BrianKrebsDec 28, 2022

Some interesting stuff I apparently didn't notice the first time in updates to AT&T's terms of service, which you agreed to by continuing to use AT&T. This language is designed to insulate AT&T from liability in the event someone SIM swaps your phone number and uses that to steal your identity, crypto, etc. There's quite a bit of ongoing litigation about this very subject.

https://www.att.com/legal/terms.consumerServiceAgreement.html

"AT&T is not responsible for losses incurred as a result of your or a third-party’s use of your AT&T wireless number or other AT&T Service as a source of authentication or verification in connection with any social media, email, financial, cryptocurrency or other account;"

....."To the greatest extent permitted by law, AT&T is not liable to you for any damages of any kind resulting in any way from:

the installation, maintenance, removal, or technical support of AT&T Services, even if the damage results from the ordinary negligence of our installer or other representative;
any unauthorized access to your AT&T Accounts or AT&T Services (including the use of your AT&T Accounts or AT&T Services to access a third-party account), even if the unauthorized access was the result of ordinary negligence by an AT&T employee, representative, agent, or any person or entity purporting to act on AT&T’s behalf;"

Whew, that's some heavy stuff. Meanwhile, please enjoy this latest SIM-swap rap. h/t @nixonnixoff
https://www.youtube.com/watch?v=C8CumdZhPIw

Terms of Service - Legal Policy Center - AT&T

Learn more about the AT&T Access ID Terms of Service.

Show threadHiFiDec 28, 2022
@briankrebs it’s far past time we started holding makers of electronics and software products liable for the security of said products. The data apocalypse currently evidenced by things like Cambridge Analytica, GLOO, 2016 political targeting by Parscale… most people don’t even understand this exists.
Show threadJonneDec 28, 2022
@HiFi @briankrebs this isn't a tech issue, it's a social engineering/ process issue on the Telco side. They made it too easy to port numbers without doing proper checks. What you personally can do is use an authenticator app for 2fa as opposed to SMS.
Show threadms. lizDec 28, 2022
@jonne @HiFi @briankrebs yes, that horse had already left the barn years ago. one might also argue that companies who only offer SMS for 2FA also bear some culpability, and that telcos should require extra auth to change account details.
Show threadHiFi
@unknown8bit @jonne @briankrebs oh I’d say the whole industry has been slipshod with their (decided lack of) security measures. Perhaps some serious regulation, data protection, and data privacy laws with severe fines for transgressions are in order. I like the EU’s new DMA and DSA, but feel even those don’t go far enough.
Dec 28, 2022 at 8:38pmWeb