4 ms·

And this is where paranoids have the upper hand. Have a secondary secret phone number from another carrier exclusively for sms confirmations, using a dumb phone

And this is where paranoids have the upper hand. Have a secondary secret phone number from another carrier exclusively for sms confirmations, using a dumb phone, which must be turned off when not expecting an automated code. Preferably a prepaid sim bought anonymously. Extra points if bought in another country and has coverage in your area.

Johnny555 3y ago
Does that help against an attacker determined enough to hack you that he'll pay $1000 for a SIM swap? Surely he has channels to figure out your "secret" phone number since you registered it with the service he's trying to hack into.
- catlikesshrimp 3y ago
  It is more difficult to sim swap a foreign number from another company. Not impossible, of course. There is also that some services don't accept foreign numbers for authentication. Nor virtual phone numbers. But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.
  - Johnny555 3y ago
    But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier. Is that really an additional layer of protection, or the same layer, slightly obscured? But probably not obscured from the attacker that managed to get your password and just needs the SMS verification code to get into your account.
- bonton89 3y ago
  You can probably figure out most people's default phone number by googling their name and going to one of those crappy white pages sites. Then try to login/do a password reset to their services and compare the masked phone number to the ones on the site. No advanced hacking or special channels required. The trouble with compartmentalizing with a separate phone is that the company with your money probably also sold your secret phone number (that they only required for security) so it will probably also show up on that whitepages site.
wcoenen 3y ago
> secret phone number You have to give this phone number to a bunch of services that you use, i.e. all the ones that do sms confirmations. One data breach, and it isn't "secret" anymore.

Johnny555 3y ago

Does that help against an attacker determined enough to hack you that he'll pay $1000 for a SIM swap? Surely he has channels to figure out your "secret" phone number since you registered it with the service he's trying to hack into.

catlikesshrimp 3y ago
It is more difficult to sim swap a foreign number from another company. Not impossible, of course. There is also that some services don't accept foreign numbers for authentication. Nor virtual phone numbers. But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.
- Johnny555 3y ago
  But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier. Is that really an additional layer of protection, or the same layer, slightly obscured? But probably not obscured from the attacker that managed to get your password and just needs the SMS verification code to get into your account.
bonton89 3y ago
You can probably figure out most people's default phone number by googling their name and going to one of those crappy white pages sites. Then try to login/do a password reset to their services and compare the masked phone number to the ones on the site. No advanced hacking or special channels required. The trouble with compartmentalizing with a separate phone is that the company with your money probably also sold your secret phone number (that they only required for security) so it will probably also show up on that whitepages site.

wcoenen 3y ago

> secret phone number You have to give this phone number to a bunch of services that you use, i.e. all the ones that do sms confirmations. One data breach, and it isn't "secret" anymore.