5 ms·
This is frightening. If you're using texts for 2-factor auth you're at the mercy of your phone service provider's customer service. And they're trying to balanc
by jaden 7y ago
This is frightening. If you're using texts for 2-factor auth you're at the mercy of your phone service provider's customer service. And they're trying to balance being helpful with security, which can be in opposition. Losing $100,000 with no hope of recovery is the kind of thing that could sink many people's finances.
His summary of how to avoid having this happen to you:
* Use a hardware wallet to secure your crypto
* SMS-based 2FA is not enough
* Reduce your online footprint
* Use Google Voice for 2FA
* Create a secondary email address
* Use an offline password manager
- thinkmassive 7y agoGood list, and I would add using multisig for serious amounts.
- AdmiralAsshat 7y ago> * Use Google Voice for 2FA I like this idea, insofar as the Voice number is not vulnerable to the SIM port attack. But then I worry that it's yet-another-thing I'm to my Google account, which Google could always shut down at a moment's notice, with no explanation, and no recourse.
- d1zzy 7y agoThere may not be a choice. Vanguard refused to log me in until I configured 2-factor SMS.
- ndiscussion 7y agoI would consider that an alarming sign that I need to change investment companies asap (probably after loudly complaining and trying to change it, since Vanguard is somewhat unique).
- anaisbetts 7y agoFidelity also only uses SMS-based 2FA :-/
- wbl 7y agoVanguard can work with Yubikeys now.
- 80mph 7y agoVanguard also offers 2FA with voice-automated calls. I wonder, would getting a landline and using that with a Yubikey be any more secure? https://investor.vanguard.com/security/security-keys https://investor.vanguard.com/security/security-keys
- deleted 7y ago[deleted]
- rsyring 7y agoUsing Google voice may not do all you had hoped: https://news.ycombinator.com/item?id=19886705 https://news.ycombinator.com/item?id=19886705