Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

Post reply on HN
Print view View original

291–300 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#291

Post by Tepix »

azinman2 wrote: post #72
mself wrote: post #49

Unlike what the OP stated, the key is NOT to list you phone number as an SMS 2FA recovery option. Only use the non-SMS options (e.g. app-based recovery, Google Authenticator, recovery codes). Adding SMS as an option makes your account less secure, not more. Unfortunately, most sites do not allow you to turn off SMS recovery even if they offer other 2FA options. Security is only as strong as the weakest link, and SMS…

The problem lies in that Google Authenticator is tied to a device, so if you upgrade it or lose it, you’re f’d. I also doubt many use/print recovery codes, and if they do, good luck finding them 7 years later. Overall the situation isn’t great.

No, Google Authenticator is not tied to a device. It's a standard (TOTP, RFC 6238) and you just need to use an app (perhaps not Google Authenticator, I use a different app myself) that will let you see the numerical code that you need to save somewhere.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#292

Post by gambiting »

renaudg wrote: post #285
gambiting wrote: post #223

If you haven't yet, remove your telephone number as a recovery option for your Gmail account. And also, why can't US fix the shit that is transferring SIM cards? In the UK you can request a SIM transfer code but it takes at least a few days - there's plenty of time to catch it and stop it before someone transfers your SIM. Why can't American operators do the same? Just say "you have received your request, please wait…

There's no such thing as a "SIM transfer code" in the UK. SIM swap scams are a thing here too : https://www.bbc.co.uk/news/business-46047714

? Of course there is - it's called a PAC code, and it takes at least 1 working day with the fastest operators, in the meantime you get notified that it's happening.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#293

Post by fauigerzigerk »

ryanmarsh wrote: post #244
ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

This kind of stuff is horrifying to me and why I willingly pay the Apple Tax. At the end of the day they have stores full of humans I can walk into and tell my sob story to and excellent telephone support.

I don't believe it works the way you think it does:

https://support.apple.com/en-us/HT204921 "If you need more help, contact Apple Support. While we can answer your questions about the account recovery process, we can't verify your identity or expedite the process in any way."

Re: SIM swap horror story: I've lost decades of data and Google won't help

#294

Post by ufmace »

jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

This is the first thing I thought of when reading that. For sure, Google's lack of real support for fixing things when someone does steal enough 2FA creds, like phone number, is a drag. On the other hand, it appears that setting up Advanced Protection probably gives you a much harder to hack account than any other provider could do.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#295

Post by calvinmorrison »

jchw wrote: post #274
calvinmorrison wrote: post #166

Earlier quoted context omitted.

FastMail has humans respond to all support tickets. Imagine being able to recover your email without spending 5 days talking to a google form? source: I work at fastmail. It's cool.

At the end of the day, there’s a lot of differences between the many webmail offerings. The apps, the support, the feature-sets, etc. If you have gotten used to things like the nuances of Gmail filters, switching anywhere can be challenging, I think, and the same could be said about the reverse. I’ve been considering using both Gmail and FastMail simultaneously for a while, especially for custom domains. Also, JMAP i…

I mean, i think you answered the question yourself. History of account security details, things like login logs, IP addresses, when things were changed, payment information, etc can corroborate the story a user is trying to tell (ie, my account got stolen), or refute it.

And those things? It comes down to having strong process rules and having intelligent life forms make the decision.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#296

Post by azinman2 »

Tepix wrote: post #291
azinman2 wrote: post #72

Earlier quoted context omitted.

The problem lies in that Google Authenticator is tied to a device, so if you upgrade it or lose it, you’re f’d. I also doubt many use/print recovery codes, and if they do, good luck finding them 7 years later. Overall the situation isn’t great.

No, Google Authenticator is not tied to a device. It's a standard (TOTP, RFC 6238) and you just need to use an app (perhaps not Google Authenticator, I use a different app myself) that will let you see the numerical code that you need to save somewhere.

It’s tied to the device as in it won’t be part of your backup to a new phone.. you have to manually transfer it yourself which according to you is using another app!

So the likelihood of moving to a new phone without those codes transferred is very high. Not exactly an easy experience.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#297

Post by juozas »

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

Buy a domain (12+USD year depends on extension) + G-Suite (around 4-5USD/Month) and that's it. As a bonus, you always can swap your email provider without changing your email address.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#298

Post by jwr »

jwr wrote: post #258

Companies should never require SMS as a 2nd factor. It isn't secure. Let's call out names: * Twitter requires you to enable cell-phone based 2nd factor before they let you enable any other 2nd factor. Luckily in my case their buggy software determined that my cell phone number is "incorrect", so I was never able to. * Twilio (the authors of Authy!) let you use TOTP codes from Authy in addition to SMS-based 2FA. There…

So, I've just realized that Chase online banking, while mandating SMS 2FA, also lets you choose "send code via E-mail".

I'll… just leave this here without any further comment.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#299

Post by mrgill »

mceachen wrote: post #47
chongli wrote: post #4

This is a good place to remind everyone of Google Takeout [1]. Back up all of your data. Don't let this horror story happen to you. [1] https://takeout.google.com/settings/takeout

Thanks for the reminder--I've done it several times in the past, but it wasn't a scheduled thing at all. There's a new checkbox in takeout that lets you schedule a backup every 2 months (and then presumably you'll get an email when you need to download it). Does anyone else have issues with takeout failing with "unknown error occurred" if you use the default of selecting all products? I have to manually create multip…

Works fine for me with select all. Maybe it was a temporary thing.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#300

Post by mrgill »

ericwood wrote: post #227
rikkus wrote: post #200

Earlier quoted context omitted.

Would you mind elaborating on your iCloud setup to handle this please?

The most common way to do this is to have the Photos app on MacOS set to "download originals," then use whatever backup solution you like best. I highly recommend setting this up. Last month through some sort of iCloud glitch my fiancé lost almost all of her photos from before the beginning of this year. We've escalated it to their highest tiers of support but the photos are gone. Redundancy is important, and even th…

I should go and backup my photos asap then...
Post reply on HN