Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

nytimes.com

Post reply on HN
Print view View original

191–200 of 312 posts

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#191

Post by johnnycab »

ojosilva wrote: post #31

I'm still a big fan of passwords. Long, hard to guess passwords. More than one password/phrase as a failsafe, in case I lose it. I got my first iOS device 3 days ago as a gift, an iPad. During the excitement of the setup process, I was told to set up 2FA for my iCloud account, which I've never conscientiously used since I own no iOS devices. Now all my Apple ids, from my 2009 iMac to my macbook are tied to the darn 2…

>Apparently 2FA for Apple ids cannot be rolled back!

Apple removed the option to turn off two-factor authentication on some Apple IDs created in iOS 10.3 or macOS 10.12.4 and later.

A couple of years ago, I forgot the question/passphrase sequence for two-step verification and subsequently got frozen out. I had initially set it as samephrase1..2..3 in an effort to refrain from supplying PII. In order to reset, I managed to opt-in to 2FA and then revert back to initial setup.

I would have continued to think of the above process as the norm, until I read your comment and followed the support link provided by the other commenter, which states that the 2FA process cannot be undone anymore! However, there seems to be a slightly convoluted alternative i.e. unlinking existing AppleID and attach a new one for iCloud only, thus keeping the (old) existing one for the App Store and other services.

https://support.ikeymonitor.com/hc/en-us/articles/1150008243...

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#192

Post by notyourday »

chimeracoder wrote: post #189
notyourday wrote: post #165

Earlier quoted context omitted.

> Dorsey should sue and sue and sue and not settle and get these companies to unfuck themselves. If you are a captain of a ship that sees an out of control oil tanker heading for it, the solution is not to sue the oil tanker owners, rather it is to get out of its way which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA

> which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Twitter supports U2F. Jack Dorsey just prefers not to use it, according to reports.

U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#193

Post by wtmt »

Abishek_Muthian wrote: post #120

In India it's not just that these digital services are at stake due to SMS OTP, entire banking security, Tax filing to Aadhaar (UID containing all data of an Indian Citizen) relies upon SMS OTP. SIM swapping attacks could have devastating effects on the lives of the people here.

It's devastating how many platforms require a mobile number in India. Many platforms also use the mobile number as the sole user identifier (try registering on Flipkart or Bounce or any other service — there is no way to do it without a mobile number and with just an email address). Many platforms also make assumptions that people's mobile numbers don't change. I gasp and scream every time I see these on a site or service, and then promptly abandon it and navigate elsewhere!

A correction: Aadhaar is available to all residents of India (those who have spent more than 182 days in the country in a year). It has nothing to do with Indian citizenship or being a proof of Indian citizenship, though with the completely broken design of the system, Aadhaar can be used to get a passport, and thus proving that one is a "citizen".

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#194

Post by chimeracoder »

notyourday wrote: post #192
chimeracoder wrote: post #189

Earlier quoted context omitted.

> which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Twitter supports U2F. Jack Dorsey just prefers not to use it, according to reports.

U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.

> U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.

The original statement is:

> 1 point by chimeracoder 11 minutes ago | parent | edit | favorite | on: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap...

> which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA

Which, as I point out, is superfluous, because Twitter already has three other forms of non-SMS 2FA. Twitter does also support SMS-based password reset, which is a problem, but that's not actually how Jack Dorsey's account got hacked in the first place.

Aside from any improvements to Twitter's security practices that could be made, Jack Dorsey himself was not using the existing security features that Twitter already offers. Which is the real problem.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#195

Post by Klathmon »

lekevicius wrote: post #190
Klathmon wrote: post #54

Earlier quoted context omitted.

Don't save your TOTP codes in your password manager if you are going for the "best" security. That turns multi-factor auth back into "single factor auth" and leaves you one exploit away from having your password and TOTP code from getting stolen.

I store my TOTP in 1Password... I think it's still more secure than SMS (because to restore 1Password vault you also need a Secret, not only your password) and so much more convenient than a separate app, because 1Password auto-copies the TOTP code to your clipboard after filling form fields, making signing in a very smooth experience. It is a security tradeoff that I take for most of my accounts. For a few that a mu…

And that's fine IMO as long as you know you are making a tradeoff.

But unless you have your 1Password setup to need the secret every time you go to have it fill in the password, the seed string is in memory unencrypted along with your passwords (or more specifically, it's stored in a way that it can be decrypted by the app/extension on it's own). That makes it one spectre/meltdown style exploit away from getting everything needed to login to the account.

