3 ms·
They were able to reset your Google password using only the simjacked phone? Or was the password the same as the T-mobile one as well? It’s hardly a second fac
by koolba 4y ago
They were able to reset your Google password using only the simjacked phone? Or was the password the same as the T-mobile one as well?
It’s hardly a second factor if it can be used to entirely replace the primary one.
- delfinom 4y agoGoogle still allows you to setup recovery phone numbers unforunately. https://support.google.com/accounts/answer/183723?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/183723?hl=en&co=G... I think years ago I found my number there with no-recollection of every agreeing to it and quickly yeeted it. (You can remove the number but keep recovery email)
- gleenn 4y agoIt's subtle with the UI but you can choose not to allow SMS by removing your phone number from Google after setting up alternative 2FA. If they don't have a number they can't sim-jack
- mike_d 4y agoThis is one of the most important pieces of security advice that is often overlooked: remove your phone number from EVERYTHING. You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere. 1. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- lima 4y agoBig benefit of Advanced Protection: you can go tell less technical users to set it up and it will enforce all these best practices (no SMS, two keys, no giving random apps access to GMail...).