etbe – Russell Coker

Below is a post I wrote about the FLX1s before it broke at the start of September, there was a problem with the display controller and it would randomly go into a messed up mode that wasn’t readable but also changed a bit in relation to button presses etc so the phone was still working. Also I could ssh to the phone when it was in that state if it was on my home wifi.

It took almost 2 months to get a replacement phone but I now have that working and the new 14.1.0 OS release. So some of the below may be obsolete when it comes to the latest release but I decided to publish it anyway for history if nothing else.

Current Issues

Wifi Hotspot Status

One thing I had known about but not mentioned before is that the icon in the drop-down menu for the hotspot will often be gray (indicating hotspot-off) when it’s actually on. To address that I have to click on it (which then indicates that the hotspot is on) and then click on it again to turn it off.

QT6 and MESA GL

Currently I have problems with QT6 applications that don’t run due to library issues and issues of missing GL support. I blogged about setting up my own container on my phone [2] which helped for some things but not for most things.

I have given up trying to get Tokodon working on the phone for the moment. Tokodon is a nice Mastodon client that would allow me to get notifications from Mastodon.

Apparently the Furilabs people are working on some issues related to this.

Bluetooth

Bluetooth is currently a bit unreliable. When I turn on my car (Nissan LEAF) the phone usually either doesn’t connect or claims to be connected while not sending audio to the car. When it does connect my favourite music player (Lollypop) usually doesn’t display the album and track names. I’ve found that turning my car off and on again usually makes it connect properly.

I admit the possibility of my car not doing things correctly in this regard. But every Android phone I tried just worked, they would connect as soon as the car was turned on and correctly display track names. So if the car is doing things wrong and needs a software work around then Linux is at fault for not doing that – we can’t get tens of millions of cars and hundreds of millions of other weird devices fixed!

I also note that my Debian laptop and a friend’s Debian laptop also have problems connecting to my car. So it’s quite possible that Debian code is at fault (the FLX1s is running a modified version of Debian).

It currently appears to have no support for handset mode so I can’t answer phone calls through the car interface. But this is a lesser problem.

I plan to do more testing with Debian laptops and file some bug reports if I can find out enough useful information. My current knowledge of this is insufficient to create a useful bug report. I do have quite a few bluetooth headsets and test laptops so I plan to start by testing Debian and Ubuntu on all the combinations – last time I tested Ubuntu 24.04 on Dell laptops worked much better than Debian/Trixie on Thinkpads.

Improvements by Furilabs

Wifi Hotspot

After a set of updates including the following Wifi hotspot seems to be working.

adaptation-furiphone-radon (1.3.0+git20260513192743.e94f2ec.forky.production) forky; urgency=medium

  * NetworkManager: sync hotspot channel/band with STA and restart on change
  * debian: depend on libhybris-utils and libgbinder-tools
  * startup: drop schedtune and add m4u debug log level
  * startup: enable glove and disable edge palm
  * device: drop flashlightd-scalable signatures

 -- Bardia Moshiri   Wed, 13 May 2026 15:27:43 -0400

Charging

Connecting the power cable now makes the phone immediately make the click sound and it starts charging while previously there was a 22 second delay. Once I get used to this I can avoid the problem of failing to plug it in firmly before going to bed and having it run flat overnight.

Things I’ve Done

SMS

The following command will send a message via SMS.

dbus-send --system --print-reply --dest=org.ofono /ril_0 org.ofono.MessageManager.SendMessage string:"+61400000000" string:"this is the message"

Also the Librem5 Wiki has another way of doing it [3], I haven’t tested if that works as the dbus method works well enough for the moment.

Also calls can be scripted via the following command:

xdg-open tel://+61400000000

Contacts

My aim is to get contacts synchronised via my own cloud service. Nextcloud is supposed to be able to do this. It’s been years since I first tried this, my most recent serious attempt at Nextcloud was in 2021 [4] and I couldn’t get the Android app for NextCloud to connect. Since then I have made more recent attempts and been unable to get the Android or Linux desktop clients to connect to it.

A friend gave me a test account on his Nextcloud server which allowed me to connect the Linux desktop app, his hypothesis was that it was somehow related to using Debian and that his server worked because it was on Ubuntu. I have since installed my own Nextcloud test server on the Ubuntu variant used by the Oracle cloud VMs which had the same apparent problem. I conclude that it’s not Debian at fault but something related to how I configured it.

In the meantime after a couple of months of having no named contacts I exported the contacts from my Android phone as a VCF file and imported them into the Gnome contacts program. I had to run “killall chatty” for it to get the names for the contacts, but the phone call program found them without needing to do that.

