4 ms·

The only way I've found to protect against SIM Swap is to use Google voice for my SMS. Google has good two factor authentication and, since it has no telephone

The only way I've found to protect against SIM Swap is to use Google voice for my SMS. Google has good two factor authentication and, since it has no telephone customer service, is hardened to PII based social engineering, or at least you can't SIM Swap somebody with just a name and an SSN.

e40 7y ago
And to make it clear, if you have phone service with Google Fi, your number is a Google Voice number (for SMS purposes).
- pxeboot 7y ago
  Fi numbers are actually hosted by T-Mobile. Google Voice uses bandwidth.com and possibly other VoIP providers in some rate centers.
bigiain 7y ago
That's a working, but very very scary foundation for security. "Google's customers service is _so_ fucked even the most dedicated social engineers with the biggest of whales in their sights can't get them to do a fucking thing."
- red_phone 7y ago
  What’s even scarier is the premise of your comment: "Any decent customer service operation will fall prey to social engineering." And what's unfortunate is that you're probably right!
  - bigiain 7y ago
    To be fair, banks do an OK job of that. (Well, it's hard to take over an account purely by remote social engineering, some of mine still blindly use SMS as an authentication thing...) Telcos do not secure phone numbers to banking grade security, because they never agreed to be part of anyone's critical security posture, and their own incentives are to make it as easy and quick as possible for customers to move their phone numbers around. It's in the telco's interest for you to be able to walk into a $TelcoBrand store and walk out with a functioning device with your old number. (Or to call up their support line and do the same thing.) They never offered to make that more difficult than it needs to be just because companies like PayPal wanted to outsource security to be somebody else's expense. They've been actively recommending against it since forever: https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...
    - mrb 7y ago
      «To be fair, banks do an OK job of that» Are you kidding? Banks do a terrible job. Just one data point: «Losses from [bank] account takeovers hit $5.1 billion last year, a 120 percent increase over 2016» https://www.aarp.org/money/scams-fraud/info-2018/thieves-targeting-bank-accounts.html https://www.aarp.org/money/scams-fraud/info-2018/thieves-tar...
- narrator 7y ago
  It would be nice if you could show up in person with a photo id and validate yourself. For a lot of bank transactions in developing countries you have to inconveniently show up in person with your ID because it's a simple way to reduce fraud.
  - deleted 7y ago
    [deleted]
dehrmann 7y ago
> since [Google] has no customer service, it's hardened to PII based social engineering, ftfy

e40 7y ago

And to make it clear, if you have phone service with Google Fi, your number is a Google Voice number (for SMS purposes).

pxeboot 7y ago
Fi numbers are actually hosted by T-Mobile. Google Voice uses bandwidth.com and possibly other VoIP providers in some rate centers.

bigiain 7y ago

That's a working, but very very scary foundation for security. "Google's customers service is _so_ fucked even the most dedicated social engineers with the biggest of whales in their sights can't get them to do a fucking thing."

red_phone 7y ago
What’s even scarier is the premise of your comment: "Any decent customer service operation will fall prey to social engineering." And what's unfortunate is that you're probably right!
- bigiain 7y ago
  To be fair, banks do an OK job of that. (Well, it's hard to take over an account purely by remote social engineering, some of mine still blindly use SMS as an authentication thing...) Telcos do not secure phone numbers to banking grade security, because they never agreed to be part of anyone's critical security posture, and their own incentives are to make it as easy and quick as possible for customers to move their phone numbers around. It's in the telco's interest for you to be able to walk into a $TelcoBrand store and walk out with a functioning device with your old number. (Or to call up their support line and do the same thing.) They never offered to make that more difficult than it needs to be just because companies like PayPal wanted to outsource security to be somebody else's expense. They've been actively recommending against it since forever: https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...
  - mrb 7y ago
    «To be fair, banks do an OK job of that» Are you kidding? Banks do a terrible job. Just one data point: «Losses from [bank] account takeovers hit $5.1 billion last year, a 120 percent increase over 2016» https://www.aarp.org/money/scams-fraud/info-2018/thieves-targeting-bank-accounts.html https://www.aarp.org/money/scams-fraud/info-2018/thieves-tar...
narrator 7y ago
It would be nice if you could show up in person with a photo id and validate yourself. For a lot of bank transactions in developing countries you have to inconveniently show up in person with your ID because it's a simple way to reduce fraud.
- deleted 7y ago
  [deleted]

dehrmann 7y ago

> since [Google] has no customer service, it's hardened to PII based social engineering, ftfy