The Most Expensive Lesson of My Life: Details of SIM Port Hack - <AUTHOR> https://medium.com/coinmonks/the-most-expensive-lesson-of-my-life-details-of-sim-port-hack-35de11517124 <comment><USER2> It's an extremely odd decision by the author to publish this piece. Port attacks on cryptocurrency accounts is nothing new, and outside of publishing the number ($100k!) there is nothing special about this account of events vs the countless other near identical articles that have been published on Medium on the same old attack.

The reason I say it's odd is that he's an _engineering manager_ at BitGo, which is a leading cryptocurrency custody solution! His job is literally to secure and protect institutional cryptocurrency wallets, and to publicly tell the world how careless he was with his own personal account looks extremely poorly on his employer despite the fact that this was an unrelated incident.

<comment><USER3> It's a reminder that crypto is fundamentally dangerous due to its lack of regulation and compliance requirements, its fundamental irreversibility and lack of authority/censorship. It's a lesson we should all take to heart about what makes for a functional financial system and what doesn't. It's also a lesson about the security of phones.

IMO its great to learn about what goes well but super valuable to learn when people face-plant.

<comment><USER4> Traditional financial regulation and compliance is a joke and mostly security theatre from the perspective of a security engineer or cryptographers.

\- credit cards with secrets printed and shared in plain sight

\- hacked banks

\- hacked atms

It only works because most involved are somewhat trustworthy and the damages are small enough that it's still worth to have the system.

But the latter also seems to be true for crypto. It shifts the responsibility further to the user. Some like it because they assume they can provide better opsec than their bank (which was easy in the past). Others don't like to take responsibility and leave it with some exchange, which in some cases even lack behind banks.

<comment><USER5> When I was a student 15 years ago my debit card was skimmed (here in the UK) and someone in the middle east completely emptied my bank account. I called my bank, they explained what had happened and what little money I had was back the very next day.

So while the infrastructure may be fundamentally insecure, quite frankly that's not my problem. If it was a crypto wallet I would have had zero legal recourse and of course never would have seen that money again - as we're seeing again and again.

I do hold some ETH but I don't see it replacing my bank anytime soon.

<comment><USER6> Ouch. Sucks to read that. For anyone who might be interested in a possible alternative to this, I keep two bank accounts with the same bank with only one being connected to my debit card. I keep a tiny balance in the account connected to the debit card so that even if I lose it, the damage is minimal. Whenever my balance is running low, I do a quick transfer via online banking.

No idea how feasible this might be in other countries, but wanted to share in case its helpful. It's really helped me have ease of mind in using my card when I've been abroad.

Doesn't stop me from attempting to dismantle any ATM though whenever I use one :')

</comment></comment></comment></comment></comment><comment><USER7> I'd like to see more companies introduce "time locks" into various big aspects of accounts.

Want to port a SIM? I'll put your request in now but it will wait for 5 business days before it happens, and at any point if you or someone claiming to be you calls up to stop it, we stop it, no questions asked.

Want to change 2 factor information for an account? We can put in the request now and it won't take effect for a week while we reach out to you using every communication method we know how to let you know it's happening and give you ample time to stop it if you discover it wasn't actually you that did it.

It seems like a fairly "low cost" way of upping the security quite a bit.

Also, not to make the OP feel worse, but Coinbase even offers a service like this called the "vault". The idea being that withdraws are time-locked for a specific amount of time, and there are multiple ways to stop it during that time lock, even if you got locked out of your account entirely.

And while we are doing PSAs, I'd like to give one piece of seemingly conflicting advice: make sure you have backups of your multi-factor authentication systems.

Sure, having your accounts taken over is awful, and it can happen to anyone, but something just as bad is losing your 2-factor systems and being locked out of accounts with no way to recover them.

Print out 2-factor backup codes, put them somewhere safe, maybe split them in 2 and put half of the codes in one place, and half in another. Think through possible problems. It really sucks to have your house flood, then find out that your phone with the 2-factor app on it was destroyed, and your backup codes ruined as well...

<comment><USER8> > I'll put your request in now but it will wait for 5 business days before it > happens

This to me seems to be a complete misunderstanding of the telcos business and motivations. They sell mobile telephony - voice, sms, and data - and their _prime objective_ is to make it as easy as possible for their customer to spend as much money doing that as possible. Making you wait five days to get reconnected to "your number" when you have, for whatever reason, lost control of it is just not going to happen. They'll move mountains to get you back onto your data/voice plan before you've walked out of the store.

Nobody ever advertised their phone/sms plans as "banking grade secure". Telcos have been telling us for years that they are explicitly _not_ secure for that:

[https://www.itnews.com.au/news/telcos-declare-sms-unsafe- for...](https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank- transactions-322194)

Communications Alliance chief executive John Stanton, representing the interests of mobile providers Telstra, Optus and Vodafone, took the extraordinary step of of declaring the technology insecure in the wake of numerous reports of Australians being defrauded via a phone porting scam first uncovered in Secure Computing magazine.

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," Stanton told iTnews this week.

Telcos are not interested in securing that, they get _way_ more complaints from people who lost/broke their phone who want their replacement one to work RIGHT NOW, than they do from people who got defrauded with a sim porting attack. And the first group of people are spending _way_ more money collectively than the second, so of course telcos will continue to make it quick and easy to sim port.

Everybody else needs to deal with that. While sms 2FA is marginally better than not having any 2FA at all, it's not the telco's problem if you choose to use it to "secure" your $100k worth of crypto. In my mind, a large part of the blame here goes to COinbase for even offering it. I'm also looking at your PayPal...

<comment><USER9> Yes, Paypal is bad, they took away their support for the Symantec 2FA codes and forced users in many countries to use SMS instead.

This is pretty easy for the telco to prevent, though. Your existing telco should simply phone you and ask if you wish to leave them before letting the number get ported out.

Note that all telcos will prevent the number being ported out if you owe them any money on the account.

<comment><USER10> > Note that all telcos will prevent the number being ported out if you owe > them any money on the account.

Wait really? Is there a way to force yourself to perpetually owe them a small amount of money then? Could be really worth the money.

<comment><USER11> An attacker could just pay the balance.

<comment><USER10> Seems like a decent hurdle to make an attacker jump through? Given they'd want the payment to be untraceable etc.

</comment></comment></comment></comment></comment></comment><comment><USER12> In all seriousness folks, as someone who long ago worked for a big wireless carrier, do not use SMS-based two-factor auth for anything. Number porting is a huge and easily performed attack vector, it requires very, very little information, a lot of which can be gathered from publicly available resources... or pretty easily obtained via social engineering. To make matters worse, the information doesn't even need to be entirely accurate.

Once they have your number ported getting it back will take, at least, a few days; during which, they'll have unfettered access to anything that uses your mobile number to authenticate.

Use a dedicated 2FA application on a device you physically control and _write down_ the backup keys somewhere physically safe.

<comment><USER13> So what's the alternative? Especially financial institutions insist on using SMS in addition to even hardware keys. It's crazy.

<comment><USER14> Many carriers let you set an "account password" or "account pin" \- changes can't be made to the account without it (even with personal info like SSN, bday, etc)

Financial institutions offer it to sometimes - my credit union requires the account password, or a visit to a branch to show ID - no amount of personal info will allow you access.

<comment><USER15> Any carrier will allow you to change your password or pin using other information .

Otherwise, what would happen in the frequent case where users forget their pin?

<comment><USER14> > Any carrier will allow you to change your password or pin using other > information .

If by "other information" you mean "come into a store and show a government issued photo ID" you are correct. That's a fairly high bar to clear.

That's the way my carrier does it, and I assume if they violate their own procedures I could evaluate my legal options... though as a practical matter I use a VOIP # which requires a 2FA protected login to port out for vendors that force me to use SMS 2FA.

<comment><USER15> Which carrier is that?

</comment></comment></comment></comment></comment></comment><comment><USER16> I was attacked in the same manner this weekend. I'll dump what I know below in the hopes it helps someone.

I lost money when MTGox went under and made some online posts (on reddit, I think) several years ago. Maybe this is what caused me to be targeted?

This weekend a malicious actor posing as the account holder on my account was able to get my number transferred to his phone. At&t fraud says this happened at a store, and the user had the last 4 of one of my family member's social security number, as well as a fake id. I'm not sure I believe this, but will request more info in writing.

I regained access to my account. The attacker came from IP 126.96.36.199 (santa clara california)

They entered my email and according to google activity logs immediately went after my coinbase account. They got in (joke's on them I didn't have anything). Then they searched my email for 'btc', and also made a visit to my bank website. They weren't able to get access.

As far as I can tell, they were in and out within 10 minutes. I wonder if this was related to the author's experience?