Chatty

A missing feature of Chatty (the default SMS and Jabber program for Phosh/Phoc systems) is archiving old messages. I use Chatty to receive Jabber messages from my monitoring system which can be a lot of messages. The following shell code deletes all Jabber messages older than 2 days. Note that this relies on “type=3” matching Jabber messages which I’m not sure is going to be the case on all systems or all versions of Chatty.

for ID in $(echo "select id from users where type=3;" | sqlite3 ~/.purple/chatty/db/chatty-history.db); do
  echo "delete from messages where sender_id=$ID and time < unixepoch('now') - (48 * 3600);" | sqlite3 ~/.purple/chatty/db/chatty-history.db
done

The following shell code extracts a dump of all messages from Chatty.

echo "select messages.id,users.username,users.alias,messages.body from messages inner join users on messages.sender_id=users.id;" |sqlite3 ~/.purple/chatty/db/chatty-history.db

Dino-IM

An update to the Chatty program for SMS and Matrix has made it crash repeatedly. There is a request in the list for Chatty upstream to have a systemd-user unit to restart it which when implemented will reduce the scope of the problem (but not solve it). I've setup a monitoring system that uses notify-send to notify me when Chatty isn't running or when 4G data turns off (a recurring problem). This crashing is allegedly due to Jabber so I installed Dino-IM for Jabber and have for the moment at least stopped using Chatty for Jabber.

It turned out that having Chatty not do Jabber didn't stop it crashing. However having alerts separated from SMS can be convenient and also my long term plan is to use a phone with Plasma Mobile and Spacebar (the SMS program for Plasma Mobile) doesn't do Jabber. So I will continue using Dino-IM.

echo "delete from message where time < unixepoch('now') - (48 * 3600);" | sqlite3 ~/.local/share/dino/dino.db

Andromeda/Android

I put in the following cron job to stop this log file from using all the storage space:

1 0 * * *	echo -n > /home/furios/.local/share/andromeda/data/system/uiderrors.txt

Wifi DHCP

I gave up on attempts to force the Wifi configuration to have a fixed MAC that I could use for a fixed IPv4 address so I manually configured the address.

4G Monitoring

I've had problems with the reliability of the 4G service, sometimes it stop working and I need to stop and restart it. I setup my etbe-mon monitoring system on the phone [5] and configured it to ssh to localhost and run notify-send to send a local notification. This means I get notified if my phone loses net access and can't access regular monitoring. Then to monitor the 4G connection (which I want to have working even when Wifi is connected) I had the following monitor line:

monitor ping.monitor -I ccmni1 -c 5 8.8.8.8 ;;

That uses the ccmni1 interface for pinging 8.8.8.8 (Google DNS). That worked for a while but I discovered that sometimes the interface for 4G would change to ccmni2, so I put the following monitor script under /usr/local/mon.d:

#!/bin/bash
DEV=$(route -n|grep ^0.0.0.0.*ccm |sed -e s/^.*ccmn/ccmn/)
exec /usr/lib/mon/mon.d/ping.monitor -I $DEV -c 5 8.8.8.8

Mastodon

I couldn't get Tokodon to work, not the native package, not running in a Debian/Testing container, and not running a Flatpak. It seems that this is all graphics library issues. So I wrote a Perl program to run "toot notifications &-json" and then send the relevant parts of the output via XMPP. As I already use XMPP for server monitoring there's no extra effort to have an extra account and use it for notifications about Mastodon activity. The Perl script is at the bottom of the post and won't be in the RSS feed.

At some future time I may change the script to send the notifications by Matrix instead to have all my social media stuff in the same place.

Source

#!/usr/bin/perl
# depends on Debian packages: toot libjson-pp-perl go-sendxmpp
use strict;
use JSON::PP;

my $homeurl = "https://mastodon.nzoss.nz/";
my $lastfile = "mast/last_id";
my $xaddr = "russell\@coker.com.au";

my $jsontxt;
while()
{
  $jsontxt .= $_;
}

my $data = decode_json($jsontxt);

my $last_id = 0, my $new_last_id;
if(open(ID, "<$lastfile"))
{
  $last_id = ;
  close(ID);
}
$new_last_id = $last_id;

