"CCC researchers had live access to 2nd factor SMS of more than 200 affected companies - served conveniently by IdentifyMobile who logged this sensitive data online without access control."
> most of them should be able to build their own service.
Isn't the hard prt the connectivity bit i.e. negotiating with the various telcos? I once saw a telco use a third party SMS vendor for messaging their own customers for an app - because setting it up internally was too much of a hassle.
No, the hard part is having to secure all these little random services that I've now built. Why would I not just pay for someone whose job it was to worry about this instead?
Not in the US at least for those companies, but the world is a big place and this other comment https://news.ycombinator.com/item?id=40935323 mentioned places like Gambia and Burkina Faso... It just makes sense to outsource local delivery to companies that are better connected locally.
Yes, and there are multiple levels of aggregators. For example, in a past life, I built SMS APIs and back-ends, including ones used by smaller telecoms to enable their subscribers to send/receive SMS. (We were pretty small, and only accounted for something like 0.5% if US SMS traffic)
We connected to multiple aggregators. It's been a few years, but the big players in the US (Verizon, AT&T, Sprint, T-Mobile) were split between different aggregators. It was a similar situation in Europe.
A big part of working with a new aggregator was a full review of security and privacy, and that became even more important as we began the process of being acquired by an F100 company.
I'm still trying to figure out why messages were stored in S3 buckets to begin with. That's an architecture choice that makes little sense to me, especially since the limited size of SMS makes them pretty space efficient.
We at MakePlans were affected by this breach as we use Twilio. We are not using Twilio Verify (their 2FA api) but rather handle 2FA SMS ourselves in our app using Twilio as one of our providers. So the CCC definition of this being only 2FA-SMS is incorrect, it was all SMS sent through this Twilio third party gateway that was exposed to a limited set of countries (France, Italy, Burkina Faso, Ivory Coast, and Gambia).
GDPR is not necessary applicable here. An SMS gateway is most likely classified as a telecom carrier, and thus any local telco laws would be applicable and not GDPR. That applies only to the transfer of the SMS though, so for example a customer GUI of sent SMS would be out of that scope.
(And before someone tells us that SMS 2FA is insecure I would like to point out that we use this for verification purposes in our booking system when a customer makes a booking. So for end-customers, not for users. It is a chosen strategy for making verification easy as alternatives are too complex for many consumers. All users however authenticate with email and password, and have the option of adding TOTP 2FA).
I think 2FA via texts is better than no 2FA. But only if you do not make the texts world readable.
Apart from that, to me it seems justifiable to follow a risk based approach. Booking systems up to a certain value/amount, fine. Online Banking and health related services, thank you, no.
It's not really 2FA even. More like a magic link (which is what we use for verification via email). The customer has no password, just verifies using a code via sms/email.
It’s for the booking site so most visitors come to make a booking thus conversion rate would be high generally. We never had passwords there so can’t compare conversion rates.
For signups to our app (to get an account with a booking site) we require a password.
He says that 160 Wh/kg is in the ballpark of LFP batteries from five years ago. It is, however, about the same as the sodium batteries announced by CATL in 2021.
In this particular case I read the statement as a dig at maps.me (the app they forked from). On iOS, maps.me would always continue accessing my location in the background unless force-quit, even if nothing was actually happening in the background. I might be wrong of course, the statement could have a different background and maps.me's behavior could be an honest bug.
That's indeed a very nice explanation but I think it's wrong to completely discard pop music with its covers. You can have the the problem, but usually only on a title level, not on an album level - so the metadata thing can be true as well.
On the other hand, as someone not listening to a lot of classical music, it's an interesting problem for sure, but as I mostly drag the mp3 folder onto foobar2000... I don't think I get the "problem" part of the problem, maybe I would if I used the likes of spotify more :P
Never heard of Robinlook in southern Germany. I would have said the other large chain besides Fielmann is Apollo (known as Pearle in another European countries).
Currently, not really for most events. Big concerts, trade shows, sports games, etc. are happening without any restrictions.
Moving into winter, the general situation can change and many people are expecting more strict regulations.
And then there’s the question of community and personal assessments. C3 is an event run by a community that tends to be note cautious with respect to risks. And, as the announcement says, "[w]hat might be possible would not be a Congress".
Or an effective intranasal sars-cov-2 specific vaccines that provides good protection from infection/spread in the upper respiratory mucosa. This is to complement the strong protection against serious disease in the body serum/lower lungs that intramuscular vaccines give.
I have high hopes for India's now approved (positive phase 3 trials) adenovirus based one even if astrozenacca's rushed repackaging of theirs as intranasal failed.
>it is foreseeable that strict hygiene requirements will be necessary and in all likelihood mandatory – if an event of the size of the Congress can be approved at all. What might be possible would not be a Congress
The question is not one of whether the government would approve it (they will, they approved Oktoberfest after all), but one of whether the CERT team of the CCC would approve it (and they wouldn't)
No, it was cancelled in anticipation of a new COVID wave that would make a strict hygiene concept necessary, and bacause most of the volunteers wouldn't want to attend such an event. That these measures might also become mandatory was only an additional aspect, but not decisive at all.
