4 ms·
I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or
by pmarreck 7y ago
I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself
- shawabawa3 7y agoyou should be aware that Authy can by default be taken over with just your sim card. I believe with the right settings you can disable this behaviour
- zwily 7y agoYes, you have to disable “multiple devices”. You just have to remember to re-enable it if you want to install Authy on a new phone and reinstall from backup.
- claviola 7y agoI've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.
- filoleg 7y agoI've been using Google Voice for that purpose for years, and it has been perfect. The phone number that is for 2FA only, shouldn't be as easy to social engineer your typical telcom, since it is all controlled from within my Google account, and I get immediate security notifications if something fishy is up.
- oarsinsync 7y agoThat's a great plan, and it definitely reduces your risk to being exposed to SIM hijacking. Unfortunately, I suspect services that enforce poor security standards are probably not following best practices in their backend either. This means your secret number stops being secret if their database ever leaks. It's still better than using the same number as you use for everything else, but it's important to understand the caveats.
- kalleboo 7y agoThis is standard practice for public figures like YouTubers who often get griefed
- oarsinsync 7y ago> Google 2FA via Authy "Google 2FA" is TOTP, an open standard, not a Google produced solution. https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
- pmarreck 7y agoThanks for the clarification. I knew it was open-source, didn't realize it was an RFC.