for(my $i = 0; $data->[$i]; $i++)
{
  my $id = $data->[$i]{id};
  if($id <= $last_id)
  {
    next;
  }
  if($id > $new_last_id)
  {
    $new_last_id = $id;
  }
  open(XMPP, "|go-sendxmpp $xaddr") or die "Can't send XMPP";
  my $type = $data->[$i]{type};
  print XMPP "type: $type\n";
  print XMPP "their_url: $homeurl\@$data->[$i]{account}{acct}\n";
  print XMPP "display_name: $data->[$i]{account}{display_name}\n";
  if($type ne "follow")
  {
    print XMPP "status_url: $data->[$i]{status}{url}\n";
    print XMPP "content: $data->[$i]{status}{content}\n";
  }
  print XMPP "created_at: $data->[$i]{created_at}\n";
  print XMPP "\n";
  close(XMPP);
}

open(ID, ">$lastfile") or die "Can't write to $lastfile";
print ID $new_last_id;
close(ID);

Fuel Should be More Expensive

etbe — Fri, 30 Oct 2026 06:16:26 +0000

The Current Situation

Before the US and Israel started attacking Iran at the end of February the petrol prices in Australia were around $1.70/L, which for American readers is roughly equivalent to $US4.64/Gal. By the 11th of March the prices were around $2.19/L. Over the same time period Diesel went from around $1.77/L to $2.40/L. The 11th of March prices weren’t necessarily unreasonable prices. In mid March it was reasonable to expect that the US would stop doing such ridiculously stupid things and make a deal with Iran to allow oil to be transported.

But every time you think there’s a limit to Trump’s stupidity (and the incompetence of people around him who don’t point him in the right direction) they do something worse. So now we have the Strait of Hormuz almost entirely closed cutting off oil from Kuwait, Qatar, and UAE. The Bab al-Mandab Strait is closed to Saudi linked ships and the Saudi East-West pipeline is closed so once the Yanbu storage tanks are empty there won’t be much if any oil from Saudi Arabia for some time. So world oil supplies will be significantly reduced for a long time.

Currently the petrol prices in Melbourne are around $2.30/L and Diesel prices around $2.70/L, not much more expensive than it was in March in spite of all the extra problems both militarily and diplomatically since then. Those prices have been steady for over a month.

The blockade of the Strait of Hormuz could be ended fairly quickly and there are reports that a lot of the oil that used to go through it is being re-routed. The damaged infrastructure throughout the middle east can’t be fixed in a hurry. The Bab al-Mandab Strait probably can’t be opened quickly as the Houthis probably don’t have a centralised command structure that allows someone to order a ceasefire and have it stick. So we can expect a massive reduction in world oil supplies for a while, which given the way the US is going could be at least until after the mid-term elections (November this year) and possibly until after the 2028 elections. After that oil production will be reduced for another year or two to rebuild infrastructure.

The Problem

When supply can’t meet demand there are three options. Supply can be rationed, demand can be decreased by increasing the prices, or it can be used up and we run out. Running out of fuel is a really bad option as fuel is needed for producing and transporting food and for most things that are important to a society.

Governments of first world countries seem unable to deal with the situation properly. Dealing with it properly requires either rationing or increasing the prices. Instead governments have been more interested in artificially keeping the prices down.

Currently in Australia and most countries a significant portion of public transport depends on Diesel fuel. Diesel is needed for most buses and for long distance trains. Most taxis run on petrol. As far as I know all emergency service vehicles run on Diesel or petrol as well as most military vehicles. So things will get really bad quickly if fuel runs out entirely. It’s not just personal cars that are affected.

We aren’t going to get the majority of tractors converted to electric power any time soon. Google search results suggest that tractors last an average of about 25 years but casual observation of working equipment on farms suggests a longer life than that is common. Some tractors could be retrofitted to be electric but many will end up being scrapped as part of a conversion while farmers are already having financial problems. It would probably be optimistic to expect that half the tractor use could be done with electric tractors in 10 years time unless there are significant government subsidies. To get the farming and food production industries adapted for electric operation in a few years would be possible but it would take a level of national mobilisation that only happens during wartime.

What We Need

As a long term solution we need to have more electric vehicles in every category. We need electricity for all train lines to replace Diesel locomotives. We need better trains between cities to reduce the need for aeroplanes, electric aeroplanes are being developed but we aren’t there yet. We need all essential services to be run with electric vehicles including farming, food transport, emergency services, and everything related to the medical system (including personal cars for healthcare workers). We also need mining vehicles powered by electricity so we can have the entire industrial system running without fuel. None of this is going to happen in time for this crisis.

