16 ms·
SIM swap horror story: I've lost decades of data and Google won't help
- chongli 7y agoThis is a good place to remind everyone of Google Takeout [1]. Back up all of your data. Don't let this horror story happen to you. [1] https://takeout.google.com/settings/takeout https://takeout.google.com/settings/takeout
- metalliqaz 7y agoThanks for reminding me... again... about this. Why haven't I backed up my gmail data yet? It has been years since I realized I have to do it. Why haven't I done it?
- russdill 7y agoBecause it's not easy to automate.
- din-9 7y agoGmail alone is easy - use POP in a mail client, set it to mark stuff read, leave it on the server etc https://support.google.com/mail/answer/7104828?hl=en https://support.google.com/mail/answer/7104828?hl=en
- btrettel 7y agoI'll agree that POP is pretty easy and worthwhile here. One caveat: I'm not certain that it's identical to what Takeout provides. I downloaded the mbox file via Takeout and the Takeout version was a fair bit larger than my Thunderbird mbox file as I recall. Maybe Thunderbird stores the emails more efficiently than Takeout? I should examine this more closely. As far as I am aware there are no missing emails in Thunderbird, though I could write a script to be certain. Edit: Seems that I misremembered. The Takeout file seems to be appreciably smaller than what Thunderbird has, but in line with what Gmail reports at the bottom. I guess Thunderbird is actually less efficient than Gmail. Attachments might explain some of this, as I deleted some attachments in Gmail that I kept in Thunderbird.
- lallysingh 7y agoAttachments?
- deleted 7y ago[deleted]
- jandrese 7y agoThe takeout file might be compressed too. Most mail clients don't bother to compress anything.
- btrettel 7y agoYes, it was zipped, but I was comparing uncompressed. I've now checked. There's about a 500 MB difference for about 10 GB of emails. So not too bad, but appreciably different.
- chongli 7y agoThey now have a feature that lets you schedule it to run every few months. You could probably automate the download from your email client.
- deleted 7y ago[deleted]
- corrigible 7y ago`gmvault` in a cron job works pretty well...
- rjohnk 7y agoCheck out Mailstore Home
- mceachen 7y agoThanks for the reminder--I've done it several times in the past, but it wasn't a scheduled thing at all. There's a new checkbox in takeout that lets you schedule a backup every 2 months (and then presumably you'll get an email when you need to download it). Does anyone else have issues with takeout failing with "unknown error occurred" if you use the default of selecting all products? I have to manually create multiple takeout archives (one for gmail, one for photos, one for location history...)
- azinman2 7y agoMy previous experience (years ago) was that it actually gave me incomplete backups... which is.. insane and frustrating. Hopefully that’s fixed now.
- bocklund 7y agoI was just about to set this up to automatically put everything in my organization's Box every six months, but: > With access to your XXX@YYY.ZZZ Box account, Google Download Your Data can: > Read and write all files and folders stored in Box Nope. Download link it is.
- OJFord 7y agoTo be clear though, unless Box does actually offer a finer-tuned 'write to specific dir' access control, that's not nosey Google's fault.
- resonanttoe 7y agoYeh that's unfortuante but it is normal for box's API. This isn't Google being overly grabby, its the only scope available to third party read and writing to box. The API scope doesn't have any knowledge of individual files or applications. https://developer.box.com/docs/scopes https://developer.box.com/docs/scopes Conversely, Google Drive does have scopes available for Application specific folder read/write https://developers.google.com/drive/api/v3/appdata https://developers.google.com/drive/api/v3/appdata So box needs to up its game.
- deleted 7y ago[deleted]
- everybodyknows 7y ago> ... enable a requirement that my SIM could not be changed unless someone went into the store with at least one means of physical identification ... Anyone have experience with this, or heard reports of attacks by means of forged physical ID?
- miles 7y agoHow to Fight Mobile Number Port-out Scams https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/ https://krebsonsecurity.com/2018/02/how-to-fight-mobile-numb... "T-Mobile suggests adding its port validation feature to all accounts. To do this, call 611 from your T-Mobile phone or dial 1-800-937-8997 from any phone. The T-Mobile customer care representative will ask you to create a 6-to-15-digit passcode that will be added to your account."
- perl4ever 7y agoAnd then I forget/lose my 15 digit passcode, then what? Either there is a retrieval method that makes the whole thing irrelevant, or else I've replaced one catastrophe with another to no purpose.
- exabrial 7y agoSilicon Valley has a systemic customer service problem. The price you pay for "Free" services.
- metalliqaz 7y agoI think the common wisdom dictates that since we aren't paying, we aren't the actual customers. I'll bet advertisers have great customer service.
- megous 7y agoArticle author was paying for some of it.
- skybrian 7y agoThat's less common wisdom and more of a catchy but dumb meme. There are all sorts of things you can buy that have crappy-to-nonexistent customer service.
- metalliqaz 7y agoI think there can be several reasons that a company lacks good customer service. One might be lack of competition. Another could be that they don't see their users as customers.
- CloudNetworking 7y ago> There are all sorts of things you can buy that have crappy-to-nonexistent customer service. But that doesn't contradict the point of the comment you were replying to, does it? Edit: You should reply instead of just downvoting.
- toss1 7y agoSure, but even Comcast isn't as bad as Google; not as much depends on Comcast, and Google has mountains of p[eople's key life-altering data, yet it is nearly impossible to speak with a human that has any capability to effect a change. As with every generalizations, there are exceptions, but they generally only prove the rule.
- Bucephalus355 7y agoRecently I discovered that Facebook has a policy that no one with pending misdemeanors can be hired if they are just a contractor. We recently had to turn away a 23 year old combat veteran who had deployed to Afghanistan because he had a pending Class C misdemeanor. That’s a max fine of $50 for the state this was in. All for a $16.50 an hour job. The amount of indifference to suffering by people in the corporate world today has gotten...I am not even sure what the word is.
