SIM swap horror story: I've lost decades of data and Google won't help • Hacker News Board

Re: SIM swap horror story: I've lost decades of data and Google won't help

#151

Post by rst » Mon, Jun 17, 2019, 5:08 PM UTC

danielpal wrote: post #138

jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

This unfortunately is useless. Account recovery will still allow the hacker to use the phone number that has just been swaped to logon to the email. The weakest link is what matters and in this case you are just putting a bigger door lock on the front door while leaving your back door open.

Once you've configured a security key on a Google account, it's entirely possible to remove phone-number based account recovery -- and strongly recommended for at-risk users. See step 21 et seq. in the Tech Solidarity security guide for people working on political campaigns:

https://techsolidarity.org/resources/security_key_gmail.htm

For no particular reason, Google does require you to temporarily configure phone-number based recovery while configuring other 2FA options -- but once they're set up, you don't need the phone number anymore.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#152

Post by rb808 » Mon, Jun 17, 2019, 5:08 PM UTC

hocuspocus wrote: post #53

rb808 wrote: post #31

The fact that ACH is slow is a feature not a bug. Remember that when people want to speed up money transfers. > After a couple of days, our bank reversed the $25,000 charge and told us that the fraud department caught the ACH withdrawal before it was fully processed so that neither my family nor the bank lost this money forever.

Instant transfers work fine in countries where banks do their job properly. Mobile phone numbers shouldn't be used as a second factor, much less as a way to fully recover online credentials to your bank account.

You're probably right. You definitely shouldn't be able to recover your online credentials then immediately transfer out all the money.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#153

Post by lotyrin » Mon, Jun 17, 2019, 5:09 PM UTC

iwasakabukiman wrote: post #145

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I can just see the people raging about this on social media now. “Google charged me $50 to fix an issue with my account!” “Google won’t give me any help unless I pay them! Extortion artists!” Etc.

Make it something you can pay in advance, then.

For a fee, you get marked as a high-risk/high-value account, get the recovery service and risky factors of authentication get extra scrutiny, etc.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#154

Post by yalogin » Mon, Jun 17, 2019, 5:09 PM UTC

What do companies still use phone numbers for 2FA? This should be an automatic design decision to not use the phone number for anything outside of initial account set up. All the banks use it.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#155

Post by fastball » Mon, Jun 17, 2019, 5:09 PM UTC

I don't understand how the attacker got access to his Google account just from his phone number? Was his password "password"?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#156

Post by ineedasername » Mon, Jun 17, 2019, 5:10 PM UTC

dangThatSucks wrote: post #114

Analemma_ wrote: post #107

Earlier quoted context omitted.

> People who pay for G-suite have real support, even ::gasp:: telephone support. Why on earth does google not offer this to consumer users? I know people are getting sick of this phrase, but I'm going to repeat it here anyway because it answers your question perfectly: why doesn't Google have customer support? They do, but if the product is free, you're not the customer. As you note, Google does have real customer su…

Google One advertises real support for consumer users... but it turns out they can't really so anything but read support docs to you.

I didn't realize, I apparently was automatically made a Google One user when they created the program because I pay for a bit of extra Drive storage. I'd really like to hear stories from people who have had a hacked/stolen account and the support Google One provided.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#157

Post by fastball » Mon, Jun 17, 2019, 5:10 PM UTC

Shank wrote: post #91

mikeash wrote: post #59

Earlier quoted context omitted.

SMS 2FA is fine. 2FA adds another layer on top of your password. The second factor doesn’t have to be particularly secure to make you safer. The problem is SMS account recovery , which is a really bad idea.

> The problem is SMS account recovery, which is a really bad idea. The problem is that a lot of services tie the two together. Often one implies the other. Even if it doesn't, though, it's also easier to social engineer -- "look! I have access to the 2fa phone number! I just can't access my password manager!"

I'm not sure I've ever seen SMS account recovery.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#158

Post by ineedasername » Mon, Jun 17, 2019, 5:11 PM UTC

Someone1234 wrote: post #118

dangThatSucks wrote: post #114

Earlier quoted context omitted.

Google One advertises real support for consumer users... but it turns out they can't really so anything but read support docs to you.

Is this a reference to something? I haven't heard much about Google One's support good or bad. The concern I'd have with G-One is that if you lost access to your account, you also aren't a Google One customer, and the support likely won't assist you. Creating a chicken/egg situation.

Yes, there should be some support for non-paying users. Even if it comes at a cost, like a flat rate incident fee.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#159

Post by timwis » Mon, Jun 17, 2019, 5:12 PM UTC

rashkov wrote: post #109

mceachen wrote: post #57

Earlier quoted context omitted.

> Call your cellphone carrier and ask to set up a password/PIN Note that, at least for TMobile, AT&T, and Verizon, the password/PIN is presented to the CSR in plaintext (as they verify the pin over the phone verbally). I'd assumed they'd transfer to some pin-capture applet to verify, but nope. > Use an authentication app, such as Google Authenticator If you decide on Google Authenticator, make sure you scan the barco…

Authy allows you to recover your account using... SMS. So this is also vulnerable to SIM swapping. https://medium.com/mycrypto/what-to-do-when-sim-swapping-hap...

Omg you're kidding me

Re: SIM swap horror story: I've lost decades of data and Google won't help

#160

Post by iwasakabukiman » Mon, Jun 17, 2019, 5:12 PM UTC

fastball wrote: post #155

I don't understand how the attacker got access to his Google account just from his phone number? Was his password "password"?

You can just say you forgot your password and they’ll send you a text message with a code to reset the password if you’ve registered a number with that account.