Electric buses are being introduced in Australia and many taxis are electric. The recent significant increase in the use of electric cars probably includes a reasonable portion of healthcare workers and other essential workers. This gives us the potential to survive fairly severe reductions in the fuel supply without everything collapsing. But we have a significant lack in electric police cars and in electric trucks for food delivery.

In the short term we need to significantly reduce the use of fuels, there is no other way to keep the food supply and other essential parts of society working. We could try rationing but I think that should be a last resort. The news reports of a de-facto petrol rationing system in Crimea and parts of Russia are not positive, significant resources are wasted in long queues for petrol and there is public disorder caused by disputes about position in the queues. The level of sanity in the population seems to have dropped significantly since the fuel crisis of 1979, any fuel rationing that is implemented now would get the same sort of opposition from Qanon types as Covid vaccines and lockdowns did in recent times.

So the best viable option seems to be to reduce demand by increasing prices. $2.30/L as a common price with occasional spikes of $2.50/L isn’t sufficient to do that. If the price increased to $3.50/L, twice what it used to be (equivalent to $9.50/gallon for Americans) then it would provide a real incentive for people to reduce fuel use. That would have to be combined with the type of remote work allowances that were in place when Covid19 was first spreading. But I think that all politicians are too weak to do such things. The media have demonstrated that nowadays the best we can expect is that they will treat both sides as equal even when facts clearly support one side, so we can’t expect the media to report on impending fuel shortages and demand policy changes to address them.

We should have higher taxes on fuel that will continue past the resolution of the current crisis caused by the attacks on Iran to provide incentives for the purchase of electric cars and for manufacturers to make more fuel efficient cars. Currently people are basing car ownership decisions on the expectation that petrol will go back to something under $2/L and we need to have a government guarantee that it won’t happen.

People always complain about poor people who can’t afford to drive if petrol is expensive but that could be addressed by increasing the minimum wage and social security payments. But a large portion of the people who complain about the hardship poor people may face when fuel prices are discussed are against increasing the minimum wage so I don’t think they are being honest.

Another common complaint is about the difficulty driving long distances in rural Australia when there isn’t sufficient charging infrastructure for electric cars and therefore rural people including farmers getting hit by high prices of fuel. There could be a rebate scheme for farmers etc, government subsidies for farmers is nothing new.

What Will Happen

I expect the governments of most first world countries to try to keep fuel prices low and do very little to try and decrease demand. China will probably do some things to reduce fuel use and being the world’s largest oil importer this will make a difference, but not as much as we need.

A related problem is that a lot of fertiliser is produced from petrochemicals and closing the strait of Hormuz cut off a significant portion of the world fertiliser supply. First world countries will outbid developing countries for fertiliser and fuel. Starvation in developing countries probably won’t get much news coverage until it leads to war.

This is not going to go well, it could be addressed if we had braver politicians and more honest media companies but that’s not the way things are going.

Radxa Rock 5A RK3588S

etbe — Fri, 30 Oct 2026 05:56:57 +0000

At the end of last year I paid $177.40 for a Radxa ROCK 5A GREEN RK3588S, 8-core CPU SBC, HDMI with 8K Output, WiFi 6 Support and Gigabit Ethernet, Single Board Computer [1] from AliExpress. I got the version with 8G of RAM as 4G didn’t seem enough and I didn’t feel like paying for the 16G or 32G versions. The prices excluding postage are $106, $130, $203, and $332 for the 4G, 8G, 16G, and 32G versions respectively. The $332 version is quite reasonably priced if you need to do some big compiles on ARM64. Since then the prices have changed by a few dollars but are almost the same (variations in postage will be greater than the price changes).

They provide modified versions of Debian/Bookworm and Debian/Bullseye [2] and an Android installation. The Debian setup includes a custom kernel, bootloader, some configuration packages including for ALSA, and some firmware.

I installed Bookworm and upgraded it to Trixie (the current Debian release). There were some conflicts with some radxa packages that contained the same files as Trixie packages but didn’t have a package conflict but it was not a big deal. It would be nice if Radxa updated their setup to Trixie and it wouldn’t be that difficult for them to do so.

The board has an expansion bus which apparently can be used for NVMe. It also has an option for a EMMC module. But if you get the default configuration then the only boot device supported is a micro SD card.

One of the aims of purchasing this card is for testing 8K monitors, but it turns out that there are no TVs that will take 8K input on sale in Australia [3].

The next thing I considered doing is running it for playing movies on a 4K but it turns out to not support HDMI audio (at least not with the supplied drivers) and has no other audio support. Apparently boards like this have a common use case of digital signs where audio isn’t required.