- baud147258 7y agoAre you sure you are commenting in the right thread?
- Rychard 7y agoThe article did mention that their Facebook account was the only one that wasn't compromised. > Through all of these hacks, it was interesting to find that Facebook was the one reliable and secure service under my control. Perhaps their comment was attempting to provide some anecdotal data in an effort to explain why the author's Facebook account remained secure. Though I agree with you in the sense that it's far more likely that they simply commented on the wrong article. :)
- AdmiralAsshat 7y agoI believe Google has some kind of service you can turn on where you will pair it with a U2F token like a Yubikey or their Titan key. At that point, all other forms of login and password recovery are turned off. In theory, that should stop the SIM-swap attack. See: https://support.google.com/accounts/answer/7539956?hl=en https://support.google.com/accounts/answer/7539956?hl=en
- metalliqaz 7y agoI use Authenticator, which should also stop a SIM-swap. However, I've noticed that many services seem to require activating 2FA via text message in order to activate authenticator. Has anyone else noticed that?
- jsty 7y agoQuite a few do require you to have at least two second-factor methods set up, although I think for me only one has ever insisted on setting up phone / text 2FA. If you don't have a spare phone for TOTP or a Yubikey for U2F, phone-based might be all you can use (considering a surprisingly small number of 2FA supporting sites seem to implement recovery codes).
- NikolaeVarius 7y agoThe point is that, while there are dangers, TXT 2FA is leagues better than not having anything at all.
- lukeschlather 7y agoUnfortunately, Yubikey at least basically only works in Google Chrome, so if you actually want to use your account you have to use methods other than the Yubikey.
- taeric 7y agoYou can use it in any browser. You have to register it in chrome. Crappy, but not a line in the sand I'm willing to die on.
- tpetry 7y agoThe industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.
- tooop 7y agoI would say that for the average user sms 2FA is secure enough. P.S. I might have a different perspective as where i am from, there really aren't important services (banks etc.) that are using sms 2FA. Mobile operators doesn't ship SIM cards over mail, you can get a new SIM only in person providing ID (or PIN/PUK in case of prepaid cards). Probably my country is just too small market for these kind of attacks so i feel secure enough when using sms 2FA.
- iNate2000 7y agoIt wasn't secure enough for the author of this article.
- tooop 7y agoNot really an average person isn't he?
- mceachen 7y agoHow is he not an average person, as far as security goes? 1) he didn't use a password app 2) he thought google drive was a safe place for his stuff 3) he thought google drive was a secure place for his stuff All three things, which I would bet are fairly common assumptions (the last 2 are certainly part of Google's marketing!), turned out to bite him.
- ijpoijpoihpiuoh 7y agoHe is a public personality and in that role has been related to Bitcoin. And he also has his phone number and email publicly visible on the internet. https://gizmodo.com/a-tv-anchor-tries-to-gift-bitcoin-on-air-is-immediatel-1488636715 https://gizmodo.com/a-tv-anchor-tries-to-gift-bitcoin-on-air... It seems like this only happens to people who have poor opsec about their email addresses, phone numbers, and are publicly related to the cryptocurrency movement. I mean, I'm sure it happens to other people, but that's the only case I've ever heard about. I would personally be wary about publicly listing the email I use with my bank, or my phone number, and I've done what I can to scrub the internet of these values. If you have to be publicly reachable through a medium other than Facebook or Twitter, have a separate email and phone number through which you conduct your serious personal business. But most people do not need this kind of public reachability, or else have it through work. For those types of people, it would behoove them to keep their profile small.
- mbauman 7y agoI certainly didn't appreciate how much SIM cards are the keys to our modern lives until mine got stolen. Interestingly, my thieves took a different tack: they actually stole the physical SIM card! You might ask how this could happen: I was traveling internationally and had a friendly guy at an official kiosk in the Heathrow arrivals hall swap out my SIM card for a local SIM. He palmed my SIM and gave me back a dud without me noticing. He then shipped it back to Atlanta where collaborators used it to blindly called credit card support numbers. Some of these credit card numbers were hits — places where I had existing accounts and where they recognized my phone number. They social-engineered their way to get the CC companies to divulge more information about me — including the CC numbers themselves — allowing them to increase my credit limits and open new cards. They then went on a $40k shopping spree. Of course I didn't notice until I came home. The dud card he gave me worked for 24 hours (I still don't understand how). And even after it stopped working, it took me quite some time to piece together everything that happened — I didn't realize that the SIM card I had wasn't mine for quite some time. Fortunately they did the equivalent of an identity theft smash-and-grab. It was relatively easy to identify and reverse, and they didn't compromise any tech 2FA services. Interestingly Heathrow police didn't care as the "theft" was only a $5 SIM card and not a "high enough value item" to warrant investigation. tldr: Don't let anyone ever touch your SIM cards.
- megous 7y ago> Interestingly Heathrow police didn't care as the "theft" was only a $5 SIM card and not a "high enough value item" to warrant investigation. What about the part that's "being a part of a criminal conspiracy to steal $40k?" I guess that's not something for the airport police to deal with though.
- 3JPLW 7y agoAyup. Here's what I got back from them: In light of the extended Fraud on your account, I believe that due to the 7 day lapse between you collecting the SIM and returning to the USA, then your details could have been compromised anywhere. In all probability, this occurred in the USA as this is where the accounts have been set up and believed the fraudsters would have had to have been in order to benefit from the crime. The fact that you bought a SIM card in the UK is purely circumstantial I’m afraid, therefore we would not investigate this further. Of course I was shouting "THEY HAD TO SHIP IT BACK TO THE U.S. FOR IT TO WORK" as well as providing the call logs documenting calls from the Atlanta region (where I don't live and hadn't visited), but it fell on deaf ears and I gave up. That response made me feel like a tin-hatted conspiracy theorist, though: yes, I am certain I was defrauded through an international criminal conspiracy.
