Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

Post reply on HN
Print view View original

241–250 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#241

Post by loginx »

8ytecoder wrote: post #111
ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

This is why I panicked when they announced they won't sync Google Photos with Google Drive anymore. With the sync, I can setup one of my computers to constantly download the photos and then copy it onto a local backup and an online backup. If my Google Account gets locked - I'll just copy the photos into something else and move on with my life. They removed that saying it's confusing to users - all the while it was a…

Where did they announce that? I still have that setting enabled, and I'm using it for backing up exactly the same way you described, so I really hope this doesn't just get magically turned off someday.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#242

Post by greggyb »

tialaramex wrote: post #96
jpalomaki wrote: post #48

This is why I would like to trust my digital identity to my bank. They have enough local, physical presence so that I could show up in person and prove who I am. Also the personnel is already familiar with checking the identity and hopefully less suspectiple to social engineering. 2FA tokens and codesheets without SMS backup are secure, but bit tricky to manage. Takes some effort to distribute to different, secure pl…

My good bank has no physical presence whatsoever. I mean, I presume they operate a call centre somewhere, maybe in Scotland, but I've never seen it. They can reach out and cause things to happen at a distance, but I don't want that used to authenticate me. They used it when I had lost my cards, to cause me to receive a bundle of cash so I could get on with my day just paying cash everywhere. I have a specialized OTP…

I would like to know more about this bank!

What bank is it? How did you find it?

I've not heard of features similar to this, especially the last part about buying a house.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#244

Post by ryanmarsh »

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

This kind of stuff is horrifying to me and why I willingly pay the Apple Tax. At the end of the day they have stores full of humans I can walk into and tell my sob story to and excellent telephone support.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#245

Post by jdofaz »

tzs wrote: post #143

> While I had a PIN associated with my SIM, I still do not know how the thief was able to get past this the first time, I changed this PIN on the call. If he's really talking about the SIM PIN, I don't think having one helps against this kind of attack. The SIM PIN is to prevent people in possession of your physical SIM from using your cellular account for voice or data. What you need with T-Mobile is a separate PIN…

I thought of the port out pin too, but I think the attacker convinced t-mobile support to activate a different SIM. I don't think the PIN does anything in that scenario.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#246

Post by Bakary »

thom wrote: post #187

In the space of the afternoon after reading this article, I removed SMS 2FA from all my accounts, installed Authy, added all my accounts to it, found out Authy is also insecure[0], reconfigured it to be less insecure, and basically despaired. My solution going forward will be to spend all of my money each month so there's nothing to steal, and have a terrible reputation online that therefore can't be ruined. [0] http…

A lock on your door is obviously insecure, but can work because it introduces friction for the burglar, while there are other targets around. It's a similar principle at work for online security. Some amount of protection coupled with the statistical likelihood of being targeted already goes a long way.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#247

Post by UncleMeat »

yellowapple wrote: post #233
mikelward wrote: post #90

Earlier quoted context omitted.

The article doesn't say if the user had two-factor authentication set up. I guess it's implied they used SMS as the second factor. This would happen with any email provider. So the fix isn't changing email provider, it's using a more secure second factor, e.g. U2F.

Right, but at least with a different email provider it's infinitely more likely to get actual support if this happens.

"I don't remember my password and I have a new phone, can you help me" is precisely how attackers do sim swaps in the first place.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#248

Post by UncleMeat »

module0000 wrote: post #108

Don't use 2FA, if the 2nd factor is anything mobile-based. Use strong passphrases, and type them when you need access to the assets they protect. There is the concept of "security VS convenience", a trade-off you make when using secured assets. 2FA is convenience just as much as it is security. By having SMS as a method to reset a password, you reduce the attackers workload from cracking a difficult password to "comp…

Passphrases can be phished.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#249

Post by OrwellianChild »

archi42 wrote: post #104
jchw wrote: post #50

Earlier quoted context omitted.

Yeah, Chromium is needed to add keys, which effectively means you can’t enable Advanced Protection without Chromium. I personally ran into this wall. I acknowledge that this sucks, as a person that intentionally only uses Firefox, but to be clear logging in and most other operations work absolutely fine with Advanced Protection. Does it really disable all API access? I thought it only blocked certain OAuth scopes, bu…

Seems like Firefox U2F is just disabled by default: https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-f... (tl;dr: Open about:config, search for u2f, enable) With that done, GitHub prompts me for my key. My Linux office workstation is missing the necessary udev rule, so I couldn't test more. (Funnily, pressing Cancel caused them to send me a SMS, so their 2FA is practically worthless).

I've run into strange interactions where adding a key is disabled in Firefox (even with the security.webauth.u2f flag set to true), but once one key is added, you can add subsequent keys no problem.

This is how Github worked for me - I think it's just a mis-match in the code checking for U2F functionality...

Re: SIM swap horror story: I've lost decades of data and Google won't help

#250

Post by everybodyknows »

tzs wrote: post #143

> While I had a PIN associated with my SIM, I still do not know how the thief was able to get past this the first time, I changed this PIN on the call. If he's really talking about the SIM PIN, I don't think having one helps against this kind of attack. The SIM PIN is to prevent people in possession of your physical SIM from using your cellular account for voice or data. What you need with T-Mobile is a separate PIN…

This T-mobile doc has more on the 6-15 digit "PIN/passcode":

  https://support.t-mobile.com/docs/DOC-37477
Note that it can be set up via the T-Mobile web site, alternative to the phone support line.
Post reply on HN