I had this post in draft for a year because I planned to write more, but I haven’t come up with anything. It’s not an exciting device. Handy to have another ARM test and build system and handy to be able to test high resolution video with a portable device but I don’t use it for much. I guess “just works in a boring way” isn’t a bad review.

CEO Impersonation Fraud

etbe — Mon, 26 Oct 2026 04:09:59 +0000

In discussion about my post on banks and phones [1] questions were asked about CEO impersonation (link to an article on the security blog Krebs on Security about it) [2].

CEO fraud (or more generally executive fraud) is a subset of Business Email Compromise fraud which allegedly loses Australian businesses $84M/year [3]. The numbers vary a lot depending on what is counted, is it just attacks where money is lost or do situations where the bank reverses the transaction count? There’s a lot of secrecy around this because of reputation issues related to fraud, a company that gets defrauded might be regarded as an unreliable business partner. Also in terms of interpreting results there are organisations that want to promote the idea that “it’s a major crime that could cost you everything unless you pay us to improve your security”.

My experience of these things is that at one company I worked for someone had gained access to an executive mailbox and setup rules to move mail from certain senders to a mailbox that wouldn’t be checked (maybe .Sent or .Spam or something – I can’t remember the details) as well as forwarding it to an address the attacker controlled. That meant that the executive wouldn’t see email from the scam targets while the email gets forwarded to the attackers. At the time it appeared that Office 365 didn’t have any features for sending automatic audit alerts for such changes. I think that all changes to executive email accounts should trigger alerts to the corporate security team (in that case me). One would hope that such exploitation would be a major wake-up call for the company but it wasn’t. It was never discovered how the attacker got access to the account, I presume it was by compromising a personal computer of the executive which they used for company purposes. Having a strong separation of hardware used for work and hardware for personal use is a really good thing.

At the same company every time the CEO went on a scheduled trip there would be email sent impersonating him claiming that money needed to be transferred. It was never discovered how the attackers knew when he was on a trip. Was the CEO telling people on LinkedIn about his plans or something? Was his calendar shared to someone outside the company? Was there an employee leaking information? We never found out and surprisingly the executive team didn’t think this was a problem. It’s not necessarily bad for the CEO to publicise their trips even if that alerts hostile parties, but everyone needs to know what the situation is. An unexplained attack is more concerning than a known attack that can be predicted and dealt with.

The role of CEO has a unique combination of being able to authorise funds transfers while also being able to reject other security methods. You can tell a line manager that they need to follow the process for a $10 purchase but you can’t necessarily tell the CEO that they need to follow the process for $100,000. Even if the CEO always follows the process for funds transfers you have to convince all the people involved in funds transfers that the CEO will follow the process and any unexpected email demanding an immediate transfer should be rejected.

A final problem is getting executives to understand the importance of computer security. My experience is that getting a CTO to adhere to good security practices can be a challenge and that even on the rare occasions someone like me gets to communicate with the CEO it’s not possible to convince them to change anything.

Most computer security problems end up as people problems.

Banks and Phones

etbe — Sun, 25 Oct 2026 12:55:06 +0000

The Problem

For years there have been ongoing issues with SMS being used as a security mechanism for important things including financial services. The problem with this is that access to a phone number is not very well secured, the business model of phone stores is based on having a price of service that doesn’t allow the amounts of money spent on security and training that organisations such as banks can spend and are legally required to spend.

The way things work now is that SMS is a second factor of authentication for banks and other traditional financial companies as well as for services involving cryptocurrencies such as bitcoin. To gain unauthorised access to SMS an attacker can physically steal a phone or SIM or they can trick an employee of a phone store into replacing the SIM or attack the computers of the telco to gain access to replace SIMs.

SMS authentication is also used for many services which have indirect access to financial service. For example when I’m employed in a sysadmin role I may get given admin access to the email server used for the CEO’s email and have it default to using the phone number of my personal phone for authentication. So while my personal phone doesn’t give the potential for defrauding much money I own it does give the potential for being used for defrauding however much money the CEO can authorise which may be significantly greater than my net worth.

Hardware Security Devices

The best thing to do for securing such things is to use hardware security devices like FIDO keys, of which there is a wide range that cost less than $50. The problem with acceptance of such things is lack of general knowledge and lack of forced requirements to use them.

