3 ms·

Geez, it's a good thing I removed cell 2FA from all my accounts after getting hacked (SIM card transfer via social engineering)

drivebycomment 6y ago
Yes. Anyone who want the protection from the SIM swap attack should remove phone 2FA from their accounts, and should consider accounts that do not support such configuration as vulnerable. Whether you consider the SIM swap attack a threat worth protecting from would depend on many factors, even though the threat itself is very real, and almost all phone numbers are vulnerable to the attack. I have yet to learn any phone service provider that is not vulnerable to this attack. I've heard people speculating that Google Fi might be one such provider, but I don't know if Fi customer service actually is not vulnerable.
woadwarrior01 6y ago
The problem with Twitter is they don't allow adding more than one security key (like Yubikey, NitroKey etc) per account. Google, FB, Github and almost everyone else who supports security keys does support multiple keys. Without it, I wouldn't disable SMS auth on Twitter, yet (the security key could die at any point, hypothetically speaking; which is why you have a backup or two).
- war1025 6y ago
  Why wouldn't you just record the authenticator code somewhere? You can easily generator OTP codes the same as any of the "authenticator" apps using, for example, oathtool [1] You don't even need the code to be stored on a computer. Just write it down somewhere safe if you're paranoid about getting hacked. The seed codes are usually 16 characters or so. [1] https://www.nongnu.org/oath-toolkit/oathtool.1.html https://www.nongnu.org/oath-toolkit/oathtool.1.html
  - woadwarrior01 6y ago
    You're right, that's exactly what I've got. I'd forgotten the exact setup I have on Twitter. I just checked and I've got a TOTP app (with backup codes on paper) + Yubikey. I'd disabled SMS for 2FA last year, around the time when Jack Dorsey's Twitter account was compromised with a SIM swap attack.
toby- 6y ago
>(SIM card transfer via social engineering) How exactly does this happen?
- hu3 6y ago
  Impersonate as the client of the phone company and request a new SIM card under the pretense that your current SIM card was stolen/lost. Or bribe company staff to give you the SIM card. Phone company staff are error-prone humans just like you and me who in general don't earn well enough for their responsibilities.
  - toby- 6y ago
    Aha! I'm an idiot; I thought this referred to social engineering of the person who owns the handset/SIM, not phone company staff. That makes a lot more sense. Thanks!
kohtatsu 6y ago
SIM swapping should not be an attack. It's called "Two-factor Authentication", not "OK Whichever Authentication".
- drivebycomment 6y ago
  It absolutely is an attack. SIM swap is a targeted attack. In a targeted attack scenario, phishing (for id and password) will succeed with high enough probability. Also, the account recovery path often requires only the phone number, effectively making the recovery phone number as the single factor.
  - kohtatsu 6y ago
    I'm remarking on the last sentence of your comment~

drivebycomment 6y ago

Yes. Anyone who want the protection from the SIM swap attack should remove phone 2FA from their accounts, and should consider accounts that do not support such configuration as vulnerable. Whether you consider the SIM swap attack a threat worth protecting from would depend on many factors, even though the threat itself is very real, and almost all phone numbers are vulnerable to the attack. I have yet to learn any phone service provider that is not vulnerable to this attack. I've heard people speculating that Google Fi might be one such provider, but I don't know if Fi customer service actually is not vulnerable.

woadwarrior01 6y ago

The problem with Twitter is they don't allow adding more than one security key (like Yubikey, NitroKey etc) per account. Google, FB, Github and almost everyone else who supports security keys does support multiple keys. Without it, I wouldn't disable SMS auth on Twitter, yet (the security key could die at any point, hypothetically speaking; which is why you have a backup or two).

war1025 6y ago
Why wouldn't you just record the authenticator code somewhere? You can easily generator OTP codes the same as any of the "authenticator" apps using, for example, oathtool [1] You don't even need the code to be stored on a computer. Just write it down somewhere safe if you're paranoid about getting hacked. The seed codes are usually 16 characters or so. [1] https://www.nongnu.org/oath-toolkit/oathtool.1.html https://www.nongnu.org/oath-toolkit/oathtool.1.html
- woadwarrior01 6y ago
  You're right, that's exactly what I've got. I'd forgotten the exact setup I have on Twitter. I just checked and I've got a TOTP app (with backup codes on paper) + Yubikey. I'd disabled SMS for 2FA last year, around the time when Jack Dorsey's Twitter account was compromised with a SIM swap attack.

toby- 6y ago

>(SIM card transfer via social engineering) How exactly does this happen?

hu3 6y ago
Impersonate as the client of the phone company and request a new SIM card under the pretense that your current SIM card was stolen/lost. Or bribe company staff to give you the SIM card. Phone company staff are error-prone humans just like you and me who in general don't earn well enough for their responsibilities.
- toby- 6y ago
  Aha! I'm an idiot; I thought this referred to social engineering of the person who owns the handset/SIM, not phone company staff. That makes a lot more sense. Thanks!

kohtatsu 6y ago

SIM swapping should not be an attack. It's called "Two-factor Authentication", not "OK Whichever Authentication".

drivebycomment 6y ago
It absolutely is an attack. SIM swap is a targeted attack. In a targeted attack scenario, phishing (for id and password) will succeed with high enough probability. Also, the account recovery path often requires only the phone number, effectively making the recovery phone number as the single factor.
- kohtatsu 6y ago
  I'm remarking on the last sentence of your comment~