Today I learned about an interesting way for an attacker, Bob, to get into the Bank account of their victim, Alice (or any other financial or sensitive account).

• Attacker Bob knows lots of info about Alice, including her account number and password at the Bank used by Alice.
• Bob tries to impersonate Alice by logging into her Bank's site, using Alice's acct & password. But the Bank site calls/txts to Alice's 212-555-0123 with a one-time code. Bob can't see this code, so he's blocked on login.
• Bob then tries to gain control of Alice's 212-555-0123 by tricking Alice's phone provider to transfer the number to Bob's device (aka SIM jacking). But Bob is unsuccessful with this attack.
• But Bob has another way to complete his attack, which I just learned about recently. With enough sophistication, Bob can "trick" the part of the public phone network between Alice's Bank and Alice's device, so that the Bank's calls/txts to 212-555-0123 instead go to a device controlled by Bob.
• Note that Bob has not taken control of 212-555-0123, rather Bob has manipulated a part of the phone network such that the Bank's calls/txts end up at Bob's device rather than Alice's (and also others might be affected).

There is now an RFC 9970 that attempts to mitigate this attack. Previous RFCs focused on making it much much harder for attacker Bob to impersonate (spoof) the Bank's calls/txts to Alice (using cryptographic techniques). This new RFC adds protection in the opposite direction, to make it much much harder for Bank to impersonate (spoof) Alice. In other words, this new RFC 9970 can give the Bank much more confidence that the Banks' calls/txts are reaching a device actually controlled by Alice (not attacker Bob), regardless of the digits of the phone number.

The RFC 9970 uses the following jargon: Improving "connected identity" means making it harder for an attacker to impersonate (spoof) the "called party" (Alice) to the "calling party" (the Bank). This RFC 9970 tries to improve this "connected identity" problem.

Of course there is no such thing as "perfect security". Even with adoption of RFC 9970, a sufficiently motivated attacker can still get into Alice's Bank account. But adoption of this will make it much harder for attackers.

Friends & family sometimes ask me for advice about passwords. I've captured this advice for the benefit of others, and to make it easier for me answer questions in the future. See netjeff.com/password-advice

Google, Facebook, and others are trying to be helpful, and show content that is customized just for you. But this can trap you in a "filter bubble". Information used to be filtered by mass-media gatekeepers like newspapers & television, and was also filtered by where you lived. Is the automatic personalization and customization by Google, Facebook, and others any better than the old filtering?