- fheld 7y agoIs there some mobile provider that has a way higher standard of security? Something like "Cloudflare for SIM"
- scarface74 7y agoNo. The issue is partially that while social engineering countermeasures that could help prevent sim swaps could be helped by better training and more rigorous security checks, there are actually bad actors who are employees of the carriers who can be paid off to switch SIMs.
- iNate2000 7y agoI noticed that author assumed he couldn't call 611 and took how long to contact via alternate phones. I'm pretty sure 611 works without a SIM card.
- vectorEQ 7y agono sim is no calls or sms. however, an inactive sim is allowed to call 611 (or provider equivalent) , 911(or local equivalent) and a few such emergency numbers generally. You do need the sim to be in working order and in the device. but it does not need to be activated.
- maxerickson 7y agoHow would the phone know which network to 611?
- Rychard 7y agoI would expect it to work for a carrier-branded device even with no SIM card, unless the device has been flashed with a stock firmware from the OEM. For a non-carrier-branded device though, perhaps the presence of a SIM card is required.
- jtokoph 7y agoGoogle Fi requires you to have access to your google account to port or sim swap your number. So if you have real 2FA you should be safer. I just had my AT&T sim swapped two weeks ago. According to police, the sim swappers are insiders at the telcos or have compromised corporate credentials and are logging into the telco admin portal and processing the swaps themselves. I’ve now switched to Google Fi. I’m banking on the assumption that Google doesn’t keep an admin portal open to the internet and that they don’t give sim swap/port access to employees that aren’t paid well enough to be willing to take a small bribe to swap the sims.
- jchw 7y agoAnyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup keys too. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ (The usual disclosure: I work for Google, but not on anything related to this, only speaking as a user.)
- flarex 7y agoWhy doesn't Google get rid of SMS recovery completely? It's a huge security flaw that can be easily exploited.
- jchw 7y agoI have no idea what the pros and cons are and certainly can’t speak for why. However, I think the existence of the Advanced Protection Program is definitely acknowledgment that the SMS backup is not secure enough for everyone. The thing is, not long ago I had no issue recovering my account if it got compromised. I think attackers today have gotten better at finding ways to beat the system. One thing I’ve seen, albeit I don’t know if it works on Google accounts, is enabling high security after stealing an account, effectively making recovery very hard. Though, I can’t really speculate on if that’s what’s going on here.
- ghaff 7y agoProbably because the more barriers you put in the way of scams, social engineering, etc. the harder you make it for people to legitimately get back into their accounts and the more likely it is that you'll instead read stories about how someone "forgot their credentials and lost access to everything in their account and Google won't do anything about it." No opinion on SMS specifically but there are tradeoffs.
- flarex 7y ago
- loup-vaillant 7y ago> I had backed up a ton of personal information on Google Drive. This included tax returns, account passwords for my wife in case I died, personal documents and spreadsheets, and just about everything I had paper copies of at home. I guess the author learned that lesson, but… please don't. Backups in the cloud are fine, but such sensitive information has to be encrypted. Ideally with a 6 words diceware password or so. And if it is meant for your close ones to recover if you die, write that password down, and lock it up in a couple homes you trust.
- TheChaplain 7y agoIn many asian countries they recycle telephone numbers quite frequently, some providers as often as 3 months. Perhaps it would be interesting to get a few pre-paid SIM cards and see if it there is any Google accounts connected to them?
- _def 7y agoMoving your irreproducible data into cloud storage is everything but a backup.
- rb808 7y agoThe fact that ACH is slow is a feature not a bug. Remember that when people want to speed up money transfers. > After a couple of days, our bank reversed the $25,000 charge and told us that the fraud department caught the ACH withdrawal before it was fully processed so that neither my family nor the bank lost this money forever.
- hocuspocus 7y agoInstant transfers work fine in countries where banks do their job properly. Mobile phone numbers shouldn't be used as a second factor, much less as a way to fully recover online credentials to your bank account.
- rb808 7y agoYou're probably right. You definitely shouldn't be able to recover your online credentials then immediately transfer out all the money.
- oasisbob 7y agoBut also, the US regulatory environment is very friendly towards individuals when it comes to fraudulent electronic transfers, regardless of how quickly they execute.
- heliodor 7y agoA few suggestions: 1) Call your cellphone carrier and ask to set up a password/PIN to be used for when you call into the customer service phone number. 2) Consider your phone number and SIM card insecure. The phone carriers are ignoring the SIM swap problem even though they know how much damage it's causing. Give your phone number to as few companies as possible. Phone services such as Google Voice work without a SIM card, so they are less prone to problems. Give out such a phone number if necessary. 3) Don't use text message verification codes as 2FA. Use an authentication app, such as Google Authenticator. 4) You can retake possession of your hacked Gmail account by providing one of the previously used passwords. No need to have a working phone. 5) Ask yourself, what will happen if you lose both your laptop and your phone at once? Do you have things set up in a way where you can get back into your digital life? Someone can break into your home while you're away, the government can confiscate them at the airport, etc. 6) Check what email addresses you have configured as backup auth methods for your Gmail. Those accounts can be used as a means of access by a hacker.
- megous 7y ago> 4) You can retake possession of your hacked Gmail account by providing one of the previously used passwords. No need to have a working phone. That's possible?! I only ever change password if I suspect it might have been compromised. Now if a service allows to use old passwords, that's quite a bummer and makes password change meaningless.
- mceachen 7y ago> Call your cellphone carrier and ask to set up a password/PIN Note that, at least for TMobile, AT&T, and Verizon, the password/PIN is presented to the CSR in plaintext (as they verify the pin over the phone verbally). I'd assumed they'd transfer to some pin-capture applet to verify, but nope. > Use an authentication app, such as Google Authenticator If you decide on Google Authenticator, make sure you scan the barcode with 2 devices (say, your tablet and your phone) to back up that credential. Or just use Authy.
