Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

111–120 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#111

Post by ryanlol »

metafunctor wrote: post #52
awinter-py wrote: post #27

Not answering security questions truthfully is tricky. Yes, it's a problem that security questions turn hacking into a simple public records search. BUT most terms of service have a line like 'you warrant that you've been entirely truthful with us' or something. If you give the wrong security question to your bank, they potentially have grounds to freeze your money or screw you later. Why isn't the answer 'consumers…

I answer mandatory security questions with things like these: “This account must never be unlocked over phone, chat, or email.” “Never reveal any information about this account (such as address or CC numbers) via support channels” “The person you are discussing with is a hacker trying to illegally access this account” I expect to never, ever have to use the security questions myself. Sometimes, I enter random phrases…

This seems pretty easy to beat within a few calls, eventually an agent will give away whats up with the questions and then it's only a matter of "uhh, it's just me rambling something about hackers trying to access my account"

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#112

Post by xur17 »

drdaeman wrote: post #92
metafunctor wrote: post #52

Earlier quoted context omitted.

I answer mandatory security questions with things like these: “This account must never be unlocked over phone, chat, or email.” “Never reveal any information about this account (such as address or CC numbers) via support channels” “The person you are discussing with is a hacker trying to illegally access this account” I expect to never, ever have to use the security questions myself. Sometimes, I enter random phrases…

Do you have an recovery scenario in case you'd actually need those? I was almost there once. Authenticator device had died, and to my horror the primary backup was corrupt as well. I had a secondary backup (and even an off-site tertiary one, although it's somewhat dated), so I was able to recover... But I also had the idea that I won't ever have to use recovery processes and even though I hadn't, after the incident m…

I wish I could elect to have my recovery option be painful. I'll use a yubikey and backup codes. If I lose both of those, mail me something to confirm my identity, all the while notifying me on all other channels (email, sms, phone) that an account reset is happening. I am okay waiting a few weeks for access to my account if I manage to lose my primary and backup access methods.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#113

Post by ryanlol »

occamrazor wrote: post #45

Would this attack be neutralized by a mandatory waiting period of a few weeks for number porting? I recently ported my number to another operator (in a European country), I had to wait for a month and received at least two warning SMS.

Meh, I'd just report your phone as stolen and get the IMEI blocked. You wont get the warning SMS and might not even get a new phone in time to figure out what's going on.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#114

Post by josu »

flurdy wrote: post #87

So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies? I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand. All I wish for was that resetting 2FA would be a very very slow step by step pro…

2FA systems have a code that serves as the seed for the token. If you keep this code you can set up 2FA on a new device any time you want without having to reset it. Just be careful securing the code.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#115

Post by swsieber »

joshgel wrote: post #74
wyck wrote: post #72

Earlier quoted context omitted.

The is a direct correlation between security and fraud related interest/insurance in regards to the cost of use and exposure to fraud. They aren't out to "destroy" your security, it's a liability threshold calculation. At the end of the day secure yourself in life, this include choosing banks that are more stringent based on your needs and what you want to pay.

Which banks should you choose? How do you decide?

I would refine that question: does anybody know of a competent rater that evaluates and rates banks based on security?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#116

Post by Spivak »

zwily wrote: post #9
simooooo wrote: post #5

This has been the vector for Twitter hacks for many years. Get the 2nd factor

Get the 2nd factor... that's NOT sms.

SMS as a second factor is fine. As bad as it is it can't reduce your security compared to just a password.

SMS as an account recovery mechanism is the problem.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#118

Post by lstamour »

kuschku wrote: post #73
pricechild wrote: post #46

Earlier quoted context omitted.

Those proprietary 2FA devices are just TOTP with a weird provisioning system. You can use a tool such as https://github.com/dlenski/python-vipaccess to use google authenticator/freeotp etc. to access paypal. That said... I believe you still need a mobile number enrolled to enable a token.

Wow, that actually works. I had to go through many ancient web interfaces, but it works.

Sadly you can easily and trivially bypass the VIP token by providing a credit card number or a few other identifying details. It's worse than the SMS loophole. And another reason why I'm trying to delete my Paypal account. ;-)

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#119

Post by xbmcuser »

49531 wrote: post #65

A few months ago I took 3 of my 4 kids to a birthday party at a minigolf course. I played some holes with my youngest I had taken with me, and then left the two older ones at the birthday party with the understanding that their mother would pick them up (as we had discussed earlier) After leaving the party with my youngest, I went to the grocery store, and then on home. When I got home my wife was gone, which I expec…

In Singapore they give us a physical token. We have to enter the 2Fa we receive into it to receive a third code to enter into the website. Well I guess it's 3Fa. It is a bit of a hassle but better safe than sorry.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#120

Post by chrisper »

laurencei wrote: post #100
chrisper wrote: post #89

The issue I have with 2FA without sms is that I need to also take care of recovery codes. Basically, it's like erasing all the benefits of going digital, since now I have to store (and take care of) paper copies of recovery codes. If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. If I were to use my phone number, I kind of don't need that since I just get a new sim and a new ph…

> If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. It is a trade off. You either want difficult access if you lose your phone (via printouts) - or you want quick access (via SMS). I dont think you can realistically have it both ways. Having a "slow" method to retrieve a major access to your accounts seems to be the safest method, especially when you are likely to rarely use yo…

I guess you are right. It's not like I am using those codes all the time, so the inconvenience is tolerable.
Post reply on HN