<comment><USER17> This is the reason I have disabled SMS as a recovery option in my gmail/google account. My 2FA for gmail is now my iphone and ipad. THey have to know my password and get one of my devices to hack my account. I also use protonmail and for SMS based 2FA, I plan to use a google voice number from a totally different google account w/c forwards the text to my protonmail account. Google voice numbers cannot be ported out. Hence, avoiding the sim hack. They can port out if they hack my "shadow" google account. The trick is to never use the shadow account for anything. Hence, the attackers have no way to get to your google voice.

<comment><USER18> I'm fairly certain that any phone number in the US has to be portable by law.

<comment><USER14> You can port out a voice number - it's $3 if it was originally a voice number:

[https://support.google.com/voice/answer/1065667?hl=en](https://support.google.com/voice/answer/1065667?hl=en)

Weirdly, you can't port a Gsuite google voice # to a gmail account. (I looked into it when considering canceling my Gsuite account)

</comment></comment></comment></comment><comment><USER19> > _Google Voice 2FA_

Unfortunately many places are actively refusing to work with Google Voice. I got a message from Bank of America saying specifically that they're removing Google Voice support:

> _You can 't enroll in Zelle with a landline, Google Voice or VOIP (voice > over internet protocol) phone number. (Section 3.C.3 Enrolling in the > Service)_

This follows with some other unnamed (because I don't remember them) services which also refuse to work with Google Voice.

That's really unfortunate because I've been using Google Voice for nearly 10 years without issue until recently (when companies specifically remove support...)

<comment><USER20> If you ported a previous phone number to google voice, how would they know?

<comment><USER21> It's easy to find out the company hosting a phone number: [http://twilio.com/lookup](http://twilio.com/lookup)

</comment></comment></comment><comment><USER22> Stuff like this freaks me out and I'm sure I'm not the only one. Thanks for the wake-up call. It's a terrible amount of money to lose. I hope things get better for this guy in the future (and I don't think anyone would say they're to blame for this.)

Security is becoming so difficult to balance with an every day life... I don't know how anyone can remember everything that they're "suppose" to know about security.

</comment><comment><USER23> This is frightfully common in South Africa except aimed at banks - they use SMS as their 2FA. ("SIM swap")

Another common tactic to watch out for: Repeated calling of your phone to annoy you enough so that you switch it off/silent it. That can give the attacker enough time where you don't notice the swap.

</comment><comment><USER24> This is frightening. If you're using texts for 2-factor auth you're at the mercy of your phone service provider's customer service. And they're trying to balance being helpful with security, which can be in opposition. Losing $100,000 with no hope of recovery is the kind of thing that could sink many people's finances.

His summary of how to avoid having this happen to you:

      * Use a hardware wallet to secure your crypto
      * SMS-based 2FA is not enough
      * Reduce your online footprint
      * Use Google Voice for 2FA
      * Create a secondary email address
      * Use an offline password manager

<comment><USER25> There may not be a choice. Vanguard refused to log me in until I configured 2-factor SMS.

<comment><USER26> I would consider that an alarming sign that I need to change investment companies asap (probably after loudly complaining and trying to change it, since Vanguard is somewhat unique).

<comment><USER27> Fidelity also only uses SMS-based 2FA :-/

</comment></comment></comment></comment><comment><USER28> Everybody involved in something like this should be suing the phone company that gave away their phone number in violation of policy.

[https://www.silvermillerlaw.com/current- investigations/crypt...](https://www.silvermillerlaw.com/current- investigations/crypto-cellphone-sim-port-hijacking/) comes up on a search and says they'll do contingency in cases like this. Got nothing to lose.

</comment><comment><USER29> How can a mobile carrier operate like this?? No authentication that the request isn't fraudulent?

In Sweden I switched to another carrier, still keeping the number in the same name. To do that I got a text message with a code I had to input to initiate the process.

When I ported my phone number from my father to me within the same carrier when I turned 18 that required the same confirmation to initiate the process and signed request/approval both from me and my father posted to the company, with associated emails about the process.

This isn't even hard? This is just basic steps to prevent identity theft....

<comment><USER30> This is not about porting the number to a different carrier or even a different owner though. It's more analogous to getting a replacement SIM card.

The last time I had a phone stolen, I went to the carrier's store, they checked my ID, and gave me a replacement SIM. And the things is, if the customer service representative is empowered to do that, they could also be bribed by the attacker.

<comment><USER29> I checked, to get a replacement sim my carrier sends out inactive cards that needs to be activated through their web service using the printed number on the card.

If you don't have an account you need to contact customer service, and to get through there they most likely authenticate you based on your SSN and an already active app on your phone (BankID) where you input your personal password.

This has actually created problems when people get their stuff stolen abroad. The ID application is authenticated using your bank and a device using your physical bank card, a generated number from the webpage and your pin and then the generated number is put into the webpage. So if you get both phone and card stolen it's essentially impossible to get into your accounts until you can get a new one posted to you. Especially fun if your bills end up in a digital mailbox requiring that login....

Using that app is how essentially all identification is done in Sweden since it's based on an already approved physical device and a personal password. With your bank as insurance that the information is correct based on your physical bank card and the account associated to it.

<comment><USER31> See recent Tele2 attacks. This is a problem in Sweden too.

Maybe the Tele2 attacks made them finally sort things out.

<comment><USER29> Googled. Is it regarding using social engineering to enable call forwarding last autumn? Can't find anything else.

<comment><USER31> Yeah. Which is how this guy got hacked, too. Whether it's by forwarding or new sim card is a detail. It's the same social engineering vulnerability.

<comment><USER29> And reading the article everyone was already at the time working on preventing it, because any unauthorized change is illegal.

The prevention seems to be either through BankID authentication or actually calling/texting the number being forwarded to make sure the request is legitimate.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> Large tech companies like Google push 2-factor auth to "increase" security, but this article shows that 2-factor auth with SMS verification opens up a huge security hole since the attacker can access your email if they can get your provider to port your SIM over to their device. Am I missing something and if not how did companies like Google not foresee this huge security hole?

<comment><USER33> Google offers many different 2 factor methods including Google Prompt, TOTP, and security key - all of which are better choices than SMS. The author is right to say that SMS is not enough but he didn't go far enough: only use SMS- based 2FA if it's your only 2FA choice for your critical accounts, and consider alternative services if it's your only choice.

<comment><USER34> The issue is that the forgot/lost device flow allows you to remove your more secure 2FA with only SMS verification.

<comment><USER31> You can turn off SMS/phone auth fallback, at least in gsuite.

</comment></comment></comment></comment><comment><USER35> Sucks to be the OP but storing any crypto in an exchange is idiotic and literally the first thing on any list of "how to secure your crypto" is to not do it. This shows the OP is just being willfully ignorant.

Exchanges get hacked or are victims of internal fraud at a level that is far beyond any acceptable risk. [https://coinsutra.com/biggest-bitcoin- hacks/](https://coinsutra.com/biggest-bitcoin-hacks/)

If you have any kind of serious crypto holdings, you should either be using hardware wallets or a PC that you _only_ use for crypto. Nothing else. * Buy crypto, transfer to your PC, turn off PC.

<comment><USER36> For any significant crypto holdings you should be using a hardware wallet, and for serious holdings you should also use a multisig setup.

<comment><USER37> Right but what if the blocks fill up and transactions are taking forever right when you (and others) have the most interest in selling?

<comment><USER38> This is why you do long term holding in BTC or any coin that may take longer to confirm on the chain and the money you are playing/trading with should be in an asset like XLM which transfers in seconds.

Now if the whole thing is tanking and you want to transfer your entire savings to try and ride the wave you are already too late if your money is not already on an exchange and you shouldn't be 100% swing trading anyway.

Just my opinion on how I handle it.

</comment></comment></comment></comment><comment><USER39> This person's Google account is likely still vulnerable to the attacker and if they used chrome password sync all of their other accounts are also likely owned. You can recover a google account if you know some basic details such as a previously used password or the creation date of an account. After having a google account owned enrollment in the advanced protection program and ensuring only the strongest recovery methods are enabled are best next steps.

[https://landing.google.com/advancedprotection/](https://landing.google.com/advancedprotection/)

</comment><comment><USER40> > Do not leave funds idle on exchanges or fiat on-ramps.

This warning has been publicly repeated _hundreds_ of times since 2010, yet people still insist on ignoring it.

The author didn't lose anything. He gave Coinbase his bitcoin in exchange for a promise to pay it back. That deal backfired.

> I knew the risks better than most, but never thought something like this > could happen to me.

There's knowing the risk, and then there's _knowing_ the risk. I'd suggest that the author didn't really know the risk, or he would never have considered leaving such a valuable asset in the care of an organization so ill-equipped to safeguard it.

<comment><USER41> Do you also keep your cash under your mattress, instead of into a bank account?

