5 ms·

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those ar

I'm surprised that you can't remove/disable the fallback SMS number. One thing you can do to mitigate that problem is to create a Google Voice number. Those are harder to port as long as you created it on Google Voice.

jeromegv 7y ago
A solution often mentioned but not available to anyone outside the US.
- munchbunny 7y ago
  Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you? It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.
  - davchana 7y ago
    I think each Google Voice number needs a real US phone number, where calls/texts sent to GV Number will be forwarded to.
    - dbancajas 7y ago
      > print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devic but this can be configured to not forward the text/voicemail.
- kalleboo 7y ago
  Or just get a prepaid phone with a number you don't tell anyone. And if your country allows it, without registering your name/ID to it.
archi42 7y ago
You're right, but I dislike that route for three reasons: 1. It should just be plain unnecessary to apply such a hack. 2. There is still a single weak point for all services. 3. While this prevents against the run-of-the-mill "attacker activates another SIM card for my mobile number and steals my crypto cash from $online_wallet" coming up here every few month, a more sophisticated attacker can just route the SMS to himself via SS7 (I suppose the SIM variant is easier to pull off with less traces, and obviously requires much less technical expertise).
- munchbunny 7y ago
  I agree with all of your points. Really Github should just let you remove any dependency on SMS entirely. I lucked out in that I never configured SMS as a fallback. I have backup codes printed out in a safe.
morpheuskafka 7y ago
What about a Twilio virtual number? Isn't porting disabled for them?
- kelnos 7y ago
  Porting is not disabled, though presumably it would be harder for an attacker to figure out your number if you only use it for 2FA purposes. The main issue with Twilio numbers is that they can't receive from short codes. If the service you're using sends 2FA codes from a short code, they'll just disappear into the ether. Of course, if you're just using this as a placeholder because the site requires SMS backup, then maybe it's ok that you can't receive on them.
techsupporter 7y ago
> Those are harder to port as long as you created it on Google Voice. I hope this myth goes away soon. It is trivial for any bad actor to force-port a number, even if it is reclaimed a day or two later. If I wanted to get fired, I could yank your GV number (which is, most of the time, really at Bandwidth.com) in a few minutes; the medium-sized voice provider I am at does several of these types of ports a week to help customers trying to leave recalcitrant providers.

jeromegv 7y ago

A solution often mentioned but not available to anyone outside the US.

munchbunny 7y ago
Can you create one that doesn't forward to your phone? Could a US friend create one for you in a new account and hand that account over to you? It's more about sinking that second factor somewhere that can't be redirected and only you can theoretically access by logging into Google Voice. You don't have to forward the messages to your actual phone.
- davchana 7y ago
  I think each Google Voice number needs a real US phone number, where calls/texts sent to GV Number will be forwarded to.
  - dbancajas 7y ago
    > print your recovery code and store it in a safe location, and that you set up at least two security keys or authenticator devices. Should you lose access to all two-step verification devic but this can be configured to not forward the text/voicemail.
kalleboo 7y ago
Or just get a prepaid phone with a number you don't tell anyone. And if your country allows it, without registering your name/ID to it.

archi42 7y ago

You're right, but I dislike that route for three reasons: 1. It should just be plain unnecessary to apply such a hack. 2. There is still a single weak point for all services. 3. While this prevents against the run-of-the-mill "attacker activates another SIM card for my mobile number and steals my crypto cash from $online_wallet" coming up here every few month, a more sophisticated attacker can just route the SMS to himself via SS7 (I suppose the SIM variant is easier to pull off with less traces, and obviously requires much less technical expertise).

munchbunny 7y ago
I agree with all of your points. Really Github should just let you remove any dependency on SMS entirely. I lucked out in that I never configured SMS as a fallback. I have backup codes printed out in a safe.

morpheuskafka 7y ago

What about a Twilio virtual number? Isn't porting disabled for them?

kelnos 7y ago
Porting is not disabled, though presumably it would be harder for an attacker to figure out your number if you only use it for 2FA purposes. The main issue with Twilio numbers is that they can't receive from short codes. If the service you're using sends 2FA codes from a short code, they'll just disappear into the ether. Of course, if you're just using this as a placeholder because the site requires SMS backup, then maybe it's ok that you can't receive on them.

techsupporter 7y ago

> Those are harder to port as long as you created it on Google Voice. I hope this myth goes away soon. It is trivial for any bad actor to force-port a number, even if it is reclaimed a day or two later. If I wanted to get fired, I could yank your GV number (which is, most of the time, really at Bandwidth.com) in a few minutes; the medium-sized voice provider I am at does several of these types of ports a week to help customers trying to leave recalcitrant providers.