Is there some mobile provider that has a way higher standard of security? Something like "Cloudflare for SIM"
SIM swap horror story: I've lost decades of data and Google won't help
11–20 of 303 posts
Re: SIM swap horror story: I've lost decades of data and Google won't help
#12Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup keys too.
https://landing.google.com/advancedprotection/
(The usual disclosure: I work for Google, but not on anything related to this, only speaking as a user.)
Re: SIM swap horror story: I've lost decades of data and Google won't help
#13I believe Google has some kind of service you can turn on where you will pair it with a U2F token like a Yubikey or their Titan key. At that point, all other forms of login and password recovery are turned off. In theory, that should stop the SIM-swap attack. See: https://support.google.com/accounts/answer/7539956?hl=en
I use Authenticator, which should also stop a SIM-swap. However, I've noticed that many services seem to require activating 2FA via text message in order to activate authenticator. Has anyone else noticed that?
Quite a few do require you to have at least two second-factor methods set up, although I think for me only one has ever insisted on setting up phone / text 2FA. If you don't have a spare phone for TOTP or a Yubikey for U2F, phone-based might be all you can use (considering a surprisingly small number of 2FA supporting sites seem to implement recovery codes).
Re: SIM swap horror story: I've lost decades of data and Google won't help
#14Re: SIM swap horror story: I've lost decades of data and Google won't help
#15I believe Google has some kind of service you can turn on where you will pair it with a U2F token like a Yubikey or their Titan key. At that point, all other forms of login and password recovery are turned off. In theory, that should stop the SIM-swap attack. See: https://support.google.com/accounts/answer/7539956?hl=en
Unfortunately, Yubikey at least basically only works in Google Chrome, so if you actually want to use your account you have to use methods other than the Yubikey.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#16This is a good place to remind everyone of Google Takeout [1]. Back up all of your data. Don't let this horror story happen to you. [1] https://takeout.google.com/settings/takeout
Thanks for reminding me... again... about this. Why haven't I backed up my gmail data yet? It has been years since I realized I have to do it. Why haven't I done it?
Because it's not easy to automate.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#17Silicon Valley has a systemic customer service problem. The price you pay for "Free" services.
I think the common wisdom dictates that since we aren't paying, we aren't the actual customers. I'll bet advertisers have great customer service.
That's less common wisdom and more of a catchy but dumb meme. There are all sorts of things you can buy that have crappy-to-nonexistent customer service.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#18Silicon Valley has a systemic customer service problem. The price you pay for "Free" services.
The hack was the fault of T-Mobile though. He pays for that.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#19I believe Google has some kind of service you can turn on where you will pair it with a U2F token like a Yubikey or their Titan key. At that point, all other forms of login and password recovery are turned off. In theory, that should stop the SIM-swap attack. See: https://support.google.com/accounts/answer/7539956?hl=en
I use Authenticator, which should also stop a SIM-swap. However, I've noticed that many services seem to require activating 2FA via text message in order to activate authenticator. Has anyone else noticed that?
The point is that, while there are dangers, TXT 2FA is leagues better than not having anything at all.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#20> I had backed up a ton of personal information on Google Drive. This included tax returns, account passwords for my wife in case I died, personal documents and spreadsheets, and just about everything I had paper copies of at home.
I guess the author learned that lesson, but… please don't. Backups in the cloud are fine, but such sensitive information has to be encrypted. Ideally with a 6 words diceware password or so.
And if it is meant for your close ones to recover if you die, write that password down, and lock it up in a couple homes you trust.