Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

161–170 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#161

Earlier quoted context omitted.

> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I can just see the people raging about this on social media now. “Google charged me $50 to fix an issue with my account!” “Google won’t give me any help unless I pay them! Extortion artists!” Etc.

Make it something you can pay in advance, then. For a fee, you get marked as a high-risk/high-value account, get the recovery service and risky factors of authentication get extra scrutiny, etc.

You can get extra security from Google for free. https://landing.google.com/advancedprotection/

Re: SIM swap horror story: I've lost decades of data and Google won't help

#163

A few suggestions: 1) Call your cellphone carrier and ask to set up a password/PIN to be used for when you call into the customer service phone number. 2) Consider your phone number and SIM card insecure. The phone carriers are ignoring the SIM swap problem even though they know how much damage it's causing. Give your phone number to as few companies as possible. Phone services such as Google Voice work without a SIM…

> 5) Ask yourself, what will happen if you lose both your laptop and your phone at once?

Yes! For example, if you're robbed on your way home from work, and they take your laptop and your mobile.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#164
post #91

Earlier quoted context omitted.

> The problem is SMS account recovery, which is a really bad idea. The problem is that a lot of services tie the two together. Often one implies the other. Even if it doesn't, though, it's also easier to social engineer -- "look! I have access to the 2fa phone number! I just can't access my password manager!"

I'm not sure I've ever seen SMS account recovery.

Google has sms account recovery.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#165

Earlier quoted context omitted.

> I would even not mind something like one-time payments for support calls, for example pay $50 for a service call to get assistance in a case like this. I can just see the people raging about this on social media now. “Google charged me $50 to fix an issue with my account!” “Google won’t give me any help unless I pay them! Extortion artists!” Etc.

Make it something you can pay in advance, then. For a fee, you get marked as a high-risk/high-value account, get the recovery service and risky factors of authentication get extra scrutiny, etc.

They'd probably get bad headlines regardless of whether or not they required an in-advance subscription:

- Don't allow upgrading after a problem arises to get premium support: "Google won't let me pay to fix my account"

- Allow upgrading after a problem arises to get premium support: "Google extorting me to regain access to my account"

Re: SIM swap horror story: I've lost decades of data and Google won't help

#166
post #61
post #33

Earlier quoted context omitted.

Why not "defend" yourself by not relying on gmail? It's not exactly the first time this has happened.

Absolutely, if you want. I am not advocating to use or not use Gmail or other services. But also be sure to use U2F on whatever you can, be it Fastmail or Proton Mail or what have you. I think Proton Mail is still working on their U2F support today, though.

FastMail has humans respond to all support tickets. Imagine being able to recover your email without spending 5 days talking to a google form?

source: I work at fastmail. It's cool.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#167

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

It’s $20/year to get 100GB of space for GoogleOne. Worth it so that you have a paid account with support options.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#168
> It turns out that the 2FA with text messaging sent to a cell phone may be useless when hackers steal your SIM right out from under you.

The most annoying part about this is that Twitter demands your phone number. You can't use another method for 2FA, such as U2F or OTP. I assume it's not at all because they want to authorize you or keep your account safe, but rather because they want to be able to identify you. User's lose both privacy and security.

Just to clarify, you can use U2F to login, but you can’t only use U2F. Eventually you’ll be locked out of your account (after logging in) and forced to provide a valid number.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#169
post #69
post #8

The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.

In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.

Sorry but you are wrong. Today was news on heise that clearing bank accounts by replacements and transfering the money to some popular new banks like fidor and n26 resulted in a temporary ban of a small bank to transfer any money to these banks. It‘s happening here too ;)

Re: SIM swap horror story: I've lost decades of data and Google won't help

#170
post #69
post #8

The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.

In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.

Does the 20 year old minimum wage employee working at that store know how to spot a good quality fake ID card?

What about hackers bribing an employee?

Post reply on HN