4 ms·
> Call your cellphone carrier and ask to set up a password/PIN Note that, at least for TMobile, AT&T, and Verizon, the password/PIN is presented to the CSR in
by mceachen 7y ago
> Call your cellphone carrier and ask to set up a password/PIN
Note that, at least for TMobile, AT&T, and Verizon, the password/PIN is presented to the CSR in plaintext (as they verify the pin over the phone verbally).
I'd assumed they'd transfer to some pin-capture applet to verify, but nope.
> Use an authentication app, such as Google Authenticator
If you decide on Google Authenticator, make sure you scan the barcode with 2 devices (say, your tablet and your phone) to back up that credential. Or just use Authy.
- rashkov 7y agoAuthy allows you to recover your account using... SMS. So this is also vulnerable to SIM swapping. https://medium.com/mycrypto/what-to-do-when-sim-swapping-happens-to-you-1367f296ef4d https://medium.com/mycrypto/what-to-do-when-sim-swapping-hap...
- timwis 7y agoOmg you're kidding me
- roywiggins 7y ago> scan the barcode with 2 devices You can print out a copy of the barcode and keep it somewhere safe. It's a little bit scary as that barcode is a super powerful extra key but, you will have a key that will work and not be reliant on any device to store it.
- yellowapple 7y agoThere are plenty of TOTP apps (besides Authy) that support backing up the code generation keys. I use andOTP, for example, which supports backing up locally to the phone's internal storage (and optionally encrypting that backup with either AES + a passphrase or a PGP key if you've setup an OpenPGP provider on your device). 1Password's iOS (and Android?) app also supports TOTP.