Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

201–210 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#201

Post by crankylinuxuser »

lotsofpulp wrote: post #177
mikeash wrote: post #172

Earlier quoted context omitted.

2FA over SMS is fine. It’s not a terribly strong second factor, but it’s decent, and far better than nothing. The problem is when companies implement 1FA over SMS and call it “2FA.” That is a catastrophically had idea, and unfortunately it confuses people into thinking that 2FA over SMS is somehow dangerous.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

So whats the procedure for someone to recover an account if the 2fa is busted/lost ?

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#202

Post by driverdan »

lotsofpulp wrote: post #177
mikeash wrote: post #172

Earlier quoted context omitted.

2FA over SMS is fine. It’s not a terribly strong second factor, but it’s decent, and far better than nothing. The problem is when companies implement 1FA over SMS and call it “2FA.” That is a catastrophically had idea, and unfortunately it confuses people into thinking that 2FA over SMS is somehow dangerous.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#203

Post by lotsofpulp »

crankylinuxuser wrote: post #201
lotsofpulp wrote: post #177

Earlier quoted context omitted.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

So whats the procedure for someone to recover an account if the 2fa is busted/lost ?

When you setup TOTP 2FA, the application should offer a few one time use codes (google offers 10, for example). These can be copied and stored safely somewhere.

If you lose the one time use codes, then you're screwed. But that's the risk you face if you want the most simple and most secure method.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#204

Post by lotsofpulp »

driverdan wrote: post #202
lotsofpulp wrote: post #177

Earlier quoted context omitted.

It's not fine, considering the zero cost of enabling TOTP 2 factor authentication. The only reason I can see for why companies don't give the option for TOTP is to force people to hand over phone numbers so they can be tracked, and in the process make the system less secure.

While you're correct it's not fine, not everyone has a smart phone or a TOTP device. There are some cases where SMS makes sense as 2FA since it's a reasonable compromise between having no 2FA or a TOTP device.

My claim is that SMS as the only 2FA option never makes sense. Wherever 2FA is enabled, a TOTP option (or equivalent that doesn't rely on third parties) should be provided.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#205

Post by lotsofpulp »

whywhywhywhy wrote: post #185
cat199 wrote: post #157

Earlier quoted context omitted.

hugely important point. helped a less-tech-savvy neighbor 'reset her skype' account that was tied to 'her phone number', only to find that the account bound to that phone number, which she had recently acquired, was publically searchable and connected with some sort of anime sex fetish subculture, presumably from a previous owner of that phone number.. she was using this phone / skype account for a job interview. nee…

Never really made any sense to me whatsoever why we all switched over from having to use phone numbers instead of email addresses as sign in over the past few years. I get why businesses want to harvest peoples phone numbers and phone books but you'd hope at least some would think of the implications to users first.

Using phone numbers as authentication is a cheap and effective way to prevent spam, as well as track users with a unique ID.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#206

Post by kyrra »

miles wrote: post #188
kyrra wrote: post #149

(googler, opinions are my own) This is one thing nice about Google Fi, Sim swap attacks aren't possible. Your phone number with Fi what is tied to your Google account, the only way to get a Fi phone number on a new phone is to sign into the Google account. So if you protect your account with good 2FA, your number is safer than any cell phone company (at least in the US).

While Google Fi appears to offer better security than other US-based carriers, the support team needs work: Why I Can No Longer Recommend Google Fi https://onemileatatime.com/google-fi-review/ > I’ve been fiercely evangelical about Project Fi since Google launched their cell phone service a few years ago. ... I think it’s important to update y’all about some recent experiences and research, along with why I am withdr…

I remember that story. It was talked about a lot here: https://news.ycombinator.com/item?id=18886804

The Fi team cares a long about these kinds of issues and does what they can to solve them. I cannot comment on specific cases, but as someone that works on Payments @ Google, I've seen the Fi team advocate for their users a lot to get things running smoothly. They deeply care about good experiences and do what they can to make sure that's the case.