- rashkov 7y agoAuthy allows you to recover your account using... SMS. So this is also vulnerable to SIM swapping. https://medium.com/mycrypto/what-to-do-when-sim-swapping-happens-to-you-1367f296ef4d https://medium.com/mycrypto/what-to-do-when-sim-swapping-hap...
- samat 7y agoThis is why I don't use Google for anything of importance. No customer support = I am not using it for anything of importance. Consider it a 'burner' service.
- doubt_me 7y agoExactly
- rb808 7y agoAnd this is a tech journalist who has friends at Google. The average guy on the street is %%%%'d in this new world.
- jpalomaki 7y agoThis is why I would like to trust my digital identity to my bank. They have enough local, physical presence so that I could show up in person and prove who I am. Also the personnel is already familiar with checking the identity and hopefully less suspectiple to social engineering. 2FA tokens and codesheets without SMS backup are secure, but bit tricky to manage. Takes some effort to distribute to different, secure places (think if house burns) and some regular checks to verify backup tokens are alive and codesheets not lost.
- tialaramex 7y agoMy good bank has no physical presence whatsoever. I mean, I presume they operate a call centre somewhere, maybe in Scotland, but I've never seen it. They can reach out and cause things to happen at a distance, but I don't want that used to authenticate me. They used it when I had lost my cards, to cause me to receive a bundle of cash so I could get on with my day just paying cash everywhere. I have a specialized OTP device with a chiclet keyboard, and a password used for normal stuff. When I do something serious, like the time I bought somewhere to live, I call them to set up the transaction, then a different random person gets assigned to call me back and verify the details - this way if one employee goes rogue they can't empty my account by claiming I called them. They have a password for me, and the second employee uses that password so that I know it's really the bank calling me.
- greggyb 7y agoI would like to know more about this bank! What bank is it? How did you find it? I've not heard of features similar to this, especially the last part about buying a house.
- tialaramex 7y agoIt's First Direct https://www1.firstdirect.com/ https://www1.firstdirect.com/ It's a Telephone Bank in the UK, launched in 1989 and I became a customer a year or three after that. Because it doesn't have any branches its call centre staff have to be trained to handle absolutely anything - if they can't fix it then it won't get fixed. I found it because my father used it, I have no idea why, he was not ordinarily a man to favour technologically sophisticated solutions, he never owned his own email address for example. Maybe as a working man he found it frustrating that other banks were closed after hours? First Direct is never closed, it operates 24/7. I have used other banks for some things, but I've always kept accounts with First Direct because of their truly extraordinary customer service hence I call it the "good bank". I actually know one of their Founders and apparently that commitment to customer service was key to their original vision for the bank, he led a strategy session for the start-up where I work now and it used that vision to give us a worked example. He was Chairman at another start-up I've worked for too. Small world. For the buying a home part I do mean that I bought it outright by the way, there wasn't a mortgage or anything like that - so that's a lot of money, let's say six figures. I presume the precaution was triggered by the fact that I wanted to move this large sum (almost all the money I had) to an account I'd never sent any money to before. Sounds almost exactly like a scam. I would _like_ to believe any other bank would have similar protections - but of course I don't buy a home every day, so I have no other examples to compare, and most of my contemporaries have a mortgage so the very large sums aren't involved. The password when they call me thing was nice, to be honest they didn't proactively set that up. I suggested it off-handedly one day and they were like "Of course, yes, we can set that up". I presume it's not custom, just they didn't explicitly advertise it to me as an option. That happens a lot, I didn't want contactless on my new card recently, and they were like "Yup, of course, done. Replacements for this card will also not have contactless until you call to change that".
- mself 7y agoUnlike what the OP stated, the key is NOT to list you phone number as an SMS 2FA recovery option. Only use the non-SMS options (e.g. app-based recovery, Google Authenticator, recovery codes). Adding SMS as an option makes your account less secure, not more. Unfortunately, most sites do not allow you to turn off SMS recovery even if they offer other 2FA options. Security is only as strong as the weakest link, and SMS is very weak.
- azinman2 7y agoThe problem lies in that Google Authenticator is tied to a device, so if you upgrade it or lose it, you’re f’d. I also doubt many use/print recovery codes, and if they do, good luck finding them 7 years later. Overall the situation isn’t great.
- hv42 7y agoI would recommend saving the recovery codes in a password manager app (that is not your browser)
- Shank 7y ago> The problem lies in that Google Authenticator is tied to a device, so if you upgrade it or lose it, you’re f’d. You can save the QR code that was used during setup to repeat the onboarding at any time. You can also use Authy, 1Password, or another service that lets you store the one-time password somewhere else. Or use U2F devices when possible.
- deleted 7y ago[deleted]
- wccrawford 7y agoI just went through this situation with a couple non-Google companies when I upgraded my phone, not realizing that their authentication info wouldn't transfer when Google transferred my data to the new phone. I thought I had double-checked that I had everything, but this got missed. It was a pain for all of them, but it was worst for the ones that I had no other auth systems set up. (Or the ones that had my old phone number for SMS still, even though I thought I'd changed it everywhere.) In the end, there's still no good system for real security. You're either stuck with a device you might lose (or someone might steal), or stuck with an account that you might cancel (or someone might steal). Or use biometrics which are just not ready for prime time.
