Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

Post reply on HN
Print view View original

141–150 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#141

Post by creato »

roywiggins wrote: post #127
andybak wrote: post #87

Earlier quoted context omitted.

Is there anything specific to Google about this? Could it be the same story about another email provider? And if not then why not? Is it because Google is a bigger and more obvious target or something specific they are doing badly? If you think people should switch then these are the kind of questions you should answer.

A smaller, paid provider may make it easier to get someone on the phone to resolve problems when things go wrong. Having better support than Google would not take much.

"Getting someone on the phone" is a big reason these kinds of problems happen in the first place. The reason Google doesn't do that is because they would be too big of a social engineering target, and couldn't possibly be secure in the face of that at a reasonable cost.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#142

Post by roywiggins »

creato wrote: post #141
roywiggins wrote: post #127

Earlier quoted context omitted.

A smaller, paid provider may make it easier to get someone on the phone to resolve problems when things go wrong. Having better support than Google would not take much.

"Getting someone on the phone" is a big reason these kinds of problems happen in the first place. The reason Google doesn't do that is because they would be too big of a social engineering target, and couldn't possibly be secure in the face of that at a reasonable cost.

Fair enough. Is there any email provider that has similar procedures to NFSN?

https://faq.nearlyfreespeech.net/q/LostEverything

Re: SIM swap horror story: I've lost decades of data and Google won't help

#143

Post by tzs »

> While I had a PIN associated with my SIM, I still do not know how the thief was able to get past this the first time, I changed this PIN on the call.

If he's really talking about the SIM PIN, I don't think having one helps against this kind of attack. The SIM PIN is to prevent people in possession of your physical SIM from using your cellular account for voice or data.

What you need with T-Mobile is a separate PIN that is required for porting out your number [1]. You set this PIN up by calling support.

[1] https://www.t-mobile.com/customers/secure

Re: SIM swap horror story: I've lost decades of data and Google won't help

#144

Post by bArray »

Why is it that the most dramatic stories of people's digital lives being lost/broken usually seem to revolve around a compromised mobile phone number? Mobile phone numbers are not unique (they are recycled) and are terrible security (mobile phone companies are careless). I change mobile numbers at least once a year and most years I end up receiving calls/messages on behalf of the previous owner. I refuse to connect my mobile phone to these services.

It seems like one of the most important lessons of computer security has already been forgotten: It's only as good as the weakest link. Not only this but decentralization/redundancy is often better than centralization/dependency. For example, I'm not sitting awake at night worrying over some semi-pseudo password I generated for an old unencrypted forum run on some random persons server.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#145

Post by iwasakabukiman »

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this.

I can just see the people raging about this on social media now.

“Google charged me $50 to fix an issue with my account!”

“Google won’t give me any help unless I pay them! Extortion artists!”

Etc.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#147

Post by daphneokeefe »

jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

What is your contingency plan for when that physical key is lost, stolen or damaged?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#148

Post by xwvvvvwx »

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

g suite is awesome for personal accounts. One of the few non abusive services that google offers.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#150

Post by OJFord »

doubt_me wrote: post #52

Since becoming aware of my own problems with google (they truly could care less about their users data) and reading stories about previous incidents of swapping SIM cards. My solution to all of it is literally just 2 emails. Both 2fa. Recovery exists but the numbers and emails are unknown to the world beyond Google or m$ servers. And those don't get used to register anything ever. I park my recoveries then use my mai…

couldn't care less
Post reply on HN