11 ms·
> But you can also gain back a phone number ...at which point the attacker has already taken over all your important online accounts and changed them to a diff
by majewsky 7y ago
> But you can also gain back a phone number
...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.
- laughinghan 7y agoNot without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously). Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?