3 ms·

this is actually an existential financial threat for some people: - SIM swap to get obtain SMS/telephone capability - hijack email, if known + non-2FA or know

this is actually an existential financial threat for some people: - SIM swap to get obtain SMS/telephone capability - hijack email, if known + non-2FA or known SMS/telephone 2FA - this could be socially engineered as well - "sorry, i forgot my password to that email account, can you change it to..." - using gathered intel from email (e.g. monthly statements), call up banks/financial account (many of which are non-2FA or SMS/telephone 2FA) - password reset/etc any accounts without 2FA or with SMS/telephone 2FA - social engineer way into bank/financial accounts - drain and profit i've seriously considered tying up financial stuff to an undisclosed phone number on its own account.

ryacko 7y ago
Should be more than that, data leaks are everywhere, and anything worth more than the fee for a phone line should have it’s own number. I wonder if the government wants people to be as paranoid as the people running the government, or they’re just ignorant. Most of these protocols were developed during the Cold War, not after.
rolltiide 7y ago
this happens to people that store their cryptocurrency on services with sms-based 2fa. any service that uses sms-based 2fa without any other option like client side generated one time passcodes (otp) should be sued for negligence at this point. the otp should be the default choice. people are currently masquerading incompetence as an indictment to cryptocurrencies as a concept. this is allowing negligent, incompetent businesses to get a free pass, because the people that should be in charge of protecting consumers are thinking the cryptocurrency itself is insecure or "got hacked" which so far isn't what is happening. (with regard to storing cryptocurrency on someone else's server, yeah those users are being negligent too.)
- i_am_nomad 7y ago
  My personal peeve is various services that offer MFA, but very quietly still offer SMS-based 2FA as a backup that is nearly impossible to turn off. If you set up MFA, be absolutely sure that recovery is only done through one-time codes and the service doesn't automatically fall back on SMS.
  - rolltiide 7y ago
    So Coinbase and .... who else?

ryacko 7y ago

Should be more than that, data leaks are everywhere, and anything worth more than the fee for a phone line should have it’s own number. I wonder if the government wants people to be as paranoid as the people running the government, or they’re just ignorant. Most of these protocols were developed during the Cold War, not after.

rolltiide 7y ago

this happens to people that store their cryptocurrency on services with sms-based 2fa. any service that uses sms-based 2fa without any other option like client side generated one time passcodes (otp) should be sued for negligence at this point. the otp should be the default choice. people are currently masquerading incompetence as an indictment to cryptocurrencies as a concept. this is allowing negligent, incompetent businesses to get a free pass, because the people that should be in charge of protecting consumers are thinking the cryptocurrency itself is insecure or "got hacked" which so far isn't what is happening. (with regard to storing cryptocurrency on someone else's server, yeah those users are being negligent too.)

i_am_nomad 7y ago
My personal peeve is various services that offer MFA, but very quietly still offer SMS-based 2FA as a backup that is nearly impossible to turn off. If you set up MFA, be absolutely sure that recovery is only done through one-time codes and the service doesn't automatically fall back on SMS.
- rolltiide 7y ago
  So Coinbase and .... who else?