and do you have to re-authorize applications to use the new identity? The summary lists "SIM card details" as a factor, but doesn't specify if the changing of a SIM invalidates exiting identity / registrations with applications. This is important because without it, you still have the issues of social engineering attacks where the attacker calls up the phone company and says "I have lost my phone, can you activate my replacement phone with this new SIM?", granting the attacker access to your email, text messages which also grants the attacker access to your second factor and password reset procedures.
Setting aside the scary privacy and tracking implications of a common ID baked into the phone, if the identity is locked to the SIM, it would help alleviate the social engineering attacks and make your phone a viable second factor for security operations.
With the current track record that carriers have of not properly authenticating people who call in or visit cell phone shops to transfer a person's service to another SIM in order to steal 2FA i give this a big HELL NO!
What a coincidence that list is so full of information I'm unwilling to give them. It's as if getting that information was their primary goal and replacing passwords was just a pretext.
Tails Linux OS. Fuck you, big money.
It is a sound choice to trust American companies! Look, they are not Huawei or Kaspersky.
The same companies that sell our data by default and give out our data to government agencies without a warrant want the ability to log in as us at any time.
Greaaaaat.
I would offer up my left nut for a suitable technology that basically provides, âoeIf I am logged into my phone, I am logged into the apps on the phoneâ.
The servers will be maintained by the NSA so the cost to the carriers will be minimal.
Anytime competing companies come together, put your tinfoil hat on....cause it isn't just divine inspiration that they all want "what's best for the consumer"
das drumpfenfuhrer will save you! he likes bigly and wet!
They can seriously go fuck themselves. How many data breaches have they had?
https://xkcd.com/927/
SJW: Someone who has run out of real oppression, and has to fake it.
As much as I like the idea of a single login for convenience, it also means there's a single point of failure which I absolutely do not like.
Did you just say that? Carrier's bill by the byte, you don't think they know where u have been? Foolish child...
I was expecting a list like Nimitz, Eisenhower, Vinson, Roosevelt, Washinton, Stennis, Ford, Truman, Reagan, Bush....
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
... and we had no use for this.
The Navy band was great, though.
It little behooves the best of us to comment on the rest of us.
Just use 1password everywhere. I've used it since 2010 and it works beautifully on phones
So now I just have to hack one place instead of four. Thank you!!! I mean seriously... all the carriers have been hacked at one point or another, some multiple times. So now we're going to collaborate (while we argue over standards) so whomever can hack me more easily. *sigh*
Where is "the apps guy" ???
I thought he'd be all over this one.
Yes, save the americans and forget the rest. Nothing else is happening in the world.
'Nuff said.
Will never be used by me, and forcibly removed from any device I use, if it cannot be removed, the device will be destroyed.
Hah - captcha karma does exist "protests"
I am sure it will be handled just as well as Puerto Rico.
Oh, wait, they are Americans.
I'm a good cook. I'm a fantastic eater. - Steven Brust
I don't even want to think about it.
Access to your phone grants access to all your accounts. Just great.
It must have been something you assimilated. . . .
It's not even as good as a password.
These clowns can't even figure out how to use a three-way handshake to verify Caller ID and we're supposed to trust them with authentication that supplants passwords?
Maybe I'm missing something, but if one gets hacked?
I buy prepaid SIM cards when I travel as it's a lot cheaper than buying an international travel plan/allowance from an American carrier. With this system in place I wouldn't be able to access any of my apps or accounts.
I'm pretty sure the execs are rubbing their greedy hands together with sly smiles expecting us all to get even more locked into our overpriced American mobile service plans, which will become more expensive once this identification mechanism achieves general acceptance.
Think globally but act within local variable scope.
Puerto Rico was a hell hole before the storm and is still a hell hole after the storm. The only thing that can change that is the attitude of the people who live there. The libs love to blame all the problems on GOP presidents. Hillary lied and people died!
Classic misdirection.
Blame the child for the parents' shortcomings.
Imagine for a moment that you used this service. Now imagine decided that you cannot access your accounts unless you pay more $. If you dont pay up, you loose access to everything. This is literally getting the carriers permission to access YOUR accounts. Does that sound even remotely sane?
Puerto Rico was never a hell hole. And it's the responsibility of the US Federal Government for any repairs or maintenance.
This is, if anything, an even worse idea than biometrics. Many commentators have already pointed out the obvious tracking and privacy issues but what about something more basic? This is about controlling access.
I don't mean controlling access as in making sure it is you or someone else. I mean controlling access to the web, to cloud based services, to computers in general. For now this is an "option". A few years from now, it will be highly recommended, a few years after that it will be mandatory and unless you are a customer of one of the big companies, you won't be able to use any app or access the web in any way. You will HAVE to possess a phone and a customer ID with one of them in order to do anything.