8 ms·

How do you even mitigate sim swapping attacks? I’m getting super paranoid from all the recent news but it seems like you literally can’t do anything about it be

by pram 4y ago

How do you even mitigate sim swapping attacks? I’m getting super paranoid from all the recent news but it seems like you literally can’t do anything about it because the phone companies are so shitty lol

notRobot 4y ago
Use a second SIM+number exclusively for all 2FA that is not publically known (ie, not shared with friends or family or used for chat apps). They can't really SIM swap you if they don't know your number.
- hiq 4y ago
  That doesn't help if the attackers manage to social-engineer telcos using other public information such as your name.
  - notRobot 4y ago
    Yes. It does make it much harder though. They'd have to try every telco. Bonus points for using an online/obscure telco or sms relay.
- deepdriver 4y ago
  Still vulnerable to a breach that exposes user data at any one of the services you've signed up for, unless you use a separate SIM for each.
staticassertion 4y ago
Don't use SMS 2FA
- UncleMeat 4y ago
  You are still fairly resistant to sim-swapping in this case because they also need your password. The real concern with sim-swapping is password resets via sms.
bsder 4y ago
Don't give services your phone number. Refuse to use services that demand your phone number. Twitter has been a gigantic PITA about this. Consequently, I have to use nitter for everything. To be fair, I think I come out ahead, actually. Companies need to start being fined real money for losing PII (personally identifiable information). Once the idea of holding PII translates into "This might cost us $100 million" companies will stop keeping PII.
deleted 4y ago
[deleted]
JumpCrisscross 4y ago
> How do you even mitigate sim swapping attacks? Google Voice.
- toastal 4y ago
  Which won't work for many regions, and Google Voice numbers are blocked from a LOT of services—including PayPal which, lol, requires you to be authenticated to talk with support about issues of authentication (needless to say, I've refused to use them ever since).
  - toastal 4y ago
    Looks like I got lucky too. I went to check my account and my number needed to be reactivated. I used a free service to "verify my number" (because I don't have a US number, and would prefer not to hand it to Google anyhow) to get back the number I had had. I wouldn't be shocked if this continued as people are "abusing" the service--which is nightmare because of how many services still require a phone number despite it being known as a security issue for SMS and when it requires a US number and you are an expat, you're pretty screwed.
- troad 4y ago
  > Google Voice Q: How do you avoid your personal data being hoovered up by advertisers? A: Route all your personal communication through the largest advertising agency in the world. Nuts to that. Also, only available in the US.
  - Jcowell 4y ago
    That does not seem to be the threat model for 2FA though
- sscotthall 4y ago
  Imagine the panic when you realize Google reclaimed your number for inactivity because you haven't been sending texts or making calls, only receiving them, and you missed the couple of emails notifying you about the change. Now your number is under some random person's control.
maccard 4y ago
Use TOTP instead of SMS.
- toomuchtodo 4y ago
  Passkey will be helpful in this regard. https://developer.apple.com/videos/play/wwdc2022/10092/ https://developer.apple.com/videos/play/wwdc2022/10092/
  - maccard 4y ago
    My understanding of passkeys is simple but how is this different to any of the password managers right now? I use 1password which generates unique passwords and on all my devices already, and has done for over a decade at this point.
    - toomuchtodo 4y ago
      Answers to these questions can be found at https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305
green-salt 4y ago
SIM Lock. My iPhone has a physical AT&T SIM that i lock. I don't want it to be an esim yet so I can swap it to a different phone which will prompt me for a PIN to unlock it.
- Crosseye_Jack 4y ago
  Wrong type of sim swapping. What I suspect they are talking about is when someone uses social engineering to convince your phone provider to swap your account (and the phone number attached to it) to another sim. They then perform the SMS recovery/2fa method. Often the first you know about it is when you realise that your phone have been disconnected from the network.

by pram 4y ago

notRobot 4y ago

Use a second SIM+number exclusively for all 2FA that is not publically known (ie, not shared with friends or family or used for chat apps). They can't really SIM swap you if they don't know your number.

hiq 4y ago
That doesn't help if the attackers manage to social-engineer telcos using other public information such as your name.
- notRobot 4y ago
  Yes. It does make it much harder though. They'd have to try every telco. Bonus points for using an online/obscure telco or sms relay.
deepdriver 4y ago
Still vulnerable to a breach that exposes user data at any one of the services you've signed up for, unless you use a separate SIM for each.

staticassertion 4y ago

Don't use SMS 2FA

UncleMeat 4y ago
You are still fairly resistant to sim-swapping in this case because they also need your password. The real concern with sim-swapping is password resets via sms.

bsder 4y ago

Don't give services your phone number. Refuse to use services that demand your phone number. Twitter has been a gigantic PITA about this. Consequently, I have to use nitter for everything. To be fair, I think I come out ahead, actually. Companies need to start being fined real money for losing PII (personally identifiable information). Once the idea of holding PII translates into "This might cost us $100 million" companies will stop keeping PII.

deleted 4y ago

[deleted]

JumpCrisscross 4y ago

> How do you even mitigate sim swapping attacks? Google Voice.

toastal 4y ago
Which won't work for many regions, and Google Voice numbers are blocked from a LOT of services—including PayPal which, lol, requires you to be authenticated to talk with support about issues of authentication (needless to say, I've refused to use them ever since).
- toastal 4y ago
  Looks like I got lucky too. I went to check my account and my number needed to be reactivated. I used a free service to "verify my number" (because I don't have a US number, and would prefer not to hand it to Google anyhow) to get back the number I had had. I wouldn't be shocked if this continued as people are "abusing" the service--which is nightmare because of how many services still require a phone number despite it being known as a security issue for SMS and when it requires a US number and you are an expat, you're pretty screwed.
troad 4y ago
> Google Voice Q: How do you avoid your personal data being hoovered up by advertisers? A: Route all your personal communication through the largest advertising agency in the world. Nuts to that. Also, only available in the US.
- Jcowell 4y ago
  That does not seem to be the threat model for 2FA though
sscotthall 4y ago
Imagine the panic when you realize Google reclaimed your number for inactivity because you haven't been sending texts or making calls, only receiving them, and you missed the couple of emails notifying you about the change. Now your number is under some random person's control.

maccard 4y ago

Use TOTP instead of SMS.

toomuchtodo 4y ago
Passkey will be helpful in this regard. https://developer.apple.com/videos/play/wwdc2022/10092/ https://developer.apple.com/videos/play/wwdc2022/10092/
- maccard 4y ago
  My understanding of passkeys is simple but how is this different to any of the password managers right now? I use 1password which generates unique passwords and on all my devices already, and has done for over a decade at this point.
  - toomuchtodo 4y ago
    Answers to these questions can be found at https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305

green-salt 4y ago

SIM Lock. My iPhone has a physical AT&T SIM that i lock. I don't want it to be an esim yet so I can swap it to a different phone which will prompt me for a PIN to unlock it.

Crosseye_Jack 4y ago
Wrong type of sim swapping. What I suspect they are talking about is when someone uses social engineering to convince your phone provider to swap your account (and the phone number attached to it) to another sim. They then perform the SMS recovery/2fa method. Often the first you know about it is when you realise that your phone have been disconnected from the network.