7 ms·

Is there anything you can do to prevent this? Does Verizon have an option to lock your account against SIM swapping attempts without heightened security procedu

Is there anything you can do to prevent this? Does Verizon have an option to lock your account against SIM swapping attempts without heightened security procedures (OTP, etc?)

alsodumb 4y ago
I think switching to Google Fi seems to be the best option we have right now with respect to any sim swap attacks. Fi doesn’t have physical stores and it’s associated with my Google account which I can secure using non SMS based 2FA options. Unfortunately Fi is also a liability in the sense that Google can kill my account any time.
- jstarfish 4y ago
  Maybe you know something I don't, but switching to an entirely-virtual provider in response to a difficult-to-execute physical threat seems a bit misguided to me. Google also has notoriously nonexistent customer service. It does not instill confidence that anyone should rely on them for something as critical as identity management. The threat of them fucking you over when you need their help far outweighs the threat of hackers and scammers. (Virtual money was supposed to be more secure than physical coin. That experiment didn't work so well either.)
  - alsodumb 4y ago
    It doesn’t seem that difficult-to-execute if the attack is targeted. Google Fi is known to have pretty good customer service, unlike rest of the free Google products. Again, considering everything, I came to the conclusion that Fi is the best option for me right now. YMMV. Google Fi’s implementation of verification also seems more robust and secure: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
  - roundandround 4y ago
    I think no tech support is the only real defense against SIM swap.. Then you need other redundancies that are equally impervious to social attack to be able to withstand a lock out from one of them. Actual security is a real pain, pretending you have it while having a tech support that can bypass it isn't nearly as painful and gives the same sense of security until it is tested.
    - jstarfish 4y ago
      Ok, that's pretty funny. Neglect-as-a-service!
  - jbverschoor 4y ago
    No customer service is the removal of that specific attack vector
throw101010 4y ago
I gave up trying to solve this at the mobile operator level, they don't care, they don't get fined/sued enough and legislators are too incompetent/slow to fix this. I just never use any service that forces 2FA by SMS. If it not avoidable for some reason, I make this account completely isolated from the rest of my online identity (new email just for it, regularly change password). If your bank/financial institution forces 2FA by SMS, it is time to change, most of the serious ones have their own app that handles 2FA. I'm yet to find one that allows to use your own OTP generators, so I'm usually forced to use their app for now.
- toomuchtodo 4y ago
  This is the happy path imho. Mobile providers cannot be trusted to be reliable identity providers.
  - deleted 4y ago
    [deleted]
- mox1 4y ago
  The attack in the article had zero mention of SMS 2FA. They swapped the sim to get access to credit card fraud alerts, delivered via SMS.
  - JohnFen 4y ago
    My CC company sends fraud alerts via email as well as SMS. They all should.
  - throw101010 4y ago
    If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud. I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.
1101010010 4y ago
Use prepaid and don't associate your real name with your cellular account, which has a multitude of privacy benefits as well. Verizon will let you set a six-digit PIN which you can use instead. Also, stop using SMS-based MFA.
- sli 4y ago
  I would love to stop using SMS-based 2FA, but nobody really has any agency in that decision if a service they rely on doesn't care to switch away.

Is there anything you can do to prevent this? Does Verizon have an option to lock your account against SIM swapping attempts without heightened security procedures (OTP, etc?)

alsodumb 4y ago

I think switching to Google Fi seems to be the best option we have right now with respect to any sim swap attacks. Fi doesn’t have physical stores and it’s associated with my Google account which I can secure using non SMS based 2FA options. Unfortunately Fi is also a liability in the sense that Google can kill my account any time.

jstarfish 4y ago
Maybe you know something I don't, but switching to an entirely-virtual provider in response to a difficult-to-execute physical threat seems a bit misguided to me. Google also has notoriously nonexistent customer service. It does not instill confidence that anyone should rely on them for something as critical as identity management. The threat of them fucking you over when you need their help far outweighs the threat of hackers and scammers. (Virtual money was supposed to be more secure than physical coin. That experiment didn't work so well either.)
- alsodumb 4y ago
  It doesn’t seem that difficult-to-execute if the attack is targeted. Google Fi is known to have pretty good customer service, unlike rest of the free Google products. Again, considering everything, I came to the conclusion that Fi is the best option for me right now. YMMV. Google Fi’s implementation of verification also seems more robust and secure: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
- roundandround 4y ago
  I think no tech support is the only real defense against SIM swap.. Then you need other redundancies that are equally impervious to social attack to be able to withstand a lock out from one of them. Actual security is a real pain, pretending you have it while having a tech support that can bypass it isn't nearly as painful and gives the same sense of security until it is tested.
  - jstarfish 4y ago
    Ok, that's pretty funny. Neglect-as-a-service!
- jbverschoor 4y ago
  No customer service is the removal of that specific attack vector

throw101010 4y ago

I gave up trying to solve this at the mobile operator level, they don't care, they don't get fined/sued enough and legislators are too incompetent/slow to fix this. I just never use any service that forces 2FA by SMS. If it not avoidable for some reason, I make this account completely isolated from the rest of my online identity (new email just for it, regularly change password). If your bank/financial institution forces 2FA by SMS, it is time to change, most of the serious ones have their own app that handles 2FA. I'm yet to find one that allows to use your own OTP generators, so I'm usually forced to use their app for now.

toomuchtodo 4y ago
This is the happy path imho. Mobile providers cannot be trusted to be reliable identity providers.
- deleted 4y ago
  [deleted]
mox1 4y ago
The attack in the article had zero mention of SMS 2FA. They swapped the sim to get access to credit card fraud alerts, delivered via SMS.
- JohnFen 4y ago
  My CC company sends fraud alerts via email as well as SMS. They all should.
- throw101010 4y ago
  If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud. I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.

1101010010 4y ago

Use prepaid and don't associate your real name with your cellular account, which has a multitude of privacy benefits as well. Verizon will let you set a six-digit PIN which you can use instead. Also, stop using SMS-based MFA.

sli 4y ago
I would love to stop using SMS-based 2FA, but nobody really has any agency in that decision if a service they rely on doesn't care to switch away.