5 ms·
How do you protect against this type of attack?
by testfoobar 6y ago
How do you protect against this type of attack?
- 0xbadcafebee 6y agoDon't use a phone. Lucky's company has this product that can monitor for the attack, but it won't prevent it: https://okeymonitor.com/ https://okeymonitor.com/
- wealthyyy 6y agoBanks already has tools that detects SIM Swaps and SS7 attacks. It's just hard to make decisions. Banks care about false positives too.
- techrat 6y agoDon't use Phone number based 2Factor or if you must use a number, keep it to an app (eg, Google Voice) and don't forward your Google Voice texts to your phone's number. Basically, avoid using your carrier provided phone number for anything related to an account.
- voltagex_ 6y agoGoogle Voice is US-only.
- jrwr 6y agoGoogle Voice SMS might not be able to help since they are all in the same POTS ecosystem as well.
- bogwog 6y agoBut Google Voice requires a Google account, and to create a Google account you need to provide a valid phone number. There are also a lot of service providers that don't allow you create an account without providing a valid phone number. I wonder how high-profile politicians and celebrities deal with security issues like this? If this is really such an easy attack to pull off, what's stopping someone from shilling cryptocurrencies on celebrity social media accounts (again)?
- davchana 6y agoI deleted the phone number from google account, just use 2FA from app. Now forgot password does not give extreme option of just sending a code to my phone.
- thelean12 6y agoHow do you recover your account if you don't have the app?
- danlugo92 6y agoYou can have a backup of the private key written on a piece of paper.
- davchana 6y agoI mean sending a code VIA SMS. I mean I deleted the phone number from my Google account. Now I have only Auth App, & Google App. The code & recovery options are 8 digit recovery phrase, Tap in Google App on other device. No reset code SMS.
- sakopov 6y agoYou could remove recovery phone number from your Google account use a couple (main and backup) hardware tokens like Yubikey as 2FA.
- supernova87a 6y agoI believe the practical solution for many people is to switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily. Most important account / banks / etc services now offer this option. The only thing is, though, make sure to keep backups of the codes you use to initialize the authenticator app, because for some services there is no recovery if you lose your phone or don't have backups.
- shishy 6y agoHi, which bank(s) offer this? > switch the 2FA to an authenticator on-your-phone code generator, which someone cannot hack easily. I remember looking a few months ago and they only offered SMS 2FA. Thanks
- supernova87a 6y agoSorry, I should've been more specific/accurate. I meant brokerages, like Fidelity, Etrade, Schwab -- where you're likely to have more funds/$ than a regular consumer bank. They do offer it. Even Amazon offers it. And you are right, I have not seen any of the banks I use convert to authenticator (BofA, Chase, etc). I can only guess that they think it's too difficult for the average consumer to understand or implement. But the fact that they don't even offer as an option is unfortunate. edit: actually I correct myself, seems like BofA may actually offer something like this: https://play.google.com/store/apps/details?id=com.bankofamerica.authenticator&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.bankofamer... However, I can't tell/test because I don't use Android
- deleted 6y ago[deleted]
- jfrunyon 6y agoUnfortunately, Fidelity (at least for my account) only offers some non-standard "Symantec VIP" product. Does someone reading this know if there's a way to turn it into standard TOTP?