Forest Global Training Partners

Cyber Risks · Krebs on Security

U.S. Mobile Giants Want to be Your Online Identity

Summary: The four major U.S. wireless carriers - AT&T, Sprint, T-Mobile and Verizon - detailed a private beta initiative tentatively called Project Verify that would let Web sites authenticate visitors using carrier-held signals such as approximate real-time location, customer tenure, and SIM card cryptographic signatures, with the app pre-loaded on carrier-sold devices and a broader launch slated for sometime in 2019. AT&T's Johannes Jaskolski said the carriers would not centralize subscriber data into a cross-carrier database and that a swapped SIM would not port the mobile authentication profile, while researcher Nicholas Weaver called the carriers' authentication track record dismal and said he does not trust them.

What's compelling: All four carriers in this effort were recently caught selling customers' real-time location data to third parties that failed to secure it, and researcher Nicholas Weaver's own SIM swap took three days to undo - so the same providers asking to vouch for your identity are the ones attackers currently impersonate to seize your phone number.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related