<comment><USER42> Someone please correct me if I'm wrong, but at least in the US banks take on all risk of fraud. If someone starts writing bad checks in your name, that's ultimately the bank's problem rather than yours.

<comment><USER40> Coinbase is not a bank. It acts like one. It spies on its customers on behalf of federal regulators like one. But it most definitely is not a bank.

The author has to eat the loss, as per the user agreement.

</comment></comment></comment></comment><comment><USER43> SMS should not be used for anything even remotely related to security. If you still need to be convinced, the Reply All episode about it[0] is eye opening while being entertaining.

[0] [https://gimletmedia.com/shows/reply-all/v4he6k/130-the- snapc...](https://gimletmedia.com/shows/reply-all/v4he6k/130-the-snapchat- thief)

</comment><comment><USER44> I wonder how nobody sees the elephant in the room.

2FA by SMS is terribly insecure. Numerous security researchers recommended never using it. Using phone numbers as primary authentication mechanism is insecure and never should be used. Phone numbers can be spoofed, SMS messages can be intercepted, SIM port attacks can and will happen. If your email or banking accounts depend on 2FA by SMS, especially when SMS can be used to reset the password — disable it now. Avoid it like plague.

More than that — if your account has significant value that you absolutely can't afford to lose, you shouldn't use _any_ 2FA services linked to your phone, at all, including Google Auth. Your phone can be lost or stolen anytime. Use a dedicated device which you don't take with you all the time.

<comment><USER45> I know SO many real banks which still use 2FA by SMS.

<comment><USER46> And it was a hell of a fight to even get _those_.

Alliant Credit Union, for example, only just rolled out SMS-based 2FA in the past ~year. No TOTP/U2F/FIDO* options at all (in fact, according to [https://dongleauth.info/](https://dongleauth.info/), exactly zero major banks/CUs in North America support anything better than SMS or TOTP).

When I can lock my GitHub account more securely than my _money_, it's a bit (read: lot) depressing.

</comment></comment></comment><comment><USER47> This is the kind of stuff that convinces me we'll never see mass adoption of cryptocurrency -- or that if we do, it will be only by replicating the existing financial system and slapping a cryptocurrency label on it.

If security engineers at cryptocurrency firms are getting hacked, what hope do mom & pop user have? And once your money is stolen, you have basically zero recourse and no way to reverse the transaction. I know many proponents consider that a feature, but I'm telling you for the average user, it is absolutely a bug.

</comment><comment><USER48> I have a question related to this that someone expert in Bitcoin could answer.

Could the victim monitor where the bitcoin (we assume) went to using the public blockchain record? Then, trace it every step of the way (and in whatever chunks it divides into) until it reaches the account of a publicly identifiable entity? At that point, there might be legal recourse in recouping stolen goods (at least, this is how it works in the UK with stolen physical goods.. even if someone "legitimately" buys them, they can be reclaimed).

<comment><USER49> Kinda but it's hard and there are measures to counter this. There is one thing called coinjoin which attempts to tumble coins.

Imagine you stole 10 btc and you split it to 10 outputs of 1 btc each. Then you use 2 of them to perform a coinjoin with several other people where in a single transaction 10 inputs of 1 btc (2 of them yours) produce 10 outputs of 1 btc (again 2 of them yours). There is no way to tell which coin is which anymore. Of course this requires some degree of interaction with other people but in other coins such as grin that use the mimblewimble protocol this happens automatically for every block.

Another thing you can do is try to do an atomic swap with someone on another blockchain i.e Litecoin. In this case you send your coins to a specific script address, the other person sends his LTC to another script address and you effectively swap BTC with LTC.

</comment></comment><comment><USER50> _" I treated Coinbase like a bank account and you have absolutely zero recourse in the case of an attack."_

Now that's the real problem. Coinbase acts like a bank or a broker/dealer, but isn't regulated like one.

<comment><USER31> That and Bitcoin is specifically designed to not give you a recourse in case of an attack.

Cryptocurrency designers seem to think that banking was designed as a mistake without anyone thinking. That laws people wanted were just unfortunate side effects.

<comment><USER50> Bitcoin isn't the problem here. Coinbase is regulated as a "money transmitter". You can get into the same situation if you send money via Western Union, which is also regulated as a money transmitter, and tell them to "waive identification" at the receiving end.[1] That's used as a payment method by some scams.

Coinbase will pay out via PayPal, so someone with access to an account's credentials could pull of this scam without involving cryptocurrency at all.

Now if Coinbase was regulated by the SEC as a "broker/dealer", which is what they really are, they'd be subject to SEC regulations on fraud, and would have SIPC insurance to protect the customer up to $250K.[2]

Coinbase does, in fact, have a New York State "BitLicense", which makes them subject to various New York State regulations. Among other things, transactions larger than US$10,000 have to be reported to the New York State Department of Financial Services within 24 hours, and Coinbase is subject to rules about cybersecurity, fraud, and its activity as a custodian of the funds of others. You can complain to the New York State Department of Financial Services.

DFS pulled Bittrx's license last month and gave them one day to get out of New York State.

[1] [https://www.westernunion.com/us/en/fraudawareness/fraud- ques...](https://www.westernunion.com/us/en/fraudawareness/fraud-question-and- answer.html)

[2] [https://www.sipc.org/for-investors/what-sipc- protects](https://www.sipc.org/for-investors/what-sipc-protects)

</comment></comment></comment><comment><USER51> That's interesting, I did not know it was possible to have a coinbase acct without working google authenticator.

I found out the hard way it takes over a week of time and multiple verifications and contacts to reset my authenticator when my old phone was broken; as it should be.

</comment><comment><USER31> I'd like to point out that preventing things like this is literally this guy's day job. (Look him up)

And he didn't know about SIM attacks.

And he kept $100k of irreversibly transactible "money" on an exchange, despite their history of being hacked.

This is what happens when you get involved with organized crime (which I consider Bitcoin to be): you become a victim.

His lessons learned is of course not that reversible transactions is something good, not a "mistake" in the fiat banking system.

</comment><comment><USER52> Additional discussion yesterday. Perhaps the mods can merge these submissions:

[https://news.ycombinator.com/item?id=19964089](https://news.ycombinator.com/item?id=19964089)

</comment><comment><USER53> I still don't get one thing: how could the attacker port OP's number without proving he owns the sim? Where I live (in EU) it's mandatory, isn't it the same in the US?

<comment><USER54> at least in germany ordering new sim cards to new addresses your provider never heard of before was a thing some years ago. I think porting a number is a lot easier if you know the detailed process though.

<comment><USER53> Oh, my bad, I thought US was the exception

Here in Italy you must provide your ID card and wait a couple days for the carrier to check the data. Goverment websites even use 2fa as a proof of your physical identity

<comment><USER55> Why is it so common for some people to use "EU"/"Europe" when talking about a quirk about their country? Americans do it too, though the states are far less unique than countries.

<comment><USER56> Because many of the rules are made on the EU level, not by the individual country.

</comment></comment></comment></comment></comment><comment><USER3> If only there was a way to trace the transactions and reverse them. Sadly, the "future of banking" is all immutable ledgers with zero recourse so the money is gone. If this were a _real_ bank he'd have his money back right quick.

</comment><comment><USER57> >Do not leave funds idle on exchanges or fiat on-ramps. I treated Coinbase like a bank account and you have absolutely zero recourse in the case of an attack. I knew the risks better than most, but never thought something like this could happen to me

I wonder why he'd think that. Disregarding the risk of you getting phished/hacked (which you can prevent), there's nothing you can do about coinbase getting hacked (eg. mt gox), running away with the funds, losing their funds because of incompetence (eg. quadrigacx), or locking your account and taking months to unlock.

</comment><comment><USER58> I am a bit surprised at the lack of opsec considering the author's employment and experience.

Definitely sucks to have $100k stolen.

</comment><comment><USER59> Is Google's password reset system a massive security risk? I set up a couple of recovery phone numbers without thinking about it too much, but after reading this it seems like I'm just a little bit of social engineering away from having my Gmail account taken over, along with anyone else who set up a recovery number. If someone took over my SIM and reset my password overnight, they would have 8 hours to do whatever they want with my Gmail account before I saw that my password had been reset.

<comment><USER60> Yes, my google account was simjacked last year. I lost access to my email, photos, and ability to login via Google. They were after my Coinbase account (luckily the only account I used real 2FA on). They could have initiated bank transfers too but didn't try.

Customer support for personal gmail accounts is almost nonexistent. Fortunately I had a friend who worked at Google and had them put a word in on my reset request otherwise I would have been SOL.

Disable phone number resets and switch to Google Authenticator w/ backup codes ASAP.

