How can apps deal with phone number recycling/reassignment when sending password resets?

Question

Instagram lets users sign up with their phone number (verified by a pin sent via text), a username and password. Should you forget your password, you can request a link sent via text to your phone, to reset your password.

It hit me today that phone numbers can be reassigned to new people if they are no longer being used - so consider the following:

I make an instagram account with my phone number. I then get a new number, and don't bother updating/removing the details. Someone who got reassigned my old number then requests a password change, and voila - they have access to my instagram account?

Seems like lyft has actually experienced something like this: https://arstechnica.com/security/2016/02/when-phone-verification-and-recycled-numbers-collide-lyft-leaks-user-data/

So what can be done by companies using phone numbers for verification to avoid this (in my opinion) security issue?

Answer 1

These days, phone number reassignment isn't even the largest security concern for apps that use SMS as any part of the authentication process. This is relatively rare and cannot be used (or at least is very difficult to use) to target a particular victim. In essence, when it happens it does so accidentally and not maliciously. While still not good, it could be worse. In contrast even just using SMS is increasingly being recognized as an insecure security solution even if you don't change your phone number. There have been an increasing number of high profile attacks that have happened due to weaknesses (of all sorts) around SMS itself. The short of it is that SMS itself was never really designed with security in mind, and phone companies are very slow to pick up on this fact and more proactively protect their users. Here are some good reads for examples:

https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoin-in-15-minutes-with-verizon-and-coinbase-com-ba75fb8d0bac

https://www.howtogeek.com/310418/why-you-shouldnt-use-sms-for-two-factor-authentication/

What can you do about this? Not a whole lot, unfortunately. Many services come with text-messaging as the default (or even only option) for both 2 factor authentication and password recovery. When this is the case, there unfortunately isn't much you can do short of complaining or using a different service.

If you're building your own service, and there is anything in the least bit valuable in it (which includes virtually any personal information) then make sure and get up-to-date on best practices for modern security, and make those the default.

Answer 2

Simple: don't send everything to the phone, just a token or one part of what's needed to change the password...

For instance:

• don't send the username as part of the link but require that the recipient enter the username when resetting
• ask a security question
• only send a code via link that the user needs to enter to authorise the change

Answer 3

I believe a good answer is that these companies can ask the person using phone verification to type in the email address, or to type the first and last name.