6 ms·

Not everyone got this version of the notice. Here's a reddit user who posted [1] that they were SIM swapped: > Additionally, on January 1, 2023 for about 1 hou

Not everyone got this version of the notice. Here's a reddit user who posted [1] that they were SIM swapped: > Additionally, on January 1, 2023 for about 1 hour 48 minutes, your mobile phone service was transferred from your SIM card to another SIM card. During the time of this temporary transfer, the unauthorized access could have involved the use of your phone number to send and receive phone calls and text messages. Despite the SIM transfer, your voicemail could not have been accessed. We have restored Google Fi service to your SIM card. [1]: https://old.reddit.com/r/GoogleFi/comments/10pjtie/google_fi_data_breach/j6kysv8/ https://old.reddit.com/r/GoogleFi/comments/10pjtie/google_fi...

livueta 4y ago
Oof, that's not good. As a Fi user, I'm pretty angry at the moment even though I got the other version of the notice. That's because one of the main reasons I was using Fi in the first place was the perceived protection against sim swapping, via a super locked down special purpose Google account and the apparent inability of T-Mobile CSRs to access Fi customer data. The first thing I thought upon reading the notice was usefulness for sim swapping, and my heart fell upon reading your comment. Good reminder that SMS 2fa fucking sucks and so do the institutions that insist on it, especially those that offer other forms of 2fa but treat SMS as a fallback (why why why why why).
- georgyo 4y ago
  The why is obvious. People will lose their 2FA. It's a fact of life. Lost keys with your yubikey. Broken phone without a backup of your totp. Etc. After that, how do you prove that someone owns their account? Send a photocopy of your passport? No way to edit a picture, right? Answer some security questions, which you certainly forgot the answer to. And people are likely using the same questions with the same answer on many sites. Tell them tough luck? The problem is there isn't a good answer for the most common failure mode. SMS 2FA isn't perfect, but it is accessible to nearly everyone and delegates ownership proof to the telephone company.
  - gleenn 4y ago
    Solution is multiple yubikeys or printing out backup codes.
    - nirvdrum 4y ago
      How are you handling multiple Yubikeys? I'm doing it personally and it's so annoying that I can't imagine recommending this to anyone else. Since I'd hate to lose access to everything if my house burns down, I keep a key outside of the home. Of course, for that key to be useful, I need to update it whenever I use my key on a new site/service. Dropping everything to go fetch my key is inconvenient, so I keep multiple keys in the house. That way I can add two keys to a service and have a local backup in case one breaks. But, then I need to remember to actually add the off-site key to the account as well. Maybe I should just round-robin the off-site key. It's just tedious to keep track of what's been registered with which key and making sure they're all in sync. I really wish there were a secure way to simply have a key backup. Not to mention, this is kind of expensive and also non-obvious as Yubikey primarily sells single keys. I'd love to see wider adoption, but can't see the general population putting up with this.
      - artdigital 4y ago
        I just have one in my drawer and one in my bag / always connected to my Mac Then a printed backup sheets like 1password somewhere offsite (still needs master password to be usable)
      - microtheo 4y ago
        I use Windows hello and Apple passkey as secondary fido devices, isn’t that a valid method??
        nirvdrum 4y ago
        Maybe? I really don't know. I dual-boot a Linux & Windows workstation and have a macOS laptop, so I haven't looked too deeply into platform-specific solutions. For now, I stick with Yubikeys. Complicating things further is for some accounts I'd like to give my wife access and she has her own keys and own devices. I've hit the key registration limit on some sites.
- mjg59 4y ago
  Fi is an MVNO - there's apparently some sort of magical mapping between Fi numbers and network-specific numbers that still end up on the network's infrastructure (there apparently used to be issues with 911 operators seeing the network-specific number rather than the actual Fi number), and the mapping of that network-specific number onto an IMSI is still going to be under the control of that network. It's possible to block front-end agents from being able to do anything with that, but if someone compromises network infrastructure then it seems like it's hard to protect against it?
pifm_guy 4y ago
> could have involved the use of your phone number to send and receive phone calls Surely from their logs they know if these calls/texts happened? If, during that period no calls/sms's occurred, then there has been no breach - the attacker was close to their target, but walked away with nothing. If messages/calls were made, the user really needs to know who they were to/from to make any informed decisions. And Google has those logs.
- nr2x 4y ago
  Straight to a write only bucket in Maryland.
- chrisbolt 4y ago
  > Surely from their logs they know if these calls/texts happened? Why would they have logs of calls/texts that weren't routed to them?
astrashe2 4y ago
Has anyone been able to confirm that this actually happened?