<comment><USER39> Go through the password reset process with google and it's worse than most people think. The first thing it asks you is:

> Enter the last password you remember using with this Google Account

Which of course the attacker knows because they changed your password. If they don't know that you can click try again and go through the various two factor methods set up (hardware token, totp code, sms) and then the very last and also terrible option is putting in the date the account was created. If your account has been owned the attacker likely knows this too. Advanced account protection is pretty much the only option if you've had your account breached at any time.

<comment><USER61> >> Enter the last password you remember using with this Google Account

> Which of course the attacker knows because they changed your password.

The site asks for the last password _you_ remember using, not the last password that _was_ used (presumably by the attacker). I don't think this is as bad as you think; the attacker doesn't likely know the previous password, or else they would not have needed to hijack your phone number.

</comment></comment></comment></comment><comment><USER62> The major US provides are looking to get you to replace all your logins with direct cell-provider authenticated logins, so they can skip the email recovery part:

[https://www.fiercewireless.com/tech/project-verify-will- brin...](https://www.fiercewireless.com/tech/project-verify-will-bring-mobile- connect-tech-to-u-s)

With this the attackers get direct access to all your services once they socially engineer or identity theft attack your cell account once.

</comment><comment><USER63> Is there a mobile carrier focusing on security?

something like what CF (and others) are doing with domains

<comment><USER64> I would think that an online-only MVNO like Ting.com would be harder to fool - even if their call agent fell for the trick, they'd still have to mail a new sim out. But you'd have to log in yourself to swap the sim using the Ting website. As I understand it, attacker would have to fool you and coax you to swap the sim.

</comment></comment><comment><USER65> This type of attack has been happening for a long time in Russia where criminals often have accomplices among employees of a cellular carrier or its dealer. There is often no serious responsibility for this and such employees often get away with a fine or just being fired.

The most notable example is when a certain person's SIM card was reissued 4 times within 2 days in different cities by criminals while the owner was trying to restore access to her phone.

To prevent it, some Russian banks have agreements with carriers that allow them to check SIM card's identifier and detect whether it was reissued. If such situation is detected, the bank doesn't allow to use new SIM card to confirm operations.

Some carriers block new SIM cards from receiving SMS for 24 hours and send a SMS with notification to an old SMS card so that the owner can restore access. Also, one can restrict a list of locations where your SIM card can be reissued.

</comment><comment><USER66> Seems like 2FA in this case is significantly weaker than 1FA if you have a long password. I suppose it depends on if it is easier to answer the security questions or to convince a customer support rep, but my security questions are pretty obscure and I have a security question salt that I always append to the answer.

<comment><USER67> 2FA is not in itself weaker (for the same password). It's account recovery that's that downfall here - the password is forgotten and not one of the factors, so the system allows to to recover your password with _only_ the second factor (mobile phone number).

</comment></comment><comment><USER68> This same thing happened to me last month (SIM Swap). I also made a post recapping the event, plus the security steps you need to take to help mitigate this attack vector, here:

[https://www.youtube.com/watch?v=Uww4Bu6Uzxk](https://www.youtube.com/watch?v=Uww4Bu6Uzxk)

</comment><comment><USER69> This inspired me to disable SMS verification on my Google account. Now, the attacker may be able to port my phone number, but without my logged in Android phone, or one of my printed pass codes, they would not be able to subvert my email address.

I was wondering how the attacker found out this guy's phone number, so I searched my own online. Disconcertingly, it was visible on truepeoplesearch.com. So I also submitted a record removal request there.

I mean, I think the best option is to not own any assets that can be fraudulently, irreversibly transferred away. That's what I do. But a little extra security won't hurt.

</comment><comment><USER70> Phone-based 2FA is security theatre that just adds a new and easy attack vector in the process, pushed by service providers obviously to attain your phone number instead of just an email address.

For anything important I use air-gapped hardware tokens for 2FA. If a brokerage or bank doesn't support hardware token 2FA they don't get my business, full stop.

At the last startup I worked for, which was rather security sensitive, the leadership actually insisted on employees setting up gmail w/SMS 2FA on their smartphones. I kept using backup codes and never set it up.

</comment><comment><USER71> Slightly off topic, but I briefly addressed SIM swap in my prequel blog post to "SSH 2 Factor...", "SSH 2-Factor's First Factor".

The goal was to help beginners in security and technology as a whole understand why SMS based two-factor is insecure and should be avoided.

It's just a couple of paragraphs in a larger post on securing your SSH sessions but hopefully it's of interest.

[https://2byt.es/post/totp2](https://2byt.es/post/totp2)

</comment><comment><USER72> Coinbase should not allow your phone number to be used for 2FA.

<comment><USER73> I don't think they'll change it either because doing so would be admitting responsibility.

</comment></comment><comment><USER74> Part of the problem here is the lack of fraud insurance from CoinBase/exchanges. If the attacker would have instead stolen from his bank (several US and Canadian banks I know happily allow logins with only a password or are only starting to introduce SMS-only 2fa), it is likely that the bank would have returned the money, whether they could revert the transaction or not, and then pursued the hackers themselves.

<comment><USER31> _because_ they can (usually) revert it.

Because reversibility is a good thing.

<comment><USER75> Fraudulent transactions made with a regular bank account are pretty irreversible too. There's a whole extra layer of infrastructure on top of the 'core' banking services that allows them (banks) to 'reverse' a fraudulent transaction. But I'd be very very surprised if fraudulent charges are 'reversible' in any other way than the bank reimbursing the account holder.

In other words, crypto-currency exchanges _could_ do the same thing (but then they'd almost certainly have/want to charge for that).

Double-entry bookkeeping is also, ideally, irreversible.

<comment><USER31> Real banks have been hacked (e.g. full mainframe root access), and the hackers have made international transfers which were reversed.

Sure. When bank _accounts_ get hacked sometimes the bank just eats the cost, but if $100k goes to another bank they'll contact that bank to have the money be clawed back.

Now I say "reversed", but the end goal I mean is "the money was transferred back" because it's traceable and doesn't require the cooperation of the receiving account holder. Not that it gets "undone" in double-entry bookkeeping.

Indeed bank hacks have lost some money when the "reversal" incurred currency fluctuation effects. (which could have gone the other way, too).

Also no, regular bank transfers are very reversible because courts can order it so. The justice system can order accounts frozen. With cryptocurrency the illusion is "math is the ultimate arbiter", but of course "math" can't solve "so what happens if one party broke the law", but is forced to answer "well... I guess they win, then".

Also compare smart contracts. You can make an illegal contract. Say the equivalent of selling yourself into slavery. Smart contracts _want_ there to be no court that says "actually, that's slavery, and this contract is void, also the money must be returned". To think that "math" can provide justice better than a justice system is not just holding low esteem for justice systems in general. It's anarchy, and tyranny by exploitation.

"People" are not lawyers, which is why some things are not allowed in contracts. "People" are not coders, which is why smart contracts are also not a thing that will happen (on a scale cryptocurrency people dream of).

</comment></comment></comment></comment><comment><USER52> > In these cases, you might be better off creating a Google Voice phone number > (which cannot be SIM ported) and using that has your 2-Factor Auth recovery > number.

I hoped this too but someone commented to me recently that GV is not immune to porting attacks:

[https://news.ycombinator.com/item?id=19886705](https://news.ycombinator.com/item?id=19886705)

</comment><comment><USER76> Coinbase's password reset delay is a great idea, but not as useful without Coinbase indicating it in the UI for the current session.

</comment><comment> tushar-r Here in India pretty much every online banking transaction requires an SMS OTP. To get a SIM card changed, you need to provide govt ID + you don't get any text messages for 24 hours. IIRC, if you go into a store asking for a SIM swap they also send you an OTP, and ask you to text the new SIM's serial number to a special number to activate it.

</comment><comment><USER14> Seems like a "better than nothing" mitigation for sites that insist on SMS 2FA is using a Google Voice number so the recovery # is 2FA protected.

Out of curiosity are there any decent free/cheap voip services that support 2FA aside from Google Voice? Using the same provider for email + recovery codes makes me a little nervous.

</comment><comment><USER77> I'm curious how difficult it would be to do this hack in Australia. Anyone have any idea?

</comment><comment><USER78> I have access to all of this data for other people because they sign up for services with the wrong email address (mine).

Tying all security to only an email is dumb for important services.

</comment><comment><USER79> Email services like Gmail should not treat all emails as identical. Some emails like change in the security settings eg. password reset, change in 2FA, suspicious activity notifications from Google as well as 3rd party, etc. are more important than usual emails. Such critical emails should not be allowed to be deleted by the user for a certain period of time say 1 week. While it might be annoying to see those emails lying around in your inbox. I would prefer that over an attacker being able to clear their traces after taking control of my account.

</comment><comment><USER80> Do not ever activate password recovery over SMS

</comment><comment><USER81> Yeah this is why I don't have mobile numbers on any of my accounts as a recovery method.

