3 ms·
I work in crypto and see Sim swaps happen all the time, mostly for Twitter account takeovers of famous people where they then post phishing links and steal thei
by TimJRobinson 2y ago
I work in crypto and see Sim swaps happen all the time, mostly for Twitter account takeovers of famous people where they then post phishing links and steal their followers coins. T-Mobile is easily the biggest offender for this, most people reporting they use it, so this has been going on for a long time.
The other big problem with Twitter security is you can have your account taken over even if you use non-sms 2FA! If you have your phone number on your account it can be used for recovery completely bypassing 2FA. They've had this security flaw for years and still haven't fixed it.
- lxgr 2y agoAlmost everybody supporting 2FA has this security flaw today. The number of sites that actually let me never provide a phone number, or at least not have it be a recovery method, is tiny. Even things like a simple time lock (e.g. SMS-OTP "2"FA recovery only being possible after 24 hours, combined with sending a blast of "careful, your account is about to be recovered by somebody that might not be you" and a way to stop that for the legitimate accountholder, would go a long way.
- sgerenser 2y agoA lot of sites have this security flaw, turning SMS 2FA into 1FA: all you need is the phone number. Although allowing it even if you use non-sms 2FA is even worse, 100% defeating the purposes of using an alternate form of 2FA.
- tekknik 2y agoNot even just SMS, some sites are doing the same with email.