livueta 4y ago

Oof, that's not good. As a Fi user, I'm pretty angry at the moment even though I got the other version of the notice. That's because one of the main reasons I was using Fi in the first place was the perceived protection against sim swapping, via a super locked down special purpose Google account and the apparent inability of T-Mobile CSRs to access Fi customer data. The first thing I thought upon reading the notice was usefulness for sim swapping, and my heart fell upon reading your comment. Good reminder that SMS 2fa fucking sucks and so do the institutions that insist on it, especially those that offer other forms of 2fa but treat SMS as a fallback (why why why why why).

georgyo 4y ago
The why is obvious. People will lose their 2FA. It's a fact of life. Lost keys with your yubikey. Broken phone without a backup of your totp. Etc. After that, how do you prove that someone owns their account? Send a photocopy of your passport? No way to edit a picture, right? Answer some security questions, which you certainly forgot the answer to. And people are likely using the same questions with the same answer on many sites. Tell them tough luck? The problem is there isn't a good answer for the most common failure mode. SMS 2FA isn't perfect, but it is accessible to nearly everyone and delegates ownership proof to the telephone company.
- gleenn 4y ago
  Solution is multiple yubikeys or printing out backup codes.
  - nirvdrum 4y ago
    How are you handling multiple Yubikeys? I'm doing it personally and it's so annoying that I can't imagine recommending this to anyone else. Since I'd hate to lose access to everything if my house burns down, I keep a key outside of the home. Of course, for that key to be useful, I need to update it whenever I use my key on a new site/service. Dropping everything to go fetch my key is inconvenient, so I keep multiple keys in the house. That way I can add two keys to a service and have a local backup in case one breaks. But, then I need to remember to actually add the off-site key to the account as well. Maybe I should just round-robin the off-site key. It's just tedious to keep track of what's been registered with which key and making sure they're all in sync. I really wish there were a secure way to simply have a key backup. Not to mention, this is kind of expensive and also non-obvious as Yubikey primarily sells single keys. I'd love to see wider adoption, but can't see the general population putting up with this.
    - artdigital 4y ago
      I just have one in my drawer and one in my bag / always connected to my Mac Then a printed backup sheets like 1password somewhere offsite (still needs master password to be usable)
    - microtheo 4y ago
      I use Windows hello and Apple passkey as secondary fido devices, isn’t that a valid method??
      - nirvdrum 4y ago
        Maybe? I really don't know. I dual-boot a Linux & Windows workstation and have a macOS laptop, so I haven't looked too deeply into platform-specific solutions. For now, I stick with Yubikeys. Complicating things further is for some accounts I'd like to give my wife access and she has her own keys and own devices. I've hit the key registration limit on some sites.
mjg59 4y ago
Fi is an MVNO - there's apparently some sort of magical mapping between Fi numbers and network-specific numbers that still end up on the network's infrastructure (there apparently used to be issues with 911 operators seeing the network-specific number rather than the actual Fi number), and the mapping of that network-specific number onto an IMSI is still going to be under the control of that network. It's possible to block front-end agents from being able to do anything with that, but if someone compromises network infrastructure then it seems like it's hard to protect against it?

pifm_guy 4y ago

> could have involved the use of your phone number to send and receive phone calls Surely from their logs they know if these calls/texts happened? If, during that period no calls/sms's occurred, then there has been no breach - the attacker was close to their target, but walked away with nothing. If messages/calls were made, the user really needs to know who they were to/from to make any informed decisions. And Google has those logs.

nr2x 4y ago
Straight to a write only bucket in Maryland.
chrisbolt 4y ago
> Surely from their logs they know if these calls/texts happened? Why would they have logs of calls/texts that weren't routed to them?

astrashe2 4y ago

Has anyone been able to confirm that this actually happened?