Still, if that system works for you, then good! having any 2fa (even SMS) is better than nothing, storing TOTP codes in a password manager is better than SMS, storing them in a seperate device is better still, and U2F keys are even better still.

Like anything it's a gradient of tradeoffs, but I've seen too many people go from Google Authenticator to 1Password in an attempt to further secure their account, and I just like to point out that there's a good chance it's doing the opposite.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#196

Post by notyourday »

chimeracoder wrote: post #194
notyourday wrote: post #192

Earlier quoted context omitted.

U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.

> U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last. The original statement is: > 1 point by chimeracoder 11 minutes ago | parent | edit | favorite | on: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap... > which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Which, as I point out, is superfluous, because Twitter already has thr…

I am not Twitter's CEO. I'm twitter's user. I cannot use that feature without opening my account to this attack. Therefore that feature for all intended purposes does not exist because it is unusable for the purpose of protecting the account.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#197

Post by dublinben »

ojosilva wrote: post #85
H8crilA wrote: post #47

Earlier quoted context omitted.

Passwords don't work these days for sophisticated attacks. Phishing is too easy. I repeat, they don't work. No 2FA means you'll experience many successful account takeover attacks on your customers. 2FA does not mean you won't, though. Coinbase had a great talk about account takeover attacks on the recent DefCon. They receive some of the most sophisticated attacks, sometimes when attackers already have control of eve…

Phishing, as in entering your password into a field pwnd by a hacker, seems like the problem to solve: how can we avoid giving out our password to a rogue player? There are simple and complex solutions out there, we should keep taking small steps in the direction of safer password authentication, like how browsers showing the users the certificate validity, or things requiring a secret, individualized secret question…

U2F and it's successors like FIDO2 were specifically designed to prevent phishing.[0] Google claims that it has entirely eliminated phishing of their employees who have been issued U2F keys.[1]. The solutions to these problems are out available.

[0] https://fidoalliance.org/fido2/ [1] https://krebsonsecurity.com/2018/07/google-security-keys-neu...

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#198

Post by Abishek_Muthian »

wtmt wrote: post #193
Abishek_Muthian wrote: post #120

In India it's not just that these digital services are at stake due to SMS OTP, entire banking security, Tax filing to Aadhaar (UID containing all data of an Indian Citizen) relies upon SMS OTP. SIM swapping attacks could have devastating effects on the lives of the people here.

It's devastating how many platforms require a mobile number in India. Many platforms also use the mobile number as the sole user identifier (try registering on Flipkart or Bounce or any other service — there is no way to do it without a mobile number and with just an email address). Many platforms also make assumptions that people's mobile numbers don't change. I gasp and scream every time I see these on a site or se…

Correction on Resident non-Indian being eligible for Aadhaar duly noted.

Ironically, Aadhaar could indeed prevent SIM swapping attacks in certain cases for those who have updated their Aadhaar number to their service provider. If the Aadhaar number is available at the service provider, it needs to be authenticated (via Biometric and SMS OTP) before swapping SIM.

I wonder if the mobile is lost, whether at-least biometric part of the Aadhaar authentication is required to get the new SIM. Also, say if Aadhaar OTP needs to be entered in their internal service; bribing might not be possible.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#199

Post by djrogers »

fernandotakai wrote: post #141
DCKing wrote: post #100

Earlier quoted context omitted.

The problem is when a phone number is the only factor that is used. That is what Twitter allows. If you truly use an SMS only as a second factor - and don't provide recovery options only by phone, like Twitter - then you have much less of a problem. In that case, a compromised phone number does not give the attacker the password or other factor. SMS is still extremely imperfect for 2FA, but it's still a lot better th…

> The problem is when a phone number is the only factor that is used. That is what Twitter allows. that's not true. i have twitter 2FA inside authy[0] AND inside twitter's own app (it's hidden -- at least on android -- under setting and privacy -> account -> security -> login verification -> Login Code Generator) [0] https://authy.com/guides/twitter/

This is obviated by the fact that Twitter allows you to do a password and 2FA reset via SMS.

Re: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap’

#200

Post by djrogers »

vageli wrote: post #150
0x00000000 wrote: post #27

Disappointed they didn’t do something like use it to manipulate the stock market. Then it would have got much more coverage and something might actually get fixed as a result.

It likely would have made tracking the perpetrators easier if there was a paper trail in the markets.

There's enough volatility and turnonver in Twitter's stock that anyone who made a few single comma trades wouldn't ever be directly identified.

Buy some options several days in advance, drop the tweet, then sell right when volume shoots through the roof.

Post reply on HN