Number port-our attack protection?

Forums › Spark New Zealand › Number port-our attack protection?

RickD

240 posts

Master Geek
+1 received by user: 6

# 251296 18-Jun-2019 07:18

I read the story below this morning and was wondering what protection Spark has against numbers being ported-out by scammers?

https://www.zdnet.com/article/sim-swap-horror-story-ive-lost-decades-of-data-and-google-wont-lift-a-finger/

freitasm

BDFL - Memuneh
63883 posts

Uber Geek
+1 received by user: 14346

Administrator

Trusted

Geekzone

Lifetime subscriber

# 2259900 18-Jun-2019 07:22

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

Sharesies investment funds | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) | Honeyminer (1000 Satoshi signup bonus)

My technology disclosure | Digital Transformation | Enterprise Content Management | Customer Relationship Management | Data Insights, Business Intelligence and Advanced Analytics

sudara

2 posts

Wannabe Geek
+1 received by user: 1

# 2260790 19-Jun-2019 11:10

One person supports this post

I recently ported my number from 2degress to Spark.

For them to port it, they needed my account number from 2dgrees (Pay-Monthly) or need the SIM number printed in your older SIM card (Pre-Paid).

So as long as that information is secure, I don't think anyone can port your number.

RickD

240 posts

Master Geek
+1 received by user: 6

# 2271728 8-Jul-2019 10:54

freitasm:

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

I have prepaid so good to know, thanks. I use Authy/Google Authenticator for 2FA, but have my 027 as the backup on my Google account and a couple services that only have SMS 2FA like Twitter.

freitasm

BDFL - Memuneh
63883 posts

Uber Geek
+1 received by user: 14346

Administrator

Trusted

Geekzone

Lifetime subscriber

# 2271729 8-Jul-2019 11:00

RickD:

I have prepaid so good to know, thanks. I use Authy/Google Authenticator for 2FA, but have my 027 as the backup on my Google account and a couple services that only have SMS 2FA like Twitter.

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

Sharesies investment funds | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) | Honeyminer (1000 Satoshi signup bonus)

My technology disclosure | Digital Transformation | Enterprise Content Management | Customer Relationship Management | Data Insights, Business Intelligence and Advanced Analytics

RickD

240 posts

Master Geek
+1 received by user: 6

# 2271786 8-Jul-2019 12:08

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys.

I must be a few years behind... need to update that now.

hairy1

2828 posts

Uber Geek
+1 received by user: 403

Trusted

Lifetime subscriber

# 2271810 8-Jul-2019 12:38

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

I also use Authy. Mauricio, how do you use the Yubikey alongside Authy? Is to open Authy or in place of Authy at times?

Cheers, Matt.

My views (except when I am looking out their windows) are not those of my employer.

dellor

17 posts

Geek
+1 received by user: 8
Inactive user

# 2271813 8-Jul-2019 12:45

freitasm:

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

What do you mean 'if prepay'' are you saying prepay connections are treated more as a security priority and they don't worry so much about the security of on On Account connections?

hio77

'That VDSL Cat'
10484 posts

Uber Geek
+1 received by user: 2520

Trusted

Spark

Subscriber

# 2271814 8-Jul-2019 12:49

This is exactly why all the providers require physical ID etc now days..

It's quite sad that it had to come down to that level of security honestly, because simswaps are a total pain!

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

richms

22260 posts

Uber Geek
+1 received by user: 4784

Trusted

Subscriber

# 2271818 8-Jul-2019 13:07

Last I checked to port a postpay number just required information that is on the bill and a date of birth, both of which are hardly secret information.

When I asked vodafone about locking swaps and ports on my 2 factor phone the 3rd world call center didnt even understand.

Richard rich.ms

dellor

17 posts

Geek
+1 received by user: 8
Inactive user

# 2271819 8-Jul-2019 13:12

Vodafone are suppose to ask for the customer's 4-digit pin..

freitasm

BDFL - Memuneh
63883 posts

Uber Geek
+1 received by user: 14346

Administrator

Trusted

Geekzone

Lifetime subscriber

# 2271899 8-Jul-2019 15:28

hairy1:

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

I also use Authy. Mauricio, how do you use the Yubikey alongside Authy? Is to open Authy or in place of Authy at times?

Cheers, Matt.

When you login on Twitter it asks if you want to enter the code or change the method...

Sharesies investment funds | Geekzone broadband switch | Amazon (Geekzone aff) | MightyApe (Geekzone aff) | Honeyminer (1000 Satoshi signup bonus)

My technology disclosure | Digital Transformation | Enterprise Content Management | Customer Relationship Management | Data Insights, Business Intelligence and Advanced Analytics