</comment><comment><USER82> Put your number in Google Voice and use two factor authentication. Unlike the phone companies, Google actually has decent security.

</comment><comment><USER83> It's why most of 2FA implementations is BS. It's truly only whoever has access to your number or email can do whatever.

<comment><USER20> I wouldn't say it's BS. It's just not perfect.

The standard person today isn't capable of managing multiple secure tokens, and actually keeping them separate.

One smashed phone, and truly secure accounts would be lost forever, or require significant resources on the part of the provider to re-verify people's identities.

</comment></comment><comment><USER41> This kind of sums up the whole article:

> _I knew the risks better than most, but never thought something like this > could happen to me_

This also explains why this article is useless as a warning. Someone who will be hacked like this in the future is reading now this article and saying "hmm, I should be securing my holdings against this, but I don't have time now, and this won't happen to me right away, I'll look into it next week"

It's like the countless articles which appear after backup failures. "I knew I was supposed to test restoring from backup, but...."

</comment><comment><USER84> Federal laws and the protections/insurances a US bank provides would have you without losses right now. Why do we want a decentralized currency again?

<comment><USER85> A non-federally controlled pseudo-anonymous currency similar to cash has the positive upside of enabling digital privacy in spite of the blockchain. That's why. There are still trustworthy tumbler services to obfuscate and hold your bitcoins similar to a bank. And with what some claim, inarguably so, of government overreach and corporate over-sharing of your personal data, it's something I can sympathize with.

<comment> mAEStro-paNDa Similar to a bank as in a guaranteed insurance of my funds, like the FDIC in the US?

<comment><USER86> FDIC _is_ the government overreach the parent was talking about.

It's also a relatively new thing.

People who cry about government overreach seem to rarely ponder why it is there in the first place. Well, TFA shows why.

<comment><USER87> TFA?

<comment><USER86> The eFfing Article (as in RTFA, "read the effing article"). I.e. the thing we're all discussing here.

<comment><USER87> Thanks.</comment></comment></comment></comment></comment></comment></comment>


Help build a modern, beautiful email client for the free desktop - <AUTHOR> http://www.yorba.org/

<comment><USER2> "so good, you don't know its open source"... well they lost my support

<comment><USER3> Obviously that sounds bad from the perspective of die-hard FOSS users, but I think the point that Jim wants to make is that being FOSS shouldn't be the 1 redeeming quality. It's not a free app first and a good app second.</comment></comment>


Feedback for New Product - <AUTHOR>

Hello Everyone,
We are trying to determine whether our MVP product website is self explanatory. The website is located at http://www.cloudtrailsecurity.com
We are looking for initial feedback on the website content and any help or feedback would be greatly appreciated. Try not to beat us up too much though!
If you have ideas, thoughts, or questions feel free to ask us on twitter @cloudtrailsecur.
Thanks The Cloud Trail Security Team @cloudtrailsecur <comment><USER2> In a couple of key places ("Who has the keys to the castle?" and "WHEN WERE YOUR SECURITY POLICIES CHANGED?") you say "Easily find out..." and "We make it easy to find out...". I suppose that the objective of this MVP website is to explain how you actually make those actions easy. The pictures on the side give some hints... but I would like to see specific and explicit language that explains how you do that. Short videos might help too.

I am no security expert, but I try to read any startup website I come across.

<comment><AUTHOR> Great points! Thanks a lot for the feedback! Getting the wording right is something we have a tendency to struggle at!</comment></comment>


To build the cities of the future, we must get out of our cars - <AUTHOR> https://www.nationalgeographic.com/magazine/2019/04/to-build-cities-of-the-future-stop-driving-cars <comment><USER2> Not exactly rocket science. Many cities around the world have figured it out already. To me it seems that the US went to the other extreme and is only slowly turning around.

I remember reading "Das neue Universum"² in the early 80s where they proposed large skyscrapers connected by tubes. No cars in sight.

Oh and don't miss "Das Neue Universum Volume 84 (1967)": [http://klausbuergle.de/buergle_verkehr1.htm](http://klausbuergle.de/buergle_verkehr1.htm) -

Click on the bottom left image - looks a lot like Hyperloop, doesn't it? The text even mentions that the tubes contain a vacuum!

\--

² [https://de.wikipedia.org/wiki/Das_Neue_Universum](https://de.wikipedia.org/wiki/Das_Neue_Universum)

<comment><USER3> > the US went to the other extreme and is only slowly turning around.

US car manufacturers are doubling down on large trucks and SUVs and the current administration continues to thwart progress on tackling climate change and other societal concerns. I would say the US, at least on a macro level, is still on the "other extreme" path.

<comment><USER4> > US car manufacturers are doubling down on large trucks and SUVs

Manufacturers are building lots of SUVs because this is what people in the US _prefer_ to buy. If manufacturers build tons of subcompacts instead they would have to drop prices and probably sell those subcompacts at a loss.

If you wanted to sell more small cars instead you should convince _consumers_ to buy them (e.g., via end user incentives), which would make it profitable for car companies to build lots of them.

<comment><USER5> Is this really surprising? The benefits of driving a large vehicle are all internal (comfort, safety of vehicle occupants, cargo capacity, range between fueling). The costs, however, are mostly external (road maintenance, emissions, safety of non occupants, space consumed for parking).

You'd need to substantially incentivize smaller vehicles to overcome these things, but we actually incentivize larger vehicles (through looser emissions standards).

<comment><USER6> I think you really touch on the core problem. All the negative externalities are eaten up by the community. The obvious solution is to stop subsidizing cars and instead start teaching the negative externalities. Ready first steps: 1\. massively increase gasoline tax. 2\. Get rid of all street parking.

I personally would prefer to just ban all combustion engines, but people seem to think I'm insane when I propose this.

<comment><USER7> Banning all combustion engines is too extreme, see this chart for reasoning: [https://image.slidesharecdn.com/13hja01motivepowermst-141217...](https://image.slidesharecdn.com/13hja01motivepowermst-141217111900-conversion- gate02/95/13-hja-01-motive-power-mst-17-638.jpg?cb=1418890147)

</comment></comment></comment></comment></comment></comment><comment><USER8> We really do have to radically re-think our cities but the biggest issues aren't going to be practical but emotional. In London parents drive their children around in 4x4s, knowing that their vehicle causes the pollution that is affecting their own children's health. I'm not sure how you even start to get around that but to some extent you will never persuade everybody to reduce their damaging behaviour. You need to enable people to travel in non-damaging ways; cycling and walking primary. That should be the first priority, although fighting the ingrained car culture will be the hardest battle.

<comment><USER9> No. Car is not just the "culture", car serves our need. If you are young without kids, it may not make much difference for you to ride a car, or take a bus, or a train, subway, etc. But if you have a family, it makes a huge pain without your own vehicle.

If the city of future requires families to abandon their own vehicle, it is not the correct city of future. Just design a better one.

<comment><USER10> Millions of people around America get their kids around the neighborhood just fine without a car. If you continue to insist that cities be designed around your limited vision, then you should be forced to pay for the full externalities of your car-centric lifestyle. The rest of us are tired of paying so you can waste our resources.

<comment><USER11> You need to cite a source for that.

Infact if anything, despite the very very recent free-range kids movement to liberate kids from the dependence on parents, its the opposite - kids get ferried everywhere, from high school sports practice sessions to neighborhood store visits.

<comment><USER10> [http://www.pedbikeinfo.org/pdf/Community_SRTSfederal_Trends....](http://www.pedbikeinfo.org/pdf/Community_SRTSfederal_Trends.pdf)

</comment></comment></comment></comment></comment><comment><USER12> I live in Los Angeles; The Mecca for the automobile. Back in the early 20th century, the city was trying really hard to invest in public transportation through the use of electric street cars. Unfortunately, car manufacturers were able to weasel their way into the pockets of the city planners and put a stop to that.

We have a problem in Los Angeles. And that problem is that it's almost impossible to live close to where you work. Most white collar jobs here require an hour or longer of commuting time. Sure, it's possible to find jobs closer to your home, but when you are a professional in a specific field, your choices are restricted.

I live in North Hollywood, which is just West of Burbank in the San Fernando Valley. It's actually miles from Hollywood despite what the name may suggest.

I work in El Segundo. Before that, I worked in Culver city.

It would take me 4 or more hours and several metro -> bus -> metro transfers to get to work without driving.

The city is working on several new Metro lines and Bus only lanes, but it doesn't solve the problem of everyone being so spread out.

<comment><USER13> Do you own your house? I'm curious because you speak as if "where you live" is an immutable fact, whereas my solution would to be to move closer to work.

