5 ms·

Probably SMS as a 2FA option on Gmail, which is the real problem. Once you add your Yubikey and set up TOTP as a backup, you need to go back and delete SMS as a

Probably SMS as a 2FA option on Gmail, which is the real problem. Once you add your Yubikey and set up TOTP as a backup, you need to go back and delete SMS as a 2FA option. Had gmail been configured correctly, the SIM swap would have far less serious.

newsclues 4y ago
SMS 2FA is a security risk! I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.
- neaumusic 4y ago
  How is SMS a security risk? As far as I know, SMS is closely tied to a person's identity, especially 'know your customer' regulations. I'm curious how it's a security risk; as far as I know they have to be unique, which is good
  - crazygringo 4y ago
    Simjacking. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
    - TeMPOraL 4y ago
      Wait. Isn't it painfully obvious when you've been simjacked? If your phone suddenly loses signal and refuses to register with the network, you know something is up. You may think it was a malfunction of your phone or your network, but it's pretty much a definition of a modern-day "drop everything you're doing and deal with it" emergency. You can't not be aware of it, or be unsure if it happened to you.
      - aaronmdjones 4y ago
        By the time you notice and can react it's too late. There have also been many prominent examples of people who got their cryptocurrency exchange accounts broken into with SIM hijacking which was conducted while the victim was asleep.
      - Nextgrid 4y ago
        The phone may not lose signal immediately (or at all) - this is implementation dependent, so it's not a reliable indicator.
      - zamnos 4y ago
        So maybe the attackers just wait for the right moment to strike. Like say Feb 13th. https://www.reuters.com/business/media-telecom/t-mobile-down-thousands-users-us-downdetector-2023-02-14/ https://www.reuters.com/business/media-telecom/t-mobile-down... But if the attacker already has your info, then couldn't they just add another line to your mobile plan, so your handset continues working, just with a new, unbeknownst to you phone number? That way it wouldn't be noticable on the handset. The real question is how long do you think it would take you to break into your own Gmail account after the passwords been changed and the attached phone numbers also been changed? Probably longer than it would take an attacker to drain bank accounts, I figure.
      - CrazyMusicians 4y ago
        You very much can not be aware of it. Consider what happens when you're simswapped at 2 am. Are you going to notice that? Probably not. And maybe not after you get up and check your phone. Because your phone may be connected to the internet via your home wifi and you don't even notice your phone has no bars and no service because you're still able to browse the web and check email.
  - tiagod 4y ago
    Check out this article: https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/ https://krebsonsecurity.com/2023/02/hackers-claim-they-breac...
  - aaronmdjones 4y ago
    Anyone can walk into a T-Mobile store with a fake driving license with your name on it and claim they need help moving their phone number to their new phone. This is of course your number. They will then receive all of your SMS messages. Or, you know, they can just bribe the store employees. Has happened before, still happens, will keep happening as long as a phone number is considered important for anything at all.
  - NavinF 4y ago
    Do you live in the US? You don't need an ID to get a phone number here so SMS is not necessarily tied to your identity and it has nothing to do with KYC. Moreover, you don't want it to be tied to your identity. The fact that anyone can pretend to be you and hijack your phone number is exactly what makes it insecure.
delfinom 4y ago
No the other problem is Google allows adding recovery phone numbers that bypass 2FA :D https://support.google.com/accounts/answer/183723?hl=en https://support.google.com/accounts/answer/183723?hl=en
fauigerzigerk 4y ago
I can use my phone number for 2FA and/or as a recovery phone number. Would you advise to remove it from both places or just from 2FA?
- doodlesdev 4y ago
  Remove it from both. However make sure that you have quite a lot of backups of your 2FA backup keys, and maybe even one offline backup of your seed, if you lose them, the account is gone (which is a good thing, I guess).
  - fauigerzigerk 4y ago
    Thanks. I have Google backup codes as well as multiple Authy installations, Google prompt and a recovery email address so I guess I should be covered :)
    - bogomipz 4y ago
      What is "Google prompt" here?
      - fauigerzigerk 4y ago
        It’s a notification pop-up the Google mobile app can send, asking for login confirmation.
        bogomipz 4y ago
        I see, but doesn't have the same issue as sending an SMS to the phone if the phone has been stolen in that the thief can just say "yes" to the prompt?
        fauigerzigerk 4y ago
        No, it's not quite the same issue. SIM swap works remotely without anyone getting a hold of my phone. A stolen phone can of course be a problem as well, but at least it's somewhat under my control and I may notice pretty quickly when it's gone.

