Number port-our attack protection?

Forums › Spark New Zealand (including Skinny and BigPipe) › Number port-our attack protection?

RickD

280 posts

Ultimate Geek

#251296 18-Jun-2019 07:18

I read the story below this morning and was wondering what protection Spark has against numbers being ported-out by scammers?

https://www.zdnet.com/article/sim-swap-horror-story-ive-lost-decades-of-data-and-google-wont-lift-a-finger/

freitasm

BDFL - Memuneh
79145 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2259900 18-Jun-2019 07:22

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

sudara

7 posts

Wannabe Geek

#2260790 19-Jun-2019 11:10

I recently ported my number from 2degress to Spark.

For them to port it, they needed my account number from 2dgrees (Pay-Monthly) or need the SIM number printed in your older SIM card (Pre-Paid).

So as long as that information is secure, I don't think anyone can port your number.

RickD

280 posts

Ultimate Geek

#2271728 8-Jul-2019 10:54

freitasm:

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

I have prepaid so good to know, thanks. I use Authy/Google Authenticator for 2FA, but have my 027 as the backup on my Google account and a couple services that only have SMS 2FA like Twitter.

freitasm

BDFL - Memuneh
79145 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2271729 8-Jul-2019 11:00

RickD:

I have prepaid so good to know, thanks. I use Authy/Google Authenticator for 2FA, but have my 027 as the backup on my Google account and a couple services that only have SMS 2FA like Twitter.

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

RickD

280 posts

Ultimate Geek

#2271786 8-Jul-2019 12:08

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys.

I must be a few years behind... need to update that now.

hairy1

3331 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2271810 8-Jul-2019 12:38

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

I also use Authy. Mauricio, how do you use the Yubikey alongside Authy? Is to open Authy or in place of Authy at times?

Cheers, Matt.

My views (except when I am looking out their windows) are not those of my employer.

dellor

16 posts

Geek
Inactive user

#2271813 8-Jul-2019 12:45

freitasm:

You are usually required to be in-person at store with a photo ID and the original SIM card (if prepay).

Of course it is possible something like this could happen if you had a rogue sales person in store, doing a favour for a "friend".

SMS 2FA is not the best of second factors authentication type.

What do you mean 'if prepay'' are you saying prepay connections are treated more as a security priority and they don't worry so much about the security of on On Account connections?

Hatch

Trade NZ and US shares and funds with Hatch (affiliate link).

hio77

'That VDSL Cat'
12999 posts

Uber Geek

ID Verified

Trusted

Lizard Networks

Subscriber

#2271814 8-Jul-2019 12:49

This is exactly why all the providers require physical ID etc now days..

It's quite sad that it had to come down to that level of security honestly, because simswaps are a total pain!

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

richms

28058 posts

Uber Geek

Trusted

Lifetime subscriber

#2271818 8-Jul-2019 13:07

Last I checked to port a postpay number just required information that is on the bill and a date of birth, both of which are hardly secret information.

When I asked vodafone about locking swaps and ports on my 2 factor phone the 3rd world call center didnt even understand.

Richard rich.ms

dellor

16 posts

Geek
Inactive user

#2271819 8-Jul-2019 13:12

Vodafone are suppose to ask for the customer's 4-digit pin..

freitasm

BDFL - Memuneh
79145 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2271899 8-Jul-2019 15:28

hairy1:

freitasm:

Twitter has lots of 2FA: authenticator, SMS and hardware keys. You can have all three active in any account and use the one easier at the moment of login. I personally use Authy and a Yubikey.

I also use Authy. Mauricio, how do you use the Yubikey alongside Authy? Is to open Authy or in place of Authy at times?

Cheers, Matt.

When you login on Twitter it asks if you want to enter the code or change the method...