<comment><USER14> For some people, moving isn't very easy. If you have kids there's the whole issue with switching schools, etc. If you tend to switch jobs frequently it may be a case of just getting settled and now you're in a new job.

Moving is also, for many people, a gigantic pain that they'd rather avoid, even if it means suffering through traffic every day.

<comment><USER13> The original comment says "it's almost impossible to live close to where you work". None of the things you mention come anywhere near the bar of "nearly impossible" in my book. As far as I can tell, it's completely possible.

</comment></comment></comment></comment><comment><USER15> I'm not sure these articles are good for my mental health. I live in Utah Valley, which has the worst air quality in the United States. I'm on the train right now as I type this, it takes twice as long for me to get to work this way but i'm trying to increase train usage. People here are just so invested in making their hour long commutes with their gigantic trucks. Trucks are ridiculously expensive even before you factor in the prohibitive cost of gas and maintenance for them. It still doesn't seem to dissuade anyone.

I'm considering protesting for more environmentally friendly city designs and transportation decisions. I could find an extremely congested intersection and protest by just pressing the walk sign and marching back and forth. Annoying, but probably effective at getting my message seen. I imagine that's the kind of protest that would get me arrested for being a nuisance.

<comment><USER16> Utah Valley (and Salt Lake Valley) trap pollution. There's no getting away from that. But the worst air quality in the US? _After_ Geneva Steel closed? Worse than, say, San Bernardino, where the wind tends to trap LA's smog? I'm kind of skeptical. (Or do you have hard data, which I admit that I don't?)

<comment><USER17> It can change depending on the season and weather, but it is seriously bad and hit #1 for a day in 2017. [1]

The geography does trap the pollution, but having refineries and mining operations just north of the city doesn't help. There are also loads of 18 wheel trucks coming through, since SLC is a bit of a hub area in terms of highways.

Despite the city being pretty walk-able with decent (by US standards) transit, lots of people have at least one large 4x4 vehicle to get up into the canyons. It hurts to see since I understand the appeal of outdoors activities, but this way of approaching them will degrade and ruin the outdoors long term.

[1] [https://kutv.com/news/local/salt-lake-city-has-the-worst- air...](https://kutv.com/news/local/salt-lake-city-has-the-worst-air-quality- in-the-nation)

</comment></comment></comment><comment><USER18> Cool little post by Mr Money Mustache about a twitter post he put out describing a future city without cars. Media picked it up as reality, pretty funny stuff.

[http://www.mrmoneymustache.com/2019/02/27/how-to-create- real...](http://www.mrmoneymustache.com/2019/02/27/how-to-create-reality/)

</comment><comment><USER19> I see it less about eliminating cars (though that would be awesome if possible) and more about giving people alternatives (public transit, walking), which you don't have in American suburbia.

Much of the rest of the world has already figured it out. I'm in a "suburb" of Seoul right now. I can get to Gangnam in 30 minutes door to door via the subway (subway ticket is ~$2 each way). I'm a short walk (< 5 mins) to grocery stores, restaurants, coffee shops, etc. It's all apartments here, which is why everything is so walkable. Of course this means less space than a house, but it's quiet and there are plenty of parks/green and a big lake nearby (5-10 minute walk).

Meanwhile back at my parents' house in the suburbs of Washington DC, the closest commercial business I can walk to is a gas station 20 minutes away, next to an ugly car-ridden highway. The nearest grocery store would require crossing that wide road and walking an additional 10-15 minutes through a massive parking lot. There is no viable public transport - if I want to take the subway into DC I need to drive 15 minutes to the nearest subway station (subway ticket is ~$5-8 I believe). Although my immediate neighborhood is very nice in the sense that there are a lot of trees, there actually aren't any parks (unless you count the local elementary school) or businesses of any form, including simple convenience stores (something I noticed is commonplace in most of the rest of the world).

Everytime I'm at my parents' house I'm completely dependent on having a vehicle to do anything, and bored out of my mind within about a week because it's extraordinarily isolating. I get very little exercise because I end up just staying in my house all day because there's little to do. On the other hand I can be in "city"-like suburbs like the one I'm in now and not feel lonely even if I don't talk to anyone because I can just step outside and there are people everywhere, or go walk to one of the million coffee shops nearby that are always packed with people hanging out.

I despise American suburbs. Who decided that the "American Dream" is owning a single-family home in the suburbs? I guess I'm just not enough of a hermit to enjoy that lifestyle.

</comment><comment><USER20> This is one of the reasons the self-driving craze in tech is so silly: We have vehicles you can commute in and not drive called public transit. Self-driving cars is desire for public transit that doesn't have your rich self sitting next to a poor person on the way to work.

<comment><USER21> Or you know people that value their time...

For me to use Public Transport here would increase my commute time to work by order of magnitude, not to mention all the places I go weekly that is not on a public transit stop or would require multiple line hops and be many times more time consuming than if I just drove directly their in my own personal vehicle

Public transport only works in area with High Population Density

<comment><USER22> I can't imagine how bad public transport must be to increase your commute time by an _order of magnitude_. I use public transport precisely because I value my time - it takes longer(around x1.5) than using a car, but that time is relaxing, can be used to read a book, listen to a podcast or just order your thoughts. Time spent in a car is stressful and requires your focus and attention.

I'm not sure what kind of population density you need to make public transport workable, but it's a blessing when you have it available. There's some sample math at the end of this article([https://www.ptua.org.au/myths/density/](https://www.ptua.org.au/myths/density/) \- technical appendix) which concludes that you don't really need that high a density(it focuses on Melbourne), as long as people actually prefer to use the public transport service over their own cars.

<comment><USER23> It depends on local details. In most large cities public transit assumes you live in the suburbs and work downtown. Jobs are moving to the suburbs, to get to them means a ride downtown, and then a ride back out. I know of people with a 4 mile commute who drive (why they don't bike is a good question) because they bus ride would be 3 hours each way.

<comment><USER20> As a Chicago native, I can definitely see a case for like a north-south suburban Metra line, being potentially amazing. But our rail system primarily piggybacks on freight lines which all are concerned about going to/from Chicago proper.

I don't feel buses are nearly as productive because of traffic. There are some nifty routes around Chicago where buses are allowed to drive the shoulder in traffic jams, and hence, do better than cars on travel time, but the north- south suburban expressway doesn't have that arrangement.

</comment></comment></comment></comment></comment><comment><USER24> I'd argue that cities will shrink over time. It's going to become easier for people to live in rural areas. I don't think there is some magic formula to manage the inevitable congestion (not just traffic).

Edit: It'd also be interesting to see the environmental impact of mega cities. And what about cities like Portland where they have put in a lot effort to plan around growth? Is it working?

<comment><USER25> It's not happening though.

My parents live in a beautiful part of the rural UK and have super-fast fibre to the premises internet, next day Amazon prime available, online food shopping from 4 or so supermarkets locally, etc.

Basically everything you'd think you'd need to live away from the city, but still the area is depopulating rapidly.

Younger people don't want a life of car dependancy and social isolation.

<comment><USER26> > Younger people don't want a life of car dependency and social isolation.

When I moved from my families acreage that was 10 minutes out of town it wasn't because of social isolation or car dependence - it was because I couldn't get an post-secondary education in my community. Even if I hadn't gone for an education, there was a ton more employment opportunities in the urban centre. I stayed in the city because "junior software developer" is a super hard sell in a town of 2,500. Now that I've more experience I could probably swing the "work remote" thing, but it just wasn't an option starting my career.

<comment><USER25> Ah yeah I didn't mention employment which is clearly the biggest barrier at the moment to living outside urban areas, as I assumed the parent comment was suggesting remote working is what will enable moving away from big cities.

</comment></comment></comment></comment><comment><USER27> If our species is to survive this century we have to get out of our cars. There is no way to sustainably build billions of electric cars- we need to consider that our existing ICE fleet needs to simply be retired and not replaced. Cars are one of the ultimate symbols of the consumption that needs to end if we are to address climate change. Between the asphalt and concrete needed to build infrastructure for them to the plastics, rubber, and metals used to manufacture them cars are rolling ecological disasters.

<comment><USER28> Any solution which requires people to give up convenience in the name of saving the environment is dead on arrival. This is human nature, we have never before managed to conserve our way out of a problem, we _innovate_ our way out of it or we will die trying.

<comment><USER29> I wonder if we can get people out of cars unless cities themselves are completely redesigned. We committed ourselves to a harmful design pattern but unfortunately everyone is heavily invested in it. Need to have a city design that will work, and then draw up a series of implementation steps to move existing cities to the new design. Would require a ton of central planning/control though, doubtful we could pull it off unless things got drastically worse to motivate people.