newsclues 4y ago

SMS 2FA is a security risk! I used to work tech support for cell phone providers, and while we were trained about fraud, the nature of the industry low wages, high turnover, makes this a security flaw that financial institutions should not risk.

neaumusic 4y ago
How is SMS a security risk? As far as I know, SMS is closely tied to a person's identity, especially 'know your customer' regulations. I'm curious how it's a security risk; as far as I know they have to be unique, which is good
- crazygringo 4y ago
  Simjacking. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
  - TeMPOraL 4y ago
    Wait. Isn't it painfully obvious when you've been simjacked? If your phone suddenly loses signal and refuses to register with the network, you know something is up. You may think it was a malfunction of your phone or your network, but it's pretty much a definition of a modern-day "drop everything you're doing and deal with it" emergency. You can't not be aware of it, or be unsure if it happened to you.
    - aaronmdjones 4y ago
      By the time you notice and can react it's too late. There have also been many prominent examples of people who got their cryptocurrency exchange accounts broken into with SIM hijacking which was conducted while the victim was asleep.
    - Nextgrid 4y ago
      The phone may not lose signal immediately (or at all) - this is implementation dependent, so it's not a reliable indicator.
    - zamnos 4y ago
      So maybe the attackers just wait for the right moment to strike. Like say Feb 13th. https://www.reuters.com/business/media-telecom/t-mobile-down-thousands-users-us-downdetector-2023-02-14/ https://www.reuters.com/business/media-telecom/t-mobile-down... But if the attacker already has your info, then couldn't they just add another line to your mobile plan, so your handset continues working, just with a new, unbeknownst to you phone number? That way it wouldn't be noticable on the handset. The real question is how long do you think it would take you to break into your own Gmail account after the passwords been changed and the attached phone numbers also been changed? Probably longer than it would take an attacker to drain bank accounts, I figure.
    - CrazyMusicians 4y ago
      You very much can not be aware of it. Consider what happens when you're simswapped at 2 am. Are you going to notice that? Probably not. And maybe not after you get up and check your phone. Because your phone may be connected to the internet via your home wifi and you don't even notice your phone has no bars and no service because you're still able to browse the web and check email.
- tiagod 4y ago
  Check out this article: https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/ https://krebsonsecurity.com/2023/02/hackers-claim-they-breac...
- aaronmdjones 4y ago
  Anyone can walk into a T-Mobile store with a fake driving license with your name on it and claim they need help moving their phone number to their new phone. This is of course your number. They will then receive all of your SMS messages. Or, you know, they can just bribe the store employees. Has happened before, still happens, will keep happening as long as a phone number is considered important for anything at all.
- NavinF 4y ago
  Do you live in the US? You don't need an ID to get a phone number here so SMS is not necessarily tied to your identity and it has nothing to do with KYC. Moreover, you don't want it to be tied to your identity. The fact that anyone can pretend to be you and hijack your phone number is exactly what makes it insecure.

delfinom 4y ago

No the other problem is Google allows adding recovery phone numbers that bypass 2FA :D https://support.google.com/accounts/answer/183723?hl=en https://support.google.com/accounts/answer/183723?hl=en

fauigerzigerk 4y ago

I can use my phone number for 2FA and/or as a recovery phone number. Would you advise to remove it from both places or just from 2FA?

doodlesdev 4y ago
Remove it from both. However make sure that you have quite a lot of backups of your 2FA backup keys, and maybe even one offline backup of your seed, if you lose them, the account is gone (which is a good thing, I guess).
- fauigerzigerk 4y ago
  Thanks. I have Google backup codes as well as multiple Authy installations, Google prompt and a recovery email address so I guess I should be covered :)
  - bogomipz 4y ago
    What is "Google prompt" here?
    - fauigerzigerk 4y ago
      It’s a notification pop-up the Google mobile app can send, asking for login confirmation.
      - bogomipz 4y ago
        I see, but doesn't have the same issue as sending an SMS to the phone if the phone has been stolen in that the thief can just say "yes" to the prompt?
        fauigerzigerk 4y ago
        No, it's not quite the same issue. SIM swap works remotely without anyone getting a hold of my phone. A stolen phone can of course be a problem as well, but at least it's somewhat under my control and I may notice pretty quickly when it's gone.