6 ms·

"Also, wherever possible, use 2-factor authentication (usually password + a code in an SMS message)" -- how's that gonna help when your phone is stolen?

hellcow 10y ago
There's a setting for iOS that hides the contents of SMS messages on the lock screen. With that, they'd at least need your pin. Hopefully you'd have some printed out backup codes.
- tamana 10y ago
  How can you log in to your account from anywhere after your phone is stolen?
- jethro_tell 10y ago
  You're not sending the message to the phone, you're sending it to the sim, in the clear. Si I pop this some in my flip phone and receive the code.
  - Throwaway23412 10y ago
    To really make things a hassle for thieves, you could lock your SIM card through Settings, no?
  - metafunctor 10y ago
    Hmm, but you do need to know the PIN code for the SIM card in order to register on the GSM network and receive the SMS? Or am I missing something? I've changed my PIN to something quite long, so hopefully an attacker cannot just pop the SIM card out of my iPhone and use it on another device.
    - lorenzhs 10y ago
      SIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course it's possible to set one but that's buried somewhere deep in the phone's settings, so most people probably don't set one.
      - metafunctor 10y ago
        I didn't even know it's possible to have no PIN code on a SIM card! Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits. This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.
        pbhjpbhj 10y ago
        Is there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length. Ah, http://www.techrepublic.com/article/pro-tip-protect-your-android-sim-card-with-sim-pin-lock/ http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts. I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?
        metafunctor 10y ago
        I'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.
        pbhjpbhj 10y ago
        You're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_sim_card_aes128_encryption_in_10_minutes_for_cloning/ http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.
  - 7Z7 10y ago
    Don't they (Apple at least) give you an option to send the code to your phone number, or to your iCloud/iMessage ID?
deleted 10y ago
[deleted]
voidingw 10y ago
Apple does not use SMS to send 2-FA codes if you have another "trusted device". [1] However, I tried recovering my account as if I were a thief and I could use the forgot password feature to send an SMS code to initiate a password reset. From there I was able to reset my password after verifying the credit card attached to the account. So even with 2-FA enabled you're screwed if they stole your wallet too. If your phone is stolen call your carrier and have them disable the number or invalidate the sim. [1] - https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915
- TorKlingberg 10y ago
  > Apple does not use SMS to send 2-FA codes if you have another "trusted device". Of course, being Apple, the other device must also be an Apple device.
hellofunk 10y ago
Apple requires you to unlock a phone to see a 2-factor authorization PIN. It is not sent via SMS.
- lobster_johnson 10y ago
  That's not true: http://i.imgur.com/mdVdq47.png http://i.imgur.com/mdVdq47.png Edit: And it seems you can't remove the phone number: http://i.imgur.com/p6myEqx.png http://i.imgur.com/p6myEqx.png
  - hellofunk 10y ago
    When you receive two factor in your device it is not sent via SMS.

hellcow 10y ago

There's a setting for iOS that hides the contents of SMS messages on the lock screen. With that, they'd at least need your pin. Hopefully you'd have some printed out backup codes.

tamana 10y ago
How can you log in to your account from anywhere after your phone is stolen?
jethro_tell 10y ago
You're not sending the message to the phone, you're sending it to the sim, in the clear. Si I pop this some in my flip phone and receive the code.
- Throwaway23412 10y ago
  To really make things a hassle for thieves, you could lock your SIM card through Settings, no?
- metafunctor 10y ago
  Hmm, but you do need to know the PIN code for the SIM card in order to register on the GSM network and receive the SMS? Or am I missing something? I've changed my PIN to something quite long, so hopefully an attacker cannot just pop the SIM card out of my iPhone and use it on another device.
  - lorenzhs 10y ago
    SIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course it's possible to set one but that's buried somewhere deep in the phone's settings, so most people probably don't set one.
    - metafunctor 10y ago
      I didn't even know it's possible to have no PIN code on a SIM card! Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits. This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.
      - pbhjpbhj 10y ago
        Is there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length. Ah, http://www.techrepublic.com/article/pro-tip-protect-your-android-sim-card-with-sim-pin-lock/ http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts. I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?
        metafunctor 10y ago
        I'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.
        pbhjpbhj 10y ago
        You're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_sim_card_aes128_encryption_in_10_minutes_for_cloning/ http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.
- 7Z7 10y ago
  Don't they (Apple at least) give you an option to send the code to your phone number, or to your iCloud/iMessage ID?

deleted 10y ago

[deleted]

voidingw 10y ago

Apple does not use SMS to send 2-FA codes if you have another "trusted device". [1] However, I tried recovering my account as if I were a thief and I could use the forgot password feature to send an SMS code to initiate a password reset. From there I was able to reset my password after verifying the credit card attached to the account. So even with 2-FA enabled you're screwed if they stole your wallet too. If your phone is stolen call your carrier and have them disable the number or invalidate the sim. [1] - https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915

TorKlingberg 10y ago
> Apple does not use SMS to send 2-FA codes if you have another "trusted device". Of course, being Apple, the other device must also be an Apple device.

hellofunk 10y ago

Apple requires you to unlock a phone to see a 2-factor authorization PIN. It is not sent via SMS.

lobster_johnson 10y ago
That's not true: http://i.imgur.com/mdVdq47.png http://i.imgur.com/mdVdq47.png Edit: And it seems you can't remove the phone number: http://i.imgur.com/p6myEqx.png http://i.imgur.com/p6myEqx.png
- hellofunk 10y ago
  When you receive two factor in your device it is not sent via SMS.