4 ms·
2FA on everything. No password reused. Only similarity is both had the T-Mobile number attached to them. I initially thought only Amazon was compromised. I tho
by ctvo 4y ago
2FA on everything. No password reused. Only similarity is both had the T-Mobile number attached to them.
I initially thought only Amazon was compromised. I thought it was due to us throwing away a FireTV device (assumption: we didn't log out and de-register) that was then used to order items.
And then I found they added filters to my Gmail account to hide the Amazon orders, and went into full panic mode.
- bogomipz 4y agoInteresting. Was your 2FA setup to use Google Authenticator or regular SMS? It's been a while since I used Google services but from what I recall from a previous company where we used Gmail was that the only way to do 2FA with Google Authenticator if you lost access to the phone was with a backup code you are given at 2FA setup time. Is that no longer the case?
- ctvo 4y ago2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out? Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.
- danso 4y agoJust noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it. Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...
- askiiart 4y agoSMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.
- konha 4y agoYour OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds. I’ll agree though that Authy’s docs are really ambiguous about account recovery.
- stef25 4y agoSo both were compromised through TMobile sim swap, which was the backup for not having access to your 2FA? I wonder then what the point is of having 2FA at all if you can just click a few buttons to bypass them with an SMS. Were you specifically targeted in any way that would make the attackers go find your phone number and perform the swap?
- clintavo 4y agoWouldn’t this still mean they cracked your gmail password? Or am I not understanding how this was executed?