Earlier quoted context omitted.
> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I can just see the people raging about this on social media now. “Google charged me $50 to fix an issue with my account!” “Google won’t give me any help unless I pay them! Extortion artists!” Etc.
Make it something you can pay in advance, then. For a fee, you get marked as a high-risk/high-value account, get the recovery service and risky factors of authentication get extra scrutiny, etc.
SIM swap horror story: I've lost decades of data and Google won't help
161–170 of 303 posts
Re: SIM swap horror story: I've lost decades of data and Google won't help
#162Re: SIM swap horror story: I've lost decades of data and Google won't help
#163A few suggestions: 1) Call your cellphone carrier and ask to set up a password/PIN to be used for when you call into the customer service phone number. 2) Consider your phone number and SIM card insecure. The phone carriers are ignoring the SIM swap problem even though they know how much damage it's causing. Give your phone number to as few companies as possible. Phone services such as Google Voice work without a SIM…
Yes! For example, if you're robbed on your way home from work, and they take your laptop and your mobile.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#164Earlier quoted context omitted.
> The problem is SMS account recovery, which is a really bad idea. The problem is that a lot of services tie the two together. Often one implies the other. Even if it doesn't, though, it's also easier to social engineer -- "look! I have access to the 2fa phone number! I just can't access my password manager!"
I'm not sure I've ever seen SMS account recovery.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#165Earlier quoted context omitted.
> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I can just see the people raging about this on social media now. “Google charged me $50 to fix an issue with my account!” “Google won’t give me any help unless I pay them! Extortion artists!” Etc.
Make it something you can pay in advance, then. For a fee, you get marked as a high-risk/high-value account, get the recovery service and risky factors of authentication get extra scrutiny, etc.
- Don't allow upgrading after a problem arises to get premium support: "Google won't let me pay to fix my account"
- Allow upgrading after a problem arises to get premium support: "Google extorting me to regain access to my account"
Re: SIM swap horror story: I've lost decades of data and Google won't help
#166Earlier quoted context omitted.
Why not "defend" yourself by not relying on gmail? It's not exactly the first time this has happened.
Absolutely, if you want. I am not advocating to use or not use Gmail or other services. But also be sure to use U2F on whatever you can, be it Fastmail or Proton Mail or what have you. I think Proton Mail is still working on their U2F support today, though.
source: I work at fastmail. It's cool.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#167Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…
Re: SIM swap horror story: I've lost decades of data and Google won't help
#168The most annoying part about this is that Twitter demands your phone number. You can't use another method for 2FA, such as U2F or OTP. I assume it's not at all because they want to authorize you or keep your account safe, but rather because they want to be able to identify you. User's lose both privacy and security.
Just to clarify, you can use U2F to login, but you can’t only use U2F. Eventually you’ll be locked out of your account (after logging in) and forced to provide a valid number.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#169The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.
In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.
Re: SIM swap horror story: I've lost decades of data and Google won't help
#170The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.
In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.
What about hackers bribing an employee?