- doubt_me 7y agoSince becoming aware of my own problems with google (they truly could care less about their users data) and reading stories about previous incidents of swapping SIM cards. My solution to all of it is literally just 2 emails. Both 2fa. Recovery exists but the numbers and emails are unknown to the world beyond Google or m$ servers. And those don't get used to register anything ever. I park my recoveries then use my main email as my most public one. Everything else is registered and recoverable on the second email that also isn't publicly known unless one of the services I'm attached to gets their data leaked etc etc etc....so even if they did successfully swap my SIM they can't get anything else. TMobile got hacked a few months back and around the same time my personal debit card that stayed in my wallet the whole time and I don't ever use in public literally for that reason. Got charged. They tried to empty it all. I pressed and pressed the only thing they could do for me was ask for a specific code. Verbal 2fa. I think if I remember correctly none of the data showed up publicly anywhere yet not sure about the specific incident I just thought the timing was weird. If that's the best security TMobile has and that's all their customer support has to offer us. They have failed as a company in my eyes. And it will only get worse not better as more middle managers get their cut of the security upgrades that they will partially and incorrectly implement. Of course they won't lift a finger your not a Kardashian
- OJFord 7y agocouldn't care less
- kburman 7y agoIn India to port a sim you have to first send a sms and would receive a verification number which is valid for a month or something.
- sofaofthedamned 7y agoWhich is the problem...
- toss1 7y agoGoogle Authenticator is a huge question. While there is apparently a desktop interface, if someone gets access to my phone, they have the live access codes right there. When the SIM is stolen, can the authenticator also be accessed with the new location of that identity? The process for moving Authenticator involves receiving a six digit Google code on your phone -- which was just effectively stolen with the SIM... While Google may have built in protections, they are not obvious at this point to me, a casual user of Google Authenticor. Does anyone have any more information to keep this more secure?
- r1ch 7y agoLast time I switched phones I had to set up GA from scratch, re-scanning the seeds on every account. The initial SMS code was just to attach an authenticator to a new device. Someone compromising your phone number shouldn't be able to get access to your codes, they would need the physical device. Also note that there is no official desktop client, anything that claims to be is 3rd party and wouldn't be connected to your current codes.
- noisy_boy 7y agoYou can generate backup codes and print/store them securely[0]. That is independent of your phone. [0]: https://myaccount.google.com/signinoptions/two-step-verification/enroll-welcome?pli=1 https://myaccount.google.com/signinoptions/two-step-verifica...
- ineedasername 7y agoGoogle really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital lives in the care of Google, it is unbelievable that they fail this badly. It's useful to note than it's not a situation that business users face. People who pay for G-suite have real support, even ::gasp:: telephone support. Why on earth does google not offer this to consumer users? I would gladly pay for that level of support and security. For that matter if there were some way of converting my personal account over to G-Suite I would do so. I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I just can't fathom the "no support" model at all.
- Analemma_ 7y ago> People who pay for G-suite have real support, even ::gasp:: telephone support. Why on earth does google not offer this to consumer users? I know people are getting sick of this phrase, but I'm going to repeat it here anyway because it answers your question perfectly: why doesn't Google have customer support? They do, but if the product is free, you're not the customer. As you note, Google does have real customer support for people who pay. The other people are not customers, they are advertising targets. Why waste money on support for them?
- dangThatSucks 7y agoGoogle One advertises real support for consumer users... but it turns out they can't really so anything but read support docs to you.
- Someone1234 7y agoIs this a reference to something? I haven't heard much about Google One's support good or bad. The concern I'd have with G-One is that if you lost access to your account, you also aren't a Google One customer, and the support likely won't assist you. Creating a chicken/egg situation.
- spookyuser 7y agoA good mitigation including getting a password manager might be to add a sync passphrase to chrome right? https://support.google.com/chrome/answer/165139?visit_id=636963843940305641-634482703&rd=1 https://support.google.com/chrome/answer/165139?visit_id=636...
- throw7 7y agoDon't use an sms/voice phone number as part of your 2-step verification in Google. In the past, I did use a verizon landline phone number as Verizon had the ability to "lock/freeze" that number from any outside changes, but I got rid of my landline a while ago. Also, print out some backup codes and stick it in your wallet. I have no idea what month and year I created my google account, and google doesn't seem to make that info available to you in a simple manner.
- module0000 7y ago> Also, print out some backup codes and stick it in your wallet. The idea of backup codes is good. Putting them in your wallet reduces your security though. Depending on the value of your accounts, you give a (physical) attacker everything he or she needs to compromise you. If you are going to keep these things on your person, consider protecting them with a hand-written cipher. Example: https://www.schneier.com/academic/solitaire/ https://www.schneier.com/academic/solitaire/
- catacombs 7y agoThis is a good reminder to never entrust Google with sensitive financial records and documents. Sure, the cloud service is a convenience, but, if a hacker accesses your account, it doesn't take much to download copies of those documents and use them against you.
- module0000 7y agoDon't use 2FA, if the 2nd factor is anything mobile-based. Use strong passphrases, and type them when you need access to the assets they protect. There is the concept of "security VS convenience", a trade-off you make when using secured assets. 2FA is convenience just as much as it is security. By having SMS as a method to reset a password, you reduce the attackers workload from cracking a difficult password to "compromise your mobile phone physically or electronically". I trust my passphrases much more than my mobile device and/or carrier.
- thefreeman 7y agoThis doesn't make sense. Why not use both 2fa AND a strong passphrase? To get to the second factor the attacker still needs your password. There is nothing that says you should use a simple password if you have 2fa configured.
- ars 7y agoBecause they can do "forgot password" using the 2fa.
- UncleMeat 7y agoPassphrases can be phished.
- tempsolution 7y agoThe author really hasn't learnt anything if he thinks that enabling all Google recovery options is the right thing to do. The only thing you should ever use is "Google Authenticator" and then store a copy of its recovery codes in a safe place (bank vault or zero-knowledge encrypted online storage). But better yet, don't use GMail in the first place.
- lkuty 7y agoIMHO. "I trusted cloud services to store my data". I never do that. I have multiple offline encrypted backup copies (on-site and off-site). I do not trust anything out of my arm's reach. The cloud is not an option for serious backups (unless you have n copies with different vendors + offline backups). I think the convenience of the cloud (with encryption) is an option when you have offline backups. I hope you will get your data back and that nothing will be compromised.
