4 ms·

But you can also gain back a phone number, by bringing your new phone to the phone company's physical location and presenting ID. That's not really an option wi

• majewsky 7y ago
  > But you can also gain back a phone number ...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.
  • laughinghan 7y ago
    Not without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously). Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?
• ubercow13 7y ago
  That depends on the way the phone company operates surely? You can’t do it if you are abroad, or if it’s a prepay SIM and the phone company doesn’t know your identity. Some telcos will give your number to somebody else if you don’t connect with the network for too long.
  • laughinghan 7y ago
    Sure, you're totally right that in some cases, physically losing a phone also means loss of that phone number. But in 100% of cases, physically losing a phone means loss of those TOTP tokens. For the vast majority of people, that's a dealbreaker, in spite of SMS being deeply flawed, as the comment you originally replied to said.