5 ms·

I don't enable it because of the social engineering attacks against mobile carriers, tricking them to hand out SIM cards to crooks.

by bagels 6y ago

danuker 6y ago
I recommend andOTP downloaded from F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/
- CarelessExpert 6y ago
  Also for the desktop I just use KeepassXC with my TOTP creds in their own database.
  - twobitshifter 6y ago
    Isn’t switching between two databases a hassle?
    - ysangkok 6y ago
      No, KeepassXC provides a "Recently used databases" listing, so the effort required is 2-3 clicks and a password prompt.
    - CarelessExpert 6y ago
      You can have more than one database open at a time.
- boromisp 6y ago
  An other option: Aegis Authenticator https://f-droid.org/packages/com.beemdevelopment.aegis https://f-droid.org/packages/com.beemdevelopment.aegis
CarelessExpert 6y ago
Which is irrelevant given Google uses a combination of TOTP, and for connected Android phones or iOS devices running certain Google apps, a confirmation prompt on the phone.
JimDabell 6y ago
Enabling SMS 2FA doesn't make your account less secure. At worst, if somebody targets you with SIMjacking, it simply doesn't make you more secure. If you don’t have 2FA enabled for your account, you are in the least secure position compared with enabling any 2FA method. Either way, there’s no need to use SMS for 2FA with Google, they support many other forms of 2FA.
- GhostVII 6y ago
  I think Google actually allowed you to just use your phone number to recover your account, so it was effective 1FA. In that case it would be less secure. They might have changed it now though.
- PeterisP 6y ago
  Often enabling SMS 2FA also enables SMS as a password reset option, which does make you less secure, since SIMjacking is easier than guessing a reasonable not-reused password.
  - CarelessExpert 6y ago
    With Google you can disable SMS-based account recovery independent of your 2FA options.
  - fr2null 6y ago
    If that is the case though, you are not really enabling SMS 2FA. It is just SMS (1F) authentication. Real 2FA would (theoretically) never make your account less secure than 1FA, because even if the second factor has 0 security, it shouldn't decrease the security of the first factor. However, it is true that this may not always be the case for imperfect implementations, like your example. I can aldo imagine that social engineering might have a higher succes ratio if the intruder can say "it really is me! I have the correct second factor, I just lost my first factor...".
remus 6y ago
SMS based 2SV is just one option, there are many better methods you can enable for a google account.
forgotpwd16 6y ago
In my country I've been required to go with my ID to a carrier shop to get a new SIM. How does that work elsewhere?
- reaperducer 6y ago
  In some countries you can buy a SIM card, or even a dozen SIM cards, with no more hassle than buying a loaf of bread.
- tialaramex 6y ago
  Even if your carrier actually enforces such a policy, the actual implementation is trusted to that part-timer on minimum wage you showed the ID to. They push "OK" on the ID check step, and it's done. What do you suppose happens when the hot guy in the club who bought them and all their friends a round of drinks says they can make a month's salary in ten minutes if they allow a few of his mates to skip that "annoying" ID check? And I'm sure that afterwards, once the carrier figures out who was responsible, they'll get fired. But meanwhile your accounts were taken over and leveraged for some scam or (if you own "cool" things like a short Twitter handle or that rare drop in a video game) sold to the highest bidder.
  - ztcfegzgf 6y ago
    you do realize that the same can be done for a bank-account, right? at the end of the day someone is sitting at a computer and given an id-card from a stranger and clicking the "yes, i verified their id card".
    - tialaramex 6y ago
      The bank account is the responsibility of the bank, the employer of these "strangers" you're talking about. Whereas, of course, the reason we're discussing SIM attacks isn't that some bad guys might use your monthly download credits, or make a phone call that you pay for (the phone company would of course undo these charges once it was apparent that their employee caused the problem) but instead that this can be leveraged to gain access to all sorts of accounts your phone company has no responsibility for whatsoever. The security was totally appropriate for the scope in which it was intended to be used, but that doesn't make it magically appropriate for all possible scopes.