</comment></comment></comment><comment><USER30> Hi HN! I'm the Director of Engineering at UrbanFootprint ([https://urbanfootprint.com/](https://urbanfootprint.com/)), one of the companies featured in the National Geographic article. Peter Calthorpe is a cofounder of the company. The El Camino corridor is highlighted at the beginning of the National Geographic article. If you want to dig into more details on that please take a look at our blog post on the topic from last year ([https://urbanfootprint.com/can-one-street-solve-the-san- fran...](https://urbanfootprint.com/can-one-street-solve-the-san-francisco- bay-area-housing-crisis/)).

At UrbanFootprint, we provide data and tools for urban planners to assess and compare the impacts of land use and transportation decisions. A basic use case is a city updating its General Plan, which would start with a forecast of how much population growth is anticipated / needs to be accommodated. A planner then needs to assess where new residents will live, work, shop, and play. Perhaps even more essential, how are people going to travel between all of these activities? Will the new growth be auto-dependent, transit-focused, walkable? Is any of the existing or planned development in hazard areas such as flood of wildfire? What are the energy and water use impacts of the plans?

We're using Python and Postgres/PostGIS on the backend to answer these questions and a React SPA to serve it up and make it interactive in a browser. It's a lot of fun getting our hands dirty with data describing the physical world in which we live in now, in addition to modeling the future of cities.

If this type of work interests you please get in touch - email me at email@example.com. I'm always interested in hearing from folks who want to use technology to improve cities.

</comment><comment><USER31> Cars are not the cause of the issue with cities, cars are symptom of bad zoning and regulation which more times than not prevents owners of property from doing what they want.

when every new building requires effectively bring special interest groups, politicians, regulatory boards, and unions, their due is it a surprise cities are not getting better.

they are serving a politically connected elite, not the people who live there or want to live there.

<comment><USER32> In cites like Los Angeles, cars are part of a feedback loop which makes them both symptom _and_ cause.

Los Angeles is low-density partly because it spends lots of land on roads and parking lots. It needs lots of roads and parking lots because everyone drives. And everyone drives because the city is low density.

<comment><USER33> The solution is to bite the bullet and build the rails. They didn't build highways to already existing suburbs in the valley or where wildfires have been roasting for 100s of years; those things popped up because the land was empty and the highway made building possible. If you build the rails and zone the area by the rail for density, a developer looking to drop a 15 story apartment is going to want to put it by the rail. Even better if you nix the rule about having to build parking if they build close enough to the rail. You can't do anything without the rail being built first.

<comment><USER34> The solution to bite the bullet though is economic incentive - tax driving more, eliminate parking, etc. The pain should come first; otherwise, why would anyone (in sufficient numbers) bite the bullet?

</comment></comment></comment></comment><comment><USER35> In Orson Welles' classic film, "The Magnficent Ambersons", one of the original inventors of the automobile predicts the changes, many negative, that the automobile will bring to civilization. Almost exactly 100 years later it sounds quite prescient:

[https://www.youtube.com/watch?v=fTTF2QIHDCM](https://www.youtube.com/watch?v=fTTF2QIHDCM)

</comment><comment><USER36> This link was once on HN

The Real Reason Your City Has No Money

[https://www.strongtowns.org/journal/2017/1/9/the-real- reason...](https://www.strongtowns.org/journal/2017/1/9/the-real-reason-your- city-has-no-money)

</comment><comment><USER37> Most cities don't need cars. It's already like this you don't need to go to the future.

Suburban layouts were actually the new thing that came after cities. The reason why we need cars is because of suburbia. For suburbia to function you have to live very far away from work and in very very low density neighborhoods where public transportation is virtually impossible to build. See Los Angeles.

</comment><comment><USER38> My City is double decking highways all the while building zero new rail and or bike lanes.

They are doubling down on stupid.

<comment><USER39> They are doubling down on what a lot of their population wants. A lot of what gets left out of the discussion of cities in the US is that tons of people have no interest in public transportation due to bad experiences or preconceived notions.

People need examples of good public transportation in the US beyond NYC or Chicago because those cities come with a lot of other baggage (high taxes, high rent, high CoL in general). Without an example, it looks to a suburbanite like the trade off is they lose their yard and 75% of the square footage of their home for less flexibility and a dirty transportation experience.

These people do not marvel at the efficiency of the Yamamote line as people are shoved in by train operators during rush hour. They hug the steering wheels of their luxurious personal space SUVs.

What makes it worse is that prominent politicians in the US on the side promoting public transport don't bother to use it when slightly inconvenient (e.g. the "scandal" of AOC using a minivan when she could have taken a subway). Even people on the "left" aren't leading by example.

<comment><USER40> AOC is mobbed like a celeb when in public and has received death threats online, yet you fault her for no longer taking the subway?

Regarding realistic trade-offs: I live in Seattle in a 1200 sq ft townhome. I commute 20-25 mins on public transit (where I read or otherwise zone out). For what I pay in rent, I could move to the suburbs and get a 2000 sq ft house. But that comes with a stressful 60 min commute in traffic and $15 a day for parking.

</comment></comment></comment><comment><USER41> Funny how the loudest voices in these sorts of articles are always from places with temperate weather.

<comment><USER28> And places that are already dramatically denser than the vast majority of the developed world.

Over the weekend I found myself looking for a place in Europe in satellite view, outside of an urban core, and I was struck by how many single-family houses there were, complete with driveways and cars. Here on HN I have been led to believe that Europe is a utopia of forward-thinking people too concerned about the environment to pollute it with a car that might also kill innocent pedestrians who just want to walk to their local grocery store.

HN readers have created a lovely bubble for themselves.

<comment><USER42> By definition, places with high population-density are the places where a lot of people live. It is not a "bubble".

<comment><USER28> The bubble is here on HN where people routinely talk about America as if it is one big suburban hellhole and Europe as if it is one big metropolis paradise.

</comment></comment></comment></comment><comment><USER43> If you are interested in learning more about how cities are dealing with the myriad of challenges outlined in the National Geographic article, I encourage you check out UrbanFootprint ([https://urbanfootprint.com/](https://urbanfootprint.com/)).

Building off our background as urban planners, the UrbanFootprint software platform helps communities, cities, and regions deal with the challenges that they face. We bring data, analytics, and most importantly, actionable insight to problems such as congestion, pollution, accessibility, and risks like flooding, sea level rise, and fires.

The software is used by public jurisdictions across the country, the private consultants who consult for those jurisdictions, and by others in real estate, finance, and new mobility modes.

</comment><comment><USER44> What gets me about these densification of suburban center proposals is that they don't come with racing the sprawl. If you just create more "central", well assuming some x-far-from-center contour lines distribution you might be creating more sprawl too.

We need to demolish our mistakes not just build new non-mistakes. We need fractal density so everyone gets both green space and high density very close, and reclaimed nature and super density not far away either.

Go to inwood Manhattan to feel what reclaimed natue is like.

</comment><comment><USER45> I'd hate walking everywhere, having to get tiny amounts of groceries every day instead of stocking up every 2 weeks, etc. Walking/standing all day at conventions feels like death and a half a mile trip to the fast food places around here turns from 2 minutes to 10 minutes if I walk, which I tried when someone from Europe said that's walking distance. Walking such distances just makes me constantly wish I was driving or something. I find the drive thru experience really nice - bring the dog along in the passenger seat, get a burger, eat in the parking lot and give her some of the beef, whole trip takes under 10 minutes. A joy instead of a drag like walking is.

If a city of the future must abandon cars then the way I'd like it is if there were equal or less walking compared to driving. Futurama tubes would be great.

Side note: "No walking is a prescription for obesity" \- exercising for weight loss has been thoroughly debunked. [1]

1: [https://getpocket.com/explore/item/why-you-shouldn-t- exercis...](https://getpocket.com/explore/item/why-you-shouldn-t-exercise-to- lose-weight-explained-with-60-studies)

<comment><USER46> Sounds like my experience living in Houston. Of course I'd hate living here without a car, I did it for a few months and it's ridiculous. But compared to Montreal, Sydney, Toronto, or even Philadelphia (my points of reference), this is far and away the worst living experience. My commute to work is 15 minutes, which isn't too bad. It used to be a 10-minute bike ride or 20-minute walk, which was both healthier and more enjoyable, not to mention more environmentally friendly and free. I enjoyed getting groceries every few days: picking up some produce and bread on the way home from one of the dozens of businesses on the way was delightful, and meant I could always have fresh food.

Living in suburban America (it's hard to call Houston a city in the same sense as the ones I mentioned above) is emotionally draining. Yes, there are positives: good food, good beer, cheap cost of living. However, I don't feel like I'm part of a community. I feel like I live on a small island in an archipelago of disconnected islands. It feels like everybody here who hasn't lived in a walkable dense urban city doesn't know what they're missing, there are intangible psychological benefits. Of course, these are just the thoughts of an east-coaster.