- segmondy 7y agoSomething that's very concerning about these stories is that it seems to happen more with TMobile than other carriers.
- jimnotgym 7y agoBy all means use hosted email, but if you want to stop this happening to you make sure you register your own domain! At least then you can open a new mail account and move the domain to this. That way you can make sure you can recover your other accounts...as long as you don't lose you DNS of course!
- e40 7y agoGoogle Takeout is your friend. I download all my drive, calendar, email, etc once a month. (Not photos, since I have those already.) It pays to be skeptical with your data. 3 copies. 2 local one offsite. If your only copy is offsite in the control of someone else... that's a terrible decision.
- tzs 7y ago> While I had a PIN associated with my SIM, I still do not know how the thief was able to get past this the first time, I changed this PIN on the call. If he's really talking about the SIM PIN, I don't think having one helps against this kind of attack. The SIM PIN is to prevent people in possession of your physical SIM from using your cellular account for voice or data. What you need with T-Mobile is a separate PIN that is required for porting out your number [1]. You set this PIN up by calling support. [1] https://www.t-mobile.com/customers/secure https://www.t-mobile.com/customers/secure
- jdofaz 7y agoI thought of the port out pin too, but I think the attacker convinced t-mobile support to activate a different SIM. I don't think the PIN does anything in that scenario.
- everybodyknows 7y agoThis T-mobile doc has more on the 6-15 digit "PIN/passcode": https://support.t-mobile.com/docs/DOC-37477 Note that it can be set up via the T-Mobile web site, alternative to the phone support line.
- bArray 7y agoWhy is it that the most dramatic stories of people's digital lives being lost/broken usually seem to revolve around a compromised mobile phone number? Mobile phone numbers are not unique (they are recycled) and are terrible security (mobile phone companies are careless). I change mobile numbers at least once a year and most years I end up receiving calls/messages on behalf of the previous owner. I refuse to connect my mobile phone to these services. It seems like one of the most important lessons of computer security has already been forgotten: It's only as good as the weakest link. Not only this but decentralization/redundancy is often better than centralization/dependency. For example, I'm not sitting awake at night worrying over some semi-pseudo password I generated for an old unencrypted forum run on some random persons server.
- Zancarius 7y ago> I change mobile numbers at least once a year and most years I end up receiving calls/messages on behalf of the previous owner. I had something very similar happen when I got a new number. I kept getting calls for the previous owner from what I assume to have been a bank, a library (for passed-due books no less; left a voice mail), and random people trying to contact this person. Not long thereafter, I started getting text updates from Facebook any time one of their contacts posted something. Facebook fortunately disables this with the text message STOP (IIRC) [1], but it bothered me that a nefarious actor could have passively collected the names of this person's contacts, messages, or more. Not quite sure what to do, I did end up calling most of them back to inform them they had the wrong number, if they left a voice mail. The calls stopped about a year and a half later, and while I was somewhat annoyed at the time, in retrospect it could have been much worse! [1] https://www.facebook.com/help/225089214296643 https://www.facebook.com/help/225089214296643
- tedunangst 7y agoBecause every time you login to gmail without a phone number there's a big "add your phone number for super security!!" pop up on the screen. People do what the google tells them to do.
- jeandejean 7y agoFeels like a real pain and the author has genuine honesty that I appreciate. But that's also why I don't ever use chrome to store my passwords! Why on earth would you do that??
- rad_gruchalski 7y agoThe problem starts with a mobile provider simply giving away a service to someone else. Twice. This is shocking.
- yalogin 7y agoWhat do companies still use phone numbers for 2FA? This should be an automatic design decision to not use the phone number for anything outside of initial account set up. All the banks use it.
- fastball 7y agoI don't understand how the attacker got access to his Google account just from his phone number? Was his password "password"?
- iwasakabukiman 7y agoYou can just say you forgot your password and they’ll send you a text message with a code to reset the password if you’ve registered a number with that account.
- fastball 7y agoOh yeah, that's a terrible security practice.
- deleted 7y ago[deleted]
- dev_dull 7y ago> It turns out that the 2FA with text messaging sent to a cell phone may be useless when hackers steal your SIM right out from under you. The most annoying part about this is that Twitter demands your phone number. You can't use another method for 2FA, such as U2F or OTP. I assume it's not at all because they want to authorize you or keep your account safe, but rather because they want to be able to identify you. User's lose both privacy and security. Just to clarify, you can use U2F to login, but you can’t only use U2F. Eventually you’ll be locked out of your account (after logging in) and forced to provide a valid number.
- throw0101a 7y ago> You can't use another method [with Twitter] for 2FA, such as U2F or OTP. Are you sure? * https://www.yubico.com/works-with-yubikey/catalog/twitter/ https://www.yubico.com/works-with-yubikey/catalog/twitter/
- doodpants 7y ago>If anyone has tips on how I might get my Google and Twitter accounts back, I would greatly appreciate the feedback. I know of one approach that might get results, but he's already done it: publicly shame them in an article. It's the only way to get results from these algorithm-driven companies that lack anything resembling an actual customer service department.
- tomc1985 7y agoThe lack of customer support provided my tech companies today is pathetic. Combine this with Google's decreasing effectiveness in looking up solutions to technical problems and we get this :( I have a really odd, obscure problem with SMB and Windows 10 and would really like to just call up a Microsoft tech support hotline like they used to have, except they don't even offer a paid service for that any more to consumers. Got a problem with Windows? Get fucked!
- Proven 7y agoWhether it's at home, work or on cloud, if you don't have a DR or backup plan, all it takes is a typo ...
- tobiasbischoff 7y agoI will never understand how someone can have all his digital life in one single place.. I mean, mail eMail, Passwords to all other sites, scanned documents - all in google? That is asking for trouble. Also, 2FA via Text makes your account unsafer, if any.
