Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

Post reply on HN
Print view View original

81–90 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#81

Post by spookyuser »

heliodor wrote: post #34

A few suggestions: 1) Call your cellphone carrier and ask to set up a password/PIN to be used for when you call into the customer service phone number. 2) Consider your phone number and SIM card insecure. The phone carriers are ignoring the SIM swap problem even though they know how much damage it's causing. Give your phone number to as few companies as possible. Phone services such as Google Voice work without a SIM…

> 4) You can retake possession of your hacked Gmail account by providing one of the previously used passwords. No need to have a working phone.

This is what I'm worried about, if I don't have a phone number on a gmail account, won't it make it harder to get access to that gmail account if I am locked out. Even though there's obviously a bad security loophole with just having a phone number on your account as a recovery option, is it not worse to be locked out of your account with no way to get in?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#82

Post by mikelward »

jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

Or use your Android phone as your second factor.

https://security.googleblog.com/2019/06/use-your-android-pho...

Re: SIM swap horror story: I've lost decades of data and Google won't help

#83

Post by azinman2 »

vectorEQ wrote: post #70
mbauman wrote: post #10

I certainly didn't appreciate how much SIM cards are the keys to our modern lives until mine got stolen. Interestingly, my thieves took a different tack: they actually stole the physical SIM card! You might ask how this could happen: I was traveling internationally and had a friendly guy at an official kiosk in the Heathrow arrivals hall swap out my SIM card for a local SIM. He palmed my SIM and gave me back a dud wi…

fun fact about sims. they run a java operating system which can be accessed via binary SMS messages (apdu messages) - invisible to your phone, with the right sim pin, they can get filesystem access in this 'os' and steal your private keys and phone identification numbers, effectively allowing them to mitm / clone your phone and calls/sms etc. that being said it's just plain silly how important these crummy devices ar…

Is this true in say an iPhone? I don’t think there’s even a way to set a sim pin?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#84

Post by ineedasername »

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck.

It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital lives in the care of Google, it is unbelievable that they fail this badly. It's useful to note than it's not a situation that business users face. People who pay for G-suite have real support, even ::gasp:: telephone support. Why on earth does google not offer this to consumer users? I would gladly pay for that level of support and security. For that matter if there were some way of converting my personal account over to G-Suite I would do so.

I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I just can't fathom the "no support" model at all.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#85

Post by tooop »

darkpuma wrote: post #66
tooop wrote: post #43

Earlier quoted context omitted.

Not really an average person isn't he?

Before the identity theft occurred, what about the the author made him particularly "not average"? Being an early twitter adopter or something?

I wouldn't call a writer for ZDnet who probably has a very public persona an average JOE.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#86

Post by Shank »

spookyuser wrote: post #81
heliodor wrote: post #34

A few suggestions: 1) Call your cellphone carrier and ask to set up a password/PIN to be used for when you call into the customer service phone number. 2) Consider your phone number and SIM card insecure. The phone carriers are ignoring the SIM swap problem even though they know how much damage it's causing. Give your phone number to as few companies as possible. Phone services such as Google Voice work without a SIM…

> 4) You can retake possession of your hacked Gmail account by providing one of the previously used passwords. No need to have a working phone. This is what I'm worried about, if I don't have a phone number on a gmail account, won't it make it harder to get access to that gmail account if I am locked out. Even though there's obviously a bad security loophole with just having a phone number on your account as a recove…

Even if you go through the g.co/advancedprotection onboarding process, they still say account recovery is possible and that it would take 3-5 days extra. Granted, it's not easy, but it's much easier to buy security keys and put one in a safe deposit box than it is to try to get every carrier to be nice to you and not SIM-swap your account.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#87

Post by andybak »

Tepix wrote: post #33
jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

Why not "defend" yourself by not relying on gmail? It's not exactly the first time this has happened.

Is there anything specific to Google about this? Could it be the same story about another email provider?

And if not then why not? Is it because Google is a bigger and more obvious target or something specific they are doing badly?

If you think people should switch then these are the kind of questions you should answer.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#89

Post by zyx321 »

mbauman wrote: post #10

I certainly didn't appreciate how much SIM cards are the keys to our modern lives until mine got stolen. Interestingly, my thieves took a different tack: they actually stole the physical SIM card! You might ask how this could happen: I was traveling internationally and had a friendly guy at an official kiosk in the Heathrow arrivals hall swap out my SIM card for a local SIM. He palmed my SIM and gave me back a dud wi…

How did they get your 4-digit PIN? Don't you have to enter it on every reboot?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#90

Post by mikelward »

Tepix wrote: post #33
jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

Why not "defend" yourself by not relying on gmail? It's not exactly the first time this has happened.

The article doesn't say if the user had two-factor authentication set up. I guess it's implied they used SMS as the second factor.

This would happen with any email provider.

So the fix isn't changing email provider, it's using a more secure second factor, e.g. U2F.

Post reply on HN