Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Listen to a SIM-Jacking, Account-Stealing Ransom

motherboard.vice.com

Post reply on HN
Print view View original

81–90 of 95 posts

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#81

Post by toast0 »

cj wrote: post #47
ironcan wrote: post #5

Earlier quoted context omitted.

And since there is no google customer service, nobody can social engineer it out of you!

Google Voice is on track to be a core service in Gsuite, which has pretty impressive phone support in my experience.

I interacted with Google support (when it was called Google apps) for two things, the first one was I wanted to disable links in Gmail -- the support people couldn't understand what I wanted for about 30 minutes, then couldn't understand why I wanted it, then said it couldn't be done.

I don't remember what the second one was, but it ended with the support person agreeing it was a problem, but suggesting I post to product forum.

If that's amazing support, I'd rather rely on the normal channels: writing an angry blog post and posting it to HN, or suckering your smart friends into interviewing at Google and bribing them to fix your problems once they get there.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#82

Post by VectorLock »

kaoD wrote: post #16
shittyadmin wrote: post #10

Earlier quoted context omitted.

There's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update. Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.

If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive: https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a... https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://github.com/google/google-authenticator/wiki/Key-Uri-...

It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#83

Post by davchana »

narrator wrote: post #71
phire wrote: post #63

Earlier quoted context omitted.

I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number. They said the best they could do was to add a note to my file to check id in store before transferring . This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it. And more importantly, it does noting to stop som…

Running it through google voice will make it subject to your google 2fa.

Could you please elaborate about google thing you mentioned? I am interested in making my ATT sim morr secure..

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#84

Post by im3w1l »

phire wrote: post #63
themagician wrote: post #25

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, b…

I talked to my cell phone provider and asked them if there was anything they could do to prevent transfering of my number. They said the best they could do was to add a note to my file to check id in store before transferring . This is better than nothing, but relies on the CS representative actually seeing the note on my file. Even then, there might be ways around it. And more importantly, it does noting to stop som…

> Apparently Inter-provider ports are all automated and there is nothing anyone could do to stop it.

"Phone number" is truly the most dysfunctional social network.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#85

Post by eksemplar »

themagician wrote: post #25

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, b…

In my country you can’t transfer your sim or number without signing the transaction with our national two-factor digital identity that is provided by the government.

You also need to supply your secret social security number in a safe validation form.

So to me it’s much safer than a token auth that I’ll accidentally wipe whenever I buy a new phone. At least Authy allows SMS restore.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#86

Post by davchana »

gammateam wrote: post #66
deanmoriarty wrote: post #35

Earlier quoted context omitted.

Is it worth it though? Now you can't fully rely on your phone number for 2FA, T-mobile is one of the providers notoriously known for transferring numbers without asking too many information. My daily number, not connected to any 2FA (for which I use Google Voice) is a T-mobile, and a couple years ago I bought a nano sim to replace a larger sim, and the call center operator transferred the number without me having to…

totally worth it, that number can be used to create a new google voice number. Offering SMS based one time codes - with no OTP protocol alternative - should be considered negligence of the legally sanctionable kind. and finally who cares about your social graph on Google? Thats not the issue at alllll

Do you mean a brand new google voice number can/should be used for all 2fa smses?

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#87

Post by zimbatm »

davchana wrote: post #83
narrator wrote: post #71

Earlier quoted context omitted.

Running it through google voice will make it subject to your google 2fa.

Could you please elaborate about google thing you mentioned? I am interested in making my ATT sim morr secure..

It replaces the SMS 2FA with a Google prompt app on the phone for Gmail verification.

So it doesn't make the SIM more secure but the SIM get hacked it doesn't allow the attacker to gain access to Gmail.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#88

Post by plantain »

Rjevski wrote: post #51
plantain wrote: post #43

Earlier quoted context omitted.

Except their text messages only appear to be processed every half hour or so... which makes it useless for 2FA most of the time (the only reason I went with them).

Strange - I get their texts immediately. Which numbers are you using? 07 ones or 020?

07. Forwarded to email.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#89

Post by wikibob »

notyourday wrote: post #33
themagician wrote: post #25

This is something that really worries me. I use token based 2FA when I can but the reality is that I have like 50 accounts with 2FA and I forget which ones have SMS as a backup. I'm sure there's an account in there somewhere that's at risk. I have AT&T and use the extra security PIN code, but I know it's not 100% guaranteed. The other day I got a robocall asking for my PIN and last for of my social. I didn't do it, b…

The lack of security of cell phone providers is absolutely infuriating considering the sheer number of people who are paid $20/h that have ability to see and manipulate records at the likes of AT&T, Sprint, TMO and VZ not to mention those who work for resellers like BestBuy that are authorized to make activation and porting related changes. It reminds me of MJR confidently stating that the maximum cost of gaining acc…

Ah just FYI the pay is around $10-$11 an hour.

Re: Listen to a SIM-Jacking, Account-Stealing Ransom

#90

Post by somabc »

VectorLock wrote: post #82
kaoD wrote: post #16

Earlier quoted context omitted.

If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive: https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a... https://en.wikipedia.org/wiki/Time-based_One-time_Password_a... https://github.com/google/google-authenticator/wiki/Key-Uri-...

It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.

Authy is a very good substitute with backups.
Post reply on HN