Forest Global Training Partners

Cyber Risks · Krebs on Security

Why Phone Numbers Stink As Identity Proof

Summary: Allison Nixon, director of security research at Flashpoint, told KrebsOnSecurity that companies have built customer authentication around phone numbers, and many sites still allow password resets with only a one-time code texted to the number on the account. Because phone numbers are recycled after unpaid bills, divorce, or account closure, whoever inherits a number can take over accounts tied to it, and Nixon described accidentally hijacking a stranger's account through an SMS reset on a burner phone.

Bottom line: A fraudster needs only access to a target's phone number, not the password, to reset credentials and reach every account tied to that number, and Nixon said there is nothing anyone can do to stop it except to stop using phone numbers as identity documents.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related