Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

361–370 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#361

Post by dx034 »

dublinben wrote: post #280
yladiz wrote: post #265

Can anyone recommend a US based bank (or a bank that accepts US customers) that 1) has either a 2FA token for phone e.g. with Google Authenticator, a hardware token, or some kind of other token based factor; and 2) has strong security when calling? I generally don't need a physical presence. My current two banks don't have direct 2FA enabled. As far as I remember, the questions available to one of my banks (credit un…

There are a handful of smaller banks or credit unions listed as accepting proper 2FA here. [0] I have no experience with any of them. [0] https://twofactorauth.org/#banking

Although the list is a bit misleading. German banks are all listed without 2FA whereas in reality they all use some form of a TAN (transaction number). Not as safe as a hardware token but if you keep it safe, it's as secure as a hardware token.

And most Sparkasse branches will use actual hardware tokens. So the reality is not as bad as the list suggests.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#362

Post by dx034 »

lostmsu wrote: post #97
blhack wrote: post #78

Earlier quoted context omitted.

Is it really necessary or helpful to be rude to the poor CSR who is just trying to do their job? They didn't make this policy, and I'm sure they think its just as stupid as you do.

I would not think CSR would actually know that phone is not a secure channel. I bet they are taught it is.

It is still more secure than not using a second factor at all. Stealing a phone number is more work than not having to do it.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#363

Post by creepydata »

kbart wrote: post #222
weinzierl wrote: post #203

Earlier quoted context omitted.

> When signing up for a new Gmail, you don’t need to enter a phone number This is not true in general. It probably at least depends on the country you try to sign-up from probably other factors.

Gmail didn't mandate phone number the last time I created dummy account (~1 month ago). I don't have phone number linked even with my primary account.

They do sometimes though depending on how "risky" they deem you based on a secret criteria. I've never been able to bypass their phone number requirements.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#364

Post by discreditable »

tokenizerrr wrote: post #323
discreditable wrote: post #315

Earlier quoted context omitted.

Last I checked, adb backup doesn't backup the secrets. Has that changed?

I don't know but I've been using this technique for a year or two now with great success. The Google authenticator just stores its secrets in the salute db every app gets.

Have you tried a restore on a factory-reset device?

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#365

Post by creepydata »

CWuestefeld wrote: post #274

A few weeks ago I was vacationing in Big Bend National Park, which is in a remote corner of Texas. When trying to pay for our breakfast, my credit card was declined. On the phone with them, they said the card had been flagged as being used in fraud because we were off in the middle of nowhere, away from our normal spending patterns. The ONLY way to reactivate the card is for the CC company to SMS text us with a code,…

This is a big reason I carry multiple credit cards and multiple debt cards with multiple banks. I'm paranoid about getting locked out of my funds while travelling. Wouldn't help if my wallet was stolen but there is still redundancy there.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#366

Post by tokenizerrr »

discreditable wrote: post #364
tokenizerrr wrote: post #323

Earlier quoted context omitted.

I don't know but I've been using this technique for a year or two now with great success. The Google authenticator just stores its secrets in the salute db every app gets.

Have you tried a restore on a factory-reset device?

I have not, but I have extracted the backup with https://sourceforge.net/projects/adbextractor/ and inspected the contents, visually confirming the secrets are there. Even if a restore doesn't work, I can re-enter them manually from the information in the sqlite database. However I fully expect a restore to work.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#368

Post by aptwebapps »

creepydata wrote: post #359
aptwebapps wrote: post #150

Earlier quoted context omitted.

I read somewhere that companies that do a lot of ACH payments use different accounts for receiving and sending payments. The receiving account is locked so that it can't send and the sending account is supposed to stay secret. I don't know if that actually works in practice, though.

If you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."

ACH transfers, not paper checks.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#369

Post by creepydata »

aptwebapps wrote: post #368
creepydata wrote: post #359

Earlier quoted context omitted.

If you give someone a paper check you are giving them your account number in plain text. I don't see how they can make that "secret."

ACH transfers, not paper checks.

Yeah but for 90%+ of transactions, if you are being paid by a company, you can almost always request a paper check instead of an ACH transfer (sometimes with a fee). In that case they either have yet another account for check writing (which won't be "secret") or they give away their "secret" ACH account.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#370

Post by [deleted] »

yladiz wrote: post #286
sowbug wrote: post #277

Earlier quoted context omitted.

Not true. They offer insurance only to military families. Banking is open to anyone. EDIT: This is no longer true as of 2013.

Are you sure? At the link listed below, it seems that it's only available for military. https://www.usaa.com/join/start/?productId=bank-checking-cla...

[deleted]
Post reply on HN