- clmul 7y ago> This included tax returns, account passwords for my wife in case I died, personal documents and spreadsheets, and just about everything I had paper copies of at home. This is why you should never store passwords on your computer / cloud in plain text. > Given that I had 2FA enabled for my bank account and the bank account info on Google Drive, it was just a matter of time before the thief started stealing my money. Is it common in the United States to allow online banking without any physical second factor? My bank requires me to use some kind of device similar to https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program with my card and code to login or execute transactions. I think most other banks in my country require something similar.
- kmlx 7y agomy UK bank ties their app to my phone using an off band code i receive from a person after calling their contact number. if i reinstall my OS i need to call them to receive another code.
- thom 7y agoIn the space of the afternoon after reading this article, I removed SMS 2FA from all my accounts, installed Authy, added all my accounts to it, found out Authy is also insecure[0], reconfigured it to be less insecure, and basically despaired. My solution going forward will be to spend all of my money each month so there's nothing to steal, and have a terrible reputation online that therefore can't be ruined. [0] https://medium.com/p/1367f296ef4d#681f https://medium.com/p/1367f296ef4d#681f
- cevn 7y ago> My solution going forward will be to spend all of my money each month so there's nothing to steal, and have a terrible reputation online that therefore can't be ruined. Way ahead of you there buddy (sorry, I know, no jokes..)
- Bakary 7y agoA lock on your door is obviously insecure, but can work because it introduces friction for the burglar, while there are other targets around. It's a similar principle at work for online security. Some amount of protection coupled with the statistical likelihood of being targeted already goes a long way.
- gopkarthik 7y agoAfter reading a similar article on HN a year ago, I too decided to use Authy but the realized that it was vulnerable to the same methods. I eventually decided to use andOTP[1]. While it doesn't automatically sync across devices, it does allow you to create backups[2] which can be encrypted with AES or your PGP key. Just store this in Dropbox/Drive/Box and offline storage and you're good to go. [1] https://github.com/andOTP/andOTP/blob/master/README.md https://github.com/andOTP/andOTP/blob/master/README.md [2] https://raw.githubusercontent.com/flocke/andOTP/master/assets/screenshots/backup_activity.png https://raw.githubusercontent.com/flocke/andOTP/master/asset...
- crazygringo 7y ago> We pay for Google Drive, Google Fi, and Google Play Movies so I was hoping there would be some level of customer service for paying customers. There are no phone numbers available for customers who pay for services or those who only use free services. I pay for Drive (now part of Google One) and they advertise free phone support with it. I've never used it, and it turns out it's not a phone number you can call, but rather you request a call from them: https://support.google.com/googleone/contact/googleone_c2c?hl=en https://support.google.com/googleone/contact/googleone_c2c?h... So there is a level of support for paying customers... at least in theory. I haven't heard of anyone's experiences with it in practice, however. Curious if anyone here has tried Google One support, and whether their reps have the ability to escalate issues, the way G Suite reps can?
- Animats 7y agoSomeone should start a blog at "googlevictims.com". The domain is available.
- jonnismash 7y agoAs a tech-reviewer I'd assume OP to be more tech-savvy than your average shmoe, yet they kept ALL (literally all) Finanical and generally sensitive information in a central location that easily breached (G-drive) and to top it off used 2FA through SMS for many of their services. If anything this article only discredits the author of any common sense in the tech-space.
- deleted 7y ago[deleted]
- tzs 7y agoPhone providers, email providers, and banks should provide an option to require in-person verification for account recovery or in the case of phone providers transfer of a number to a different SIM. These events should be infrequent enough that it would be OK if there was a fee for verification. This might seem impractical for people who live somewhere that the provider doesn't have an office, but it actually isn't. There is a nationwide, readily available mechanism already in place for this. They are called notary publics. It could work like this: 1. You request account recovery, and pay the fee, and provide your physical contact information. 2. The provider hires a notary public in your area, and sends them a form for you to sign authorizing the account recovery. 3. The notary meets with you, verifies your identity, notarizes your signature on the form, and then lets your provider know that this has successfully completed. 4. Now that the provider knows the request was legitimate, the recovery or transfer can go through.
- gambiting 7y agoIf you haven't yet, remove your telephone number as a recovery option for your Gmail account. And also, why can't US fix the shit that is transferring SIM cards? In the UK you can request a SIM transfer code but it takes at least a few days - there's plenty of time to catch it and stop it before someone transfers your SIM. Why can't American operators do the same? Just say "you have received your request, please wait 7 days for it to be processed" - why does it have to be instant?
- renaudg 7y agoThere's no such thing as a "SIM transfer code" in the UK. SIM swap scams are a thing here too : https://www.bbc.co.uk/news/business-46047714 https://www.bbc.co.uk/news/business-46047714
- gambiting 7y ago? Of course there is - it's called a PAC code, and it takes at least 1 working day with the fastest operators, in the meantime you get notified that it's happening.
- renaudg 7y agoNo, you're confused. A PAC code is used when switching carriers, it has nothing to do with the scam described here where an attacker contacts your carrier and claims "I lost my SIM". Activating a replacement SIM can happen in minutes (and that's a good thing : would you want to wait 7 days to get service again ?) The only thing that seems different from the US is that I don't think everything can be done over the phone here : you need to go physically into a shop and (hopefully) show ID.
- carapace 7y agoSo the same pattern unfolds: Someone trusts faceless uncaring tech companies with all of their most crucial data. Companies get hacked. User's life is crashed. Companies feel nothing and have pathetic "support". "Thankfully", insider access grants privileges. > Thankfully, I have a good friend at $COMPANY who was very concerned with my plight and was able to get $PRIVILEGED_SUPPORT My point is that we have set up these systems that have us all skating on thin ice, and when people inevitable fall through (or are pulled under by thieves) we have almost no recourse, unless we happen to be well-connected to the internal workings of these machines. We're turning the world into Morlocks and Eloi. We've got to wake up and slow this shit down.