The vast majority of banks (including all banks in Australia AFAIK) have chosen not to require hardware security devices because of the cost. It has been widely claimed that 20% of the customers of a typical bank make 120% of the profit – 80% of the customers lose money for the bank. While I’m not in a position to know the accuracy of that most banks seem to have implemented monthly fees for accounts below a certain minimum balance to discourage less profitable customers. If there were banking regulations requiring hardware security devices then the costs would be passed on to people who really can’t afford an extra $50 per year in banking fees to pay for it.

It might be a good option for the government to require personal presence at the bank or a hardware security device for transfers of more than $1000. That would allow kids and minimum wage workers to have bank accounts without excessive fees while forcing a higher level of security for larger transfers.

I really should use the hardware security devices I own more, although they are mostly only usable on systems I run.

Improving Phone Store Security

The problems of employees of phone stores being tricked or bribed to giving attackers access to someone’s phone service could be addressed by introducing new regulations about security at phone stores. I think this isn’t a viable option as the amount of work required to develop new procedures, train staff, and implement more secure systems is significant. Also the stores used for selling phones aren’t the type of secure buildings that are used for banks so some construction work would be required and many phone stores in small towns would no longer be economically viable and would be shut down.

I think we should have legislation to require better security for phone stores as there is a lot of scope to do things better without the expense of bank type security. Crimes that involve stealing phone service don’t just hurt people who want a regular phone service, they hurt the community by facilitating other crimes.

How Virtual Telcos Work

In Australia there are 3 companies providing the full mobile phone service, Telstra, TPG (which bought Vodafone), and Optus. There are many “virtual telcos” that use those services. The virtual telcos are companies that will sell a phone service but use one of the 3 companies to provide the actual connection. The backend mobile service run by the big 3 has appeared to be secure, but probably doesn’t have the “protect $200m of bitcoin” level of security.

When you get a phone service you are issued a SIM or given a QR code for an eSIM by a company that has SIMs issued by the big 3. That company can then replace your SIM if it’s damaged, lost, or stolen by using a level of security that it deems appropriate, which probably isn’t very secure. Most of the news about SIM swapping attacks comes from other countries and it’s shown that the security of virtual telcos in the US is quite insecure and probably Australian companies aren’t any better.

To transfer a service to another virtual telco you used to be able to do it with just knowing the invoice number of your last invoice but in recent times you receive a SMS on your old SIM to confirm that you wish to change. That could be viable for any crime that involves stealing a phone today and stealing money tomorrow. But for most attacks that involve stealing a phone number transferring to a different virtual telco isn’t a good option.

Another possibility for crime that I haven’t seen reported yet is to steal eSIMs. It’s unreasonably difficult (although not impossible) to steal an eSIM once it’s installed in a phone. But stealing an eSIM before it gets installed is much easier. Kogan and Aldi email eSIMs to customers which is very vulnerable to attack and should be illegal. Telstra and Optus use an app to install an eSIM which could be quite secure if implemented properly. TPG uses a web page and QR code or an app which again could be quite secure.

Currently the iPhone 17 Air is apparently the only phone released world-wide without support for physical SIMs. When phones that have no support for physical SIMs become common people may have to make the security of eSIM delivery a factor when choosing a telco.

Banks as Virtual Telcos or SIM Providers

I think that in the near future the best thing to do to improve security involving the phone system would be to have the banks run virtual telco businesses or manage the supply of SIMs for virtual telcos. Then getting a SIM replaced would require the same security as changing access to a bank account and a lot of problems related to stealing phone service would be solved. Banks wouldn’t need to provide all phone services, just services to customers who want to use it which would be everyone who considers themself to be at risk of fraud.

I don’t think that this would be a great solution, but I think it’s better than anything else that’s likely to get used by a sufficient number of people in the near future.

What Will Happen

This blog post is mostly a thought experiment on ways of improving overall computer security in society. It can be read as advocacy for hardware security tokens. I don’t expect anything to be done to improve these issues.

I expect that banks will continue with their current security mechanisms (including SMS authentication) and just accepting a certain amount of fraud as the cost of doing business. For large fraud they can try to claw the money back or blame the customer to avoid having to pay. It’s not impossible to solve these things, I had a hardware device issued to me by a Dutch bank about 25 years ago but countries like Australia and the US are much more than 25 years behind.

I expect most people to regard whatever security they have on their bank account to be sufficient and that they will be happy to use the same for everything else. So we will continue to have things like SMS on a personal phone used to secure important corporate access to data and then people will be shocked when something goes wrong.

To make things even more exciting if a criminal takes over the phone number of the sysadmin to access the CEO’s email then there may be no-one to call to get the access restored.

We can add rampant financial fraud to the list for the AI related world economic crash that’s about to happen.