<comment><USER28> Different strokes for different folks. My suburban neighborhood is very socially active, we all know each other very well. I know their kids and vice versa, etc. What I find draining is all the noise when I go downtown, and being around so many strangers. I visit friends who live in condos downtown and they don't know their shared-wall neighbors as well as I know mine in the next house over. Everyone just retreats back to their personal cave once they're done dealing with the crowds.

<comment><USER46> I'm sure my experience is partly due to my own learned preferences, as well as the specifics of my neighborhood. I know there are nice suburban and rural areas to live, and I hope that with time I develop a greater appreciation for what's here.

</comment></comment></comment></comment><comment><USER47> > In the 1990s Calthorpe scored a breakthrough: He helped persuade Portland, > Oregon, to build a light-rail line instead of another freeway and to cluster > housing, offices, and shops around it.

Mr Calthorpe is playing simcity in Real Life, ENVY!

</comment><comment><USER48> Show me a carless city with nice weather most of the year that I can easily get a visa to live in, and I'd strongly consider it! Bonus if it's in US/Canada.

<comment><USER33> Portland, OR

</comment></comment><comment><USER49> Honestly one of the bigger potential benefits of self-driving cars would be the decreased need for parking and resulting increased density.

</comment><comment><USER50> In addition to convenience, habit, and layout of cities and living areas, I'd say that a big push for cars is personal security.

</comment><comment><USER51> Improving life in cities is a matter of fixing existing problems, like poor public transport and pollution from combustion engines and heating. Building a "feel good" fantasy around the hatred of cars isn't going to improve anything, it'll just replace the current best choice for individual transport with something inferior, as well as destroy the economy (which depends on roads for logistics and public services).

<comment><USER52> I don't think its a hatred of cars. Its just cars are so entrenched in western cultures that its easy to overlook all the problems.

All those things you cited are all exacerbated by the car. Electric cars will solve the pollution issue, but they are still cars, with all the issues they bring.

<comment><USER51> > I don't think its a hatred of cars. Its just cars are so entrenched in > western cultures that its easy to overlook all the problems.

They are entrenched for a reason: because they are extremely useful. Without cars and the individual transport methods they superseded, many of our cities wouldn't even exist.

What this and many other articles do, is to decide first what the problem should be and then build a case around it to show it in a bad light. That's not how you improve life in cities, it's just how you get rid of cars and with them all the benefits you've overlooked. Proof: you can get all the benefits of cars without the drawbacks by putting all the infrastructure for cars underground and using EV. None of these "visionaries" consider that, because they hate cars.

<comment><USER52> I don't think there are any cities that wouldn't exist without cars, the shape of cities would change yes, but that is one of the problems of cars.

Cars are useful yes, doesn't mean we shouldn't question them. Just like we should question trains, bikes etc.

Re putting cars underground. Yes you could, are you going to support the taxes to pay for it?

"What this and many other articles do, is to decide first what the problem should be and then build a case around it to show it in a bad light."

Why don't you decide on the merits of the argument rather than perceived motivation?

</comment></comment></comment></comment><comment><USER53> Eventually, cars will become a shared resource right? If cars can drive on their own then you could rent your car out while you're at work to lyft or uber. Eventually wouldn't most people do this? Eventually, wouldn't there be a multitude of cars roaming the city? Why would you need to own one?

I live in a fairly walkable city but it still seems odd to me that people hold such a personal connection to their cars.

<comment><USER54> Well, I also use my car as a giant man-purse. Furthermore, sometimes you want to travel out of the beaten path and it's possible that the only way you can get there is with your own car.

</comment></comment><comment><USER55> > they'd no longer segregate rich from poor

Should people who want to spend more on housing be automatically labeled "rich"?

<comment><USER56> Should people who _can 't_ afford housing be automatically labelled "poor"? It's certainly one indicator.

Not segrating people improves the world. Segragating them introduces division, self-evidentially. Something to be avoided, then, and worked against.

Planners will try to mix properties in a new development, if the local politics is to provide for everyone fairly.

<comment><USER23> You cannot mix a new development like that. Building a house is expensive, so only the rich and upper middle class can afford it. The poor always have and always will live in the houses the above lived in some years back and left for something newer.

What planners need to do it make sure that when the rich vacate the neighborhood they left behind is good. Part of that is making sure that some of the rich decide to rebuild their current house instead of leaving thus mixing the neighborhood a bit.

Cities are a long games. The "ideal" state you plan today to build tomorrow is not the end state. That means your plans need to account for change. New development will be old in 20 years, what then?

<comment><USER57> "Mixed Income Housing" is becoming more and more prevalent, it decreases segregation by forcing proportions of new development to include low income housing.

Possibly your statement: "You cannot mix a new development like that. Building a house is expensive, so only the rich and upper middle class can afford it. The poor always have and always will live in the houses the above lived in some years back and left for something newer." could be a bit of an absolute.

<comment><USER23> One of two things are happening: either the mixed income is richer and middle class - as I already said; or the rich are paying extra for their house to subsidies the house of the poor. Probably a mixture of each.

</comment></comment></comment></comment></comment><comment><USER58> We need to expand the remote work force and create AR devices that can replace mobile phones to make collaborative sustainable living a reality.

</comment><comment><USER59> Obviously.

</comment><comment><USER60> I hate cities and love driving my truck, take that old boy in mud and have something I enjoy in life. There is plenty of these stories.

Will one give up himself to go on as husk.</comment>


How to build powerful REST APIs blazingly fast with Node.js - <AUTHOR> https://hackernoon.com/how-to-build-powerful-rest-apis-blazingly-fast-with-node-js-86d6e55a5b34 <comment><AUTHOR> Hi HN, I'm launching v1 for a project I've been working on for two years now. Please check out the article and let me know what you think :)</comment>


Texty: SMS Text Messages from Google Chrome Using Your Phone # - <AUTHOR> http://lifehacker.com/5799144/texty-sends-text-messages-from-google-chrome-using-your-phone-number-and-weve-got-beta-invites

<comment><USER2> The base functionality - being able to text from my computer - is great. I wish the texts in Texty were kept in sync with those on my phone, though.

UI is a bit buggy as well, too.

Again though, the base featureset is a big win.

</comment><comment><USER3> Great job! Was being funky at first but it was my fault -- I had 3rd party access disabled in the MIUI ROM's messenger settings. (Droid Incredible) No problems thus far, aesthetically things could be better but the functionality is there. Feature request? I think it would be awesome if you could almost imitate the "Bridge" functionality of the BB PlayBook -- E.g. send texts to a Honeycomb tablet.

</comment><comment><USER4> I have it installed, I seem to have issues sending texts from the web interface. Reading them and the notifications are great though. I tried emailing your support email and that bounced too.

Desire,cyanogen7

<comment><AUTHOR> you emailed info at textyapp dot com?

<comment><USER4> email at textyapp dot com

It was listed somewhere - can't remember where, I'll forward the original to you now.

Keep up the good work.

</comment></comment></comment><comment><USER5> Works well...love the popup notifications. seamless with my workflow.

</comment><comment><USER6> another great google feature.

i had struggled with 4 pc sync apps to pc programs via USB.

this just worked..</comment>


Ask HN: what would you ask Scott Cook, Intuit co-founder? - <AUTHOR>

Mr. Cook's speaking at my school tomorrow and I'm eating lunch with him. I don't want to waste the opportunity; what should I ask about? <comment><AUTHOR> Scott Cook Bio - <http://www.inc.com/magazine/20040401/25cook.html>

Cook onstage at TC Disrupt <http://techcrunch.com/2010/09/27/ge-intuit- tcdisrupt-sf/>

Scott Cook working a trade show booth <http://news.cnet.com/8301-17939_109-10133923-2.html>

</comment><comment><USER2> Dunno - I don't know anything about him. Does he come from an entrepreneurial background? It might help if you could post a bit of his bio in your question so we don't have to look it up.

I'd certainly be interested in how the Mint acquisition came about - timing, why Mint, has he read the "Why Wesabe Lost to Mint" post, etc

</comment><comment><AUTHOR> note: I'm doing my own preparation as well but I've never, for example, worked at Intuit or Mint and I've never met Mr. Cook before.</comment>


Zero Rating: What It Is and Why You Should Care - <AUTHOR> https://www.eff.org/deeplinks/2016/02/zero-rating-what-it-is-why-you-should-care <comment><USER2> From the article: "In a nutshell, zero-rating plans exempt particular data from counting against a user's data cap, or from accruing any excess usage charges.

The most dangerous of these plans, such as the AT&T and Verizon offerings, only offer their users zero-rated data from content providers who pay the carriers money to do so.

Such "pay for play" arrangements favor big content providers who can afford to pay for access to users' eyeballs, and marginalize those who can't, such as nonprofits, startups, and fellow users."</comment>