- desc 7y agoAgree. These two snippets inspired /facepalm: > While Twitter is a free service, I would still expect some level of assistance for someone who has had the same account for 13 years and can get thousands of people to verify my identity. 'free service' being the operative words, and they can probably trust the user to do all the hard work of maintaining a new account for another 13 years (with associated pageviews) without lifting a finger. > I made sure to have two-factor authentication (2FA) enabled with this service. It turns out that the 2FA with text messaging sent to a cell phone may be useless when hackers steal your SIM right out from under you. O RLY. The point of 2FA is that one of those factors is a physical token which cannot be stolen remotely. Anything involving SMS to a phone number is not 2FA and never will be 2FA and anyone claiming otherwise is either an idiot or assumes you are...
- ChuckMcM 7y agoBack before phones we had things like fire safes that would hold your "precious memories" so when your house burned down you wouldn't lose them. That is so much harder to do these days. One of the things I do is periodically spool off ephemeral data to BD-R's (write once Blu-Ray disks). At 25GB a pop they aren't super dense but I don't actually generate more 'new' data than that in a given month. It was something I do because when I started in this business I made backups because crappy disk drives would lose data. But these days you can get crypto ransomed and poof all that data unavailable? There is no doubt a market for some new 'best practices' for data security. Perhaps No Starch Press will get someone to collect those ideas into a book.
- graeme 7y agoI find it strange that there is no procedure for the following situation: * all emergency/account recovery info changed * Person contacts shortly thereafter claiming account hack I lost a legacy skype account recently. It had had no email attached to it, so the hacker was able to add theirs and get notified whenever I got back into the account. There was no way to remove their email or add new security mechanisms without waiting 24 hours, so I had no way to keep them from resetting the password. The account was shut down for spam not long after. As far as I could tell there was no way to effectively reach microsoft about this, despite being a paying office 365 customer. They had a security chat but it was a deadend, and slow.
- gnicholas 7y ago> I have countless PR folks, friends, family, and others who are in my long Gmail history and am currently unable to access any of that information I have all this in my gmail also, but my mail downloads to my computer (I use Mail on my Mac). My Mail application data in turn backs up to a few backup drives, so I have this data in several places. Do people use gmail without having a copy stored anywhere else? I totally get that this guy has been screwed many different ways, including by Google, but it seems unwise to not have a backup copy of your mail anywhere.
- LorenPechtel 7y agoI strongly suspect the problem will continue until someone gets a nice, fat judgement against a telco over SIM swap damage. As it stands now they lose very little when it happens, why should they make their systems secure?
- DonCarlitos 7y agoGoogle NEVER helps - with anything.
- jwr 7y agoCompanies should never require SMS as a 2nd factor. It isn't secure. Let's call out names: * Twitter requires you to enable cell-phone based 2nd factor before they let you enable any other 2nd factor. Luckily in my case their buggy software determined that my cell phone number is "incorrect", so I was never able to. * Twilio (the authors of Authy!) let you use TOTP codes from Authy in addition to SMS-based 2FA. There is no way to disable the SMS authentication, so your account is never secure. * Many banks assume that SMS is a secure channel, which it isn't, and force its use as 2FA. This should get more publicity and companies should be called out on forcing people to use SMS as a 2nd factor. There are many reasons why this is a bad idea, and the story described in the article is just one of many possible attacks.
- 013a 7y agoIts because all of these companies are cheap and don't want to deal with the customer support cost of people who lose a virtual/physical MFA device. Instead, they treat virtual/physical MFA like a convenience feature that their customers keep whining about. But, if you've got that SMS on backup, then who cares if you lose the MFA; just use your phone, security be damned. 1Password is also guilty of this in a different way: They won't let you register a U2F physical security key unless you also have a virtual security key on the account. This is ridiculously simple. I'll spell it out: 1) Offer Virtual, U2F, and SMS-based multi-factor authentication. SMS is still useful for convenience on platforms which pose less of a security risk to your digital life. 2) Don't gatekeep methods of multi-factor authentication behind others. 3) Allow multiple devices for each method of multi-factor authentication, especially physical U2F keys. 4) Offer backup codes. 5) Offer an Enhanced Lockdown option, whereby customer support account recovery is irrevocably impossible in the event of lost multi-factor.
- jwr 7y agoSo, I've just realized that Chase online banking, while mandating SMS 2FA, also lets you choose "send code via E-mail". I'll… just leave this here without any further comment.
- ragingderp 7y ago“Maybe I was naive” Why don’t I take my entire life and give it to tech companies? That seems like a good idea! I’ll just upload all my tax returns and other critical documents to the cloud because the cloud is well thought out and rock solid. I know this because software of all kinds is known to be well thought out and written in a pragmatic and thoughtful manner. There have never been instances of people exploiting flaws in software or the companies that maintain software. The web is not broken and is definitely not a precarious mountain of turds held together with scotch tape. The web is rock solid and I will trust it with my very life. My whole career depends on a twitter account and i have never tried to lessen my reliance on a single twitter account. Having my entire career depend on a twitter account is a safe and prudent thing to do. I have children.
- wooptoo 7y agoGoogle now allows the removal of SMS and Voicemail based 2FA if you have a hardware token configured. Good news is you can now use your Android phone as a hardware token.
- runjake 7y agoIt’s probably a good time to remind people complaining that there is no Google support to call: You are not their customer. You are their product. This is quite literally true. They only have to care for us cattle enough to keep us as good products.
- eeeeeeeeeeeee 7y agoAnyone know if Google Voice numbers have more protection from the SIM attack? I would assume that those numbers are hard to port out anywhere given their usage, right? Are mobile numbers part of a separate pool of numbers with different rules on porting?