4 ms·

I have T-Mobile. 6 weeks ago my phone could no longer access the cell network. The support agent told me that someone went into a store, claimed to be me, and w

I have T-Mobile. 6 weeks ago my phone could no longer access the cell network. The support agent told me that someone went into a store, claimed to be me, and was able to change the SIM card. The history showed the employee in the store verified me by my driver's license. We changed the SIM back and supposedly locked the account. I use Google Auth OTP for all the accounts that I can, and as far as I can tell nothing was breached or stolen, but I wouldn't rely on your cell phone or number for anything whatsoever, it's way too easy to socially engineer, or have some easily corruptible retail employee steal from you.

kuwze 8y ago
Reminds me of this: https://www.ccn.com/bitcoin-investor-sues-att-for-224-million-after-mobile-linked-theft/ https://www.ccn.com/bitcoin-investor-sues-att-for-224-millio... https://cointelegraph.com/news/california-police-arrest-teenage-sim-swapper-who-allegedly-stole-crypto-from-cell-phones https://cointelegraph.com/news/california-police-arrest-teen...
hippich 8y ago
Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms "two factory" authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can't provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.
- acomar 8y ago
  There are a few sites that won't accept this and won't even accept a Google Voice/VOIP number because they do some kind of check. Very frustrating.
  - r00fus 8y ago
    Can you provide a number (i.e. POTS) that has no SMS capability?
- gowld 8y ago
  What's the point of having a lock (OTP) if the lock is removed upon an attacker's request?
- inetknght 8y ago
  SMS is not two factor authentication, no matter what ISPs or websites tell you.
  - chayesfss 8y ago
    Actually it is a form of 2fa, might not be one you like but it’s better than 1fa or kba which is double single factor
    - weej 8y ago
      Agreed. Although poor security with easy hijacking, it's still a form of 2FA. Even NIST doesn't recommend it as a factor to use for authentication.
swarnie_ 8y ago
I remember this being a common tactic to break in to youtube/twitter accounts with 2FA enabled a few years back, really shocked its still going on.
hb3b 8y ago
That's bad but at least they checked. Apple recently swapped out a phone for me at the store. The genius called Sprint and they activated the new phone on my Dad's line without asking me for ID or my account code. Imagine if this were to happen to a journalist or politician. The stakes are quite high.
- s73v3r_ 8y ago
  Honestly, I think one of the best things to happen for the rest of us is for a prominent Senator to have this happen to them. Then hopefully we'd get some legislation holding these companies responsible when they do that.
rm999 8y ago
T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don't use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I'd spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue. https://www.t-mobile.com/offers/t-mobile-digits https://www.t-mobile.com/offers/t-mobile-digits
- MrEfficiency 8y ago
  Not to mention digits SUCKS. My wife used this for her business since it was free at the time. It cost her literally thousands of dollars of missed/unconnected calls and dozens of hours of customer service.
- r00fus 8y ago
  Is there any way to turn off Digits?
bogomipz 8y ago
Do they actually support third party 2FA for their customers?

kuwze 8y ago

Reminds me of this: https://www.ccn.com/bitcoin-investor-sues-att-for-224-million-after-mobile-linked-theft/ https://www.ccn.com/bitcoin-investor-sues-att-for-224-millio... https://cointelegraph.com/news/california-police-arrest-teenage-sim-swapper-who-allegedly-stole-crypto-from-cell-phones https://cointelegraph.com/news/california-police-arrest-teen...

hippich 8y ago

Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms "two factory" authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can't provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.

acomar 8y ago
There are a few sites that won't accept this and won't even accept a Google Voice/VOIP number because they do some kind of check. Very frustrating.
- r00fus 8y ago
  Can you provide a number (i.e. POTS) that has no SMS capability?
gowld 8y ago
What's the point of having a lock (OTP) if the lock is removed upon an attacker's request?
inetknght 8y ago
SMS is not two factor authentication, no matter what ISPs or websites tell you.
- chayesfss 8y ago
  Actually it is a form of 2fa, might not be one you like but it’s better than 1fa or kba which is double single factor
  - weej 8y ago
    Agreed. Although poor security with easy hijacking, it's still a form of 2FA. Even NIST doesn't recommend it as a factor to use for authentication.

swarnie_ 8y ago

I remember this being a common tactic to break in to youtube/twitter accounts with 2FA enabled a few years back, really shocked its still going on.

hb3b 8y ago

That's bad but at least they checked. Apple recently swapped out a phone for me at the store. The genius called Sprint and they activated the new phone on my Dad's line without asking me for ID or my account code. Imagine if this were to happen to a journalist or politician. The stakes are quite high.

s73v3r_ 8y ago
Honestly, I think one of the best things to happen for the rest of us is for a prominent Senator to have this happen to them. Then hopefully we'd get some legislation holding these companies responsible when they do that.

rm999 8y ago

T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don't use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I'd spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue. https://www.t-mobile.com/offers/t-mobile-digits https://www.t-mobile.com/offers/t-mobile-digits

MrEfficiency 8y ago
Not to mention digits SUCKS. My wife used this for her business since it was free at the time. It cost her literally thousands of dollars of missed/unconnected calls and dozens of hours of customer service.
r00fus 8y ago
Is there any way to turn off Digits?

bogomipz 8y ago

Do they actually support third party 2FA for their customers?