Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

41–50 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#41

Post by glandium »

fabian2k wrote: post #22

What settings exactly do I have to change to get GMail to never unlock my account by SMS alone? I have enabled proper 2FA on my Google account with U2F, but I haven't disabled everything else yet because I only have one token, and I still need something like TOTP for stuff that uses Google accounts, but doesn't support U2F. As a closely related remark, I wish U2F would just get popular enough, it's pretty convenient,…

Something that is infuriating is that when you have 2FA enabled on Google, they insist that you add a backup phone number that a bot calls to give you a verification code, in case, you know, you lost your second factor. Which is nice and all, but now, you're back to having a second factor that is about as vulnerable as SMS.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#42

Post by willow9886 »

This recently happened to a friend of mine. It was devastating. As mentioned, U2F is very scarcely supported today.

The best way he came up with to secure services that insist on using SMS for 2FA (or credential reset) was to register the number of a pre-paid phone for those services.

Inconvenient? YES. But a pre-paid phone number can not be ported by a negligent (or willfully criminal!) operator.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#43

Post by djsumdog »

awinter-py wrote: post #27

Not answering security questions truthfully is tricky. Yes, it's a problem that security questions turn hacking into a simple public records search. BUT most terms of service have a line like 'you warrant that you've been entirely truthful with us' or something. If you give the wrong security question to your bank, they potentially have grounds to freeze your money or screw you later. Why isn't the answer 'consumers…

I never use real answers. I've had a bank teller ask "your mother had a number I get maiden name?"

"Wait, you actually use real answers instead of passwords for security questions?"

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#44

Post by SAI_Peregrinus »

user5994461 wrote: post #36
SAI_Peregrinus wrote: post #12

Earlier quoted context omitted.

Only for 2-factor schemes that rely on your phone number. Those are horribly insecure, there's a reason NIST and pretty much all security experts recommend against using them. SMS authentication was created as a cheap hack to get around needing SecurID tokens, and should have been abandoned when ToTP (Google Authenticator and the like) became possible.

SecurID tokens do ToTP just fine.

True, I mean the OATH standard / RFC 6238 style ToTP, which runs on generic hardware (a smartphone or PC).

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#46

Post by pricechild »

kuschku wrote: post #26
jacquesm wrote: post #11

Earlier quoted context omitted.

It doesn't stop incompetent dataroom operators either from forcing their users to give them their phone numbers for 2fa purposes. And there is absolute gold in those datarooms if you know where to look. Recent offender: "iDeals proposes to protect your account with 2 factor authentication. It means that each time when you will be accessing the project/ changing your password/ accessing the protected versions of docum…

There’s a far worse example: PayPal only supports SMS based 2FA, or, if you dig through their old website with archive.org, you can find a way to use one of their proprietary 2FA devices. Support for TOTP? HOTP? Nope.

Those proprietary 2FA devices are just TOTP with a weird provisioning system.

You can use a tool such as https://github.com/dlenski/python-vipaccess to use google authenticator/freeotp etc. to access paypal.

That said... I believe you still need a mobile number enrolled to enable a token.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#47

Post by justinclift »

Klathmon wrote: post #20
godzillabrennus wrote: post #13

I owned a hosted PBX company from 2007-2011 and was amazed with how antiquated the port request system truly is. The problem is that the phone company owns your phone number and you just get access as part of a service. Unlike a domain name where you own it. If we change the law we'd bring more accountability.

To be fair, you really don't own a domain. You still rely on the TLD honoring your purchase and not hand it over to someone else in the same way you rely on the phone company to treat your number as yours.

Some domain registrars are so completely incompetent (ie Dotster), I'm disappointed they're still in business. Literally clueless "customer support" staff that either don't auth (experienced that personally), or refuse to follow the written rules to everyone's detriment.

Recent example:

https://issues.apache.org/jira/browse/INFRA-13657

Note - Don't use Dotster (specifically) for your domains. If you're using them now, switch away. Saying that because if you experience any trouble with your domains, you'll be wanting to contact competent staff who can fix problems. Dotster's can't. :(

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#48

Post by pricechild »

seanp2k2 wrote: post #39
kuschku wrote: post #26

Earlier quoted context omitted.

There’s a far worse example: PayPal only supports SMS based 2FA, or, if you dig through their old website with archive.org, you can find a way to use one of their proprietary 2FA devices. Support for TOTP? HOTP? Nope.

Paypal also couldn't walk you through a 2FA payment for eBay on mobile. At all. You had to use a desktop. This was about a year or two ago. One would think that a payment company would have better security, especially given they're owned by eBay.

I've sometimes been instructed to login with 2fa code+password joined in the single field. It's rarely worked.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#49

Post by matt_wulfeck »

godzillabrennus wrote: post #13

I owned a hosted PBX company from 2007-2011 and was amazed with how antiquated the port request system truly is. The problem is that the phone company owns your phone number and you just get access as part of a service. Unlike a domain name where you own it. If we change the law we'd bring more accountability.

In this case it's better for us all to move away from centralized numbers, not simply regulate them better.

There are many, better and more secure options for communicating these days.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#50

Post by FT_intern »

willow9886 wrote: post #42

This recently happened to a friend of mine. It was devastating. As mentioned, U2F is very scarcely supported today. The best way he came up with to secure services that insist on using SMS for 2FA (or credential reset) was to register the number of a pre-paid phone for those services. Inconvenient? YES. But a pre-paid phone number can not be ported by a negligent (or willfully criminal!) operator.

It's still very trivial to tell a customer rep that you lost your SIM card and have the rep send all new communication to the phone number to a separate SIM card with a pre paid phone.
Post reply on HN