Sadly, things sometimes go wrong, and it becomes a learning experience to make it better for users in the future.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#207

Post by kamyarg »

darkhorn wrote: post #182
Svip wrote: post #9

Does anyone know how common or easy SIM swapping elsewhere in the world? The SIM swapping stories I've seen on HN mostly focus on US users. I remember reading an article years ago, about banks combating SIM swapping in Africa, where a lot of transfers are done by SMS, by forcing a cooldown. But I wonder, besides the US and Africa, where is SIM swapping prevalent? NYT says I'm at risk too. I'm in Europe -- am I?

In Turkey if you change your SIM card you cannot login to your bank account (web site, app). Yeah, even if you are in same mobile operator with your same phone number. How does my bank know that I have changed my SIM card? I think that they have API between mobile operator, government, and bank. For example I can see my mobile and land line numbers from my e-government account.

App is able to access the sim unique identifier.

- https://en.wikipedia.org/wiki/SIM_card#ICCID - https://stackoverflow.com/a/38032034/1329429

But I am not sure about website, maybe they have integration with the operators to check last sim change date and compare it to their last know trusted sim or check the last time your phone was audited? You need to generate one time codes in TR banks afaik.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#208

Post by jshowa3 »

dev_dull wrote: post #162
hprotagonist wrote: post #135

https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo... NIST has said that 2FA via SMS is bad and awful for at least 3 years now. Can we knock it off, already? This won’t stop SIM swaps, but it will blunt their impact by rather a lot.

That’s the problem. Twitter requires you to add a phone number (even if you sign up without one, eventually you’ll be locked out and requires to add one). Then, once you add a number to unlock your account you’re left exposed.

I never understood this. Tinder is the same way. It makes no sense to me because of how relatively easy is to hijack someones number.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#209

Post by miles »

kyrra wrote: post #206
miles wrote: post #188

Earlier quoted context omitted.

While Google Fi appears to offer better security than other US-based carriers, the support team needs work: Why I Can No Longer Recommend Google Fi https://onemileatatime.com/google-fi-review/ > I’ve been fiercely evangelical about Project Fi since Google launched their cell phone service a few years ago. ... I think it’s important to update y’all about some recent experiences and research, along with why I am withdr…

I remember that story. It was talked about a lot here: https://news.ycombinator.com/item?id=18886804 The Fi team cares a long about these kinds of issues and does what they can to solve them. I cannot comment on specific cases, but as someone that works on Payments @ Google, I've seen the Fi team advocate for their users a lot to get things running smoothly. They deeply care about good experiences and do what they ca…

Thanks for your reply, kyrra.

Sadly, I've experienced the same steep drop in Google support of late (twice in the past week in fact) working with G Suite support agents.

Just yesterday, I was helping a client troubleshoot a week-long issue with Drive File Stream ("Can't reach Google Drive") that remains unresolved for three of their users. Despite repeated phone calls and a promised callback from a "Drive engineer", the issue persists. We've eliminated suspected culprits by testing on other computers and networks.

Tech support from large players like Google, Microsoft, and Rackspace, even when paid, has declined precipitously in recent years.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#210

Post by jxcl »

tialaramex wrote: post #174
notyourday wrote: post #165

Earlier quoted context omitted.

> Dorsey should sue and sue and sue and not settle and get these companies to unfuck themselves. If you are a captain of a ship that sees an out of control oil tanker heading for it, the solution is not to sue the oil tanker owners, rather it is to get out of its way which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA

COLREGs (international rules to not have collisions at sea on account of everybody is agreed that would be bad) A.2b. "In construing and complying with these rules due regard shall be had to all dangers of navigation and collision and to any special circumstances, including the limitations of the vessels involved, which may make a departure from these rules necessary to avoid immediate danger" Basically, if obeying t…

In case anyone regularly has trouble not getting hit by an Oil Tanker, I'd like to recommend John W. Trimmer's excellent book: How to Avoid Huge Ships[1].

[1]: https://www.amazon.com/Avoid-Huge-Ships-John-Trimmer/dp/0870...

Post reply on HN