I don't enable it because of the social engineering attacks against mobile carriers, tricking them to hand out SIM cards to crooks.

by bagels 6y ago

I don't enable it because of the social engineering attacks against mobile carriers, tricking them to hand out SIM cards to crooks.

danuker 6y ago

I recommend andOTP downloaded from F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

CarelessExpert 6y ago
Also for the desktop I just use KeepassXC with my TOTP creds in their own database.
- twobitshifter 6y ago
  Isn’t switching between two databases a hassle?
  - ysangkok 6y ago
    No, KeepassXC provides a "Recently used databases" listing, so the effort required is 2-3 clicks and a password prompt.
  - CarelessExpert 6y ago
    You can have more than one database open at a time.
boromisp 6y ago
An other option: Aegis Authenticator https://f-droid.org/packages/com.beemdevelopment.aegis https://f-droid.org/packages/com.beemdevelopment.aegis

CarelessExpert 6y ago

Which is irrelevant given Google uses a combination of TOTP, and for connected Android phones or iOS devices running certain Google apps, a confirmation prompt on the phone.

JimDabell 6y ago

Enabling SMS 2FA doesn't make your account less secure. At worst, if somebody targets you with SIMjacking, it simply doesn't make you more secure. If you don’t have 2FA enabled for your account, you are in the least secure position compared with enabling any 2FA method. Either way, there’s no need to use SMS for 2FA with Google, they support many other forms of 2FA.

GhostVII 6y ago
I think Google actually allowed you to just use your phone number to recover your account, so it was effective 1FA. In that case it would be less secure. They might have changed it now though.
PeterisP 6y ago
Often enabling SMS 2FA also enables SMS as a password reset option, which does make you less secure, since SIMjacking is easier than guessing a reasonable not-reused password.
- CarelessExpert 6y ago
  With Google you can disable SMS-based account recovery independent of your 2FA options.
- fr2null 6y ago
  If that is the case though, you are not really enabling SMS 2FA. It is just SMS (1F) authentication. Real 2FA would (theoretically) never make your account less secure than 1FA, because even if the second factor has 0 security, it shouldn't decrease the security of the first factor. However, it is true that this may not always be the case for imperfect implementations, like your example. I can aldo imagine that social engineering might have a higher succes ratio if the intruder can say "it really is me! I have the correct second factor, I just lost my first factor...".

remus 6y ago

SMS based 2SV is just one option, there are many better methods you can enable for a google account.

forgotpwd16 6y ago

In my country I've been required to go with my ID to a carrier shop to get a new SIM. How does that work elsewhere?

reaperducer 6y ago
In some countries you can buy a SIM card, or even a dozen SIM cards, with no more hassle than buying a loaf of bread.
tialaramex 6y ago
Even if your carrier actually enforces such a policy, the actual implementation is trusted to that part-timer on minimum wage you showed the ID to. They push "OK" on the ID check step, and it's done. What do you suppose happens when the hot guy in the club who bought them and all their friends a round of drinks says they can make a month's salary in ten minutes if they allow a few of his mates to skip that "annoying" ID check? And I'm sure that afterwards, once the carrier figures out who was responsible, they'll get fired. But meanwhile your accounts were taken over and leveraged for some scam or (if you own "cool" things like a short Twitter handle or that rare drop in a video game) sold to the highest bidder.
- ztcfegzgf 6y ago
  you do realize that the same can be done for a bank-account, right? at the end of the day someone is sitting at a computer and given an id-card from a stranger and clicking the "yes, i verified their id card".
  - tialaramex 6y ago
    The bank account is the responsibility of the bank, the employer of these "strangers" you're talking about. Whereas, of course, the reason we're discussing SIM attacks isn't that some bad guys might use your monthly download credits, or make a phone call that you pay for (the phone company would of course undo these charges once it was apparent that their employee caused the problem) but instead that this can be leveraged to gain access to all sorts of accounts your phone company has no responsibility for whatsoever. The security was totally appropriate for the scope in which it was intended to be used, but that doesn't make it magically appropriate for all possible scopes.