SIM swap horror story: I've lost decades of data and Google won't help • Hacker News Board

Re: SIM swap horror story: I've lost decades of data and Google won't help

#221

Post by ijpoijpoihpiuoh » Mon, Jun 17, 2019, 6:25 PM UTC

mceachen wrote: post #65

tooop wrote: post #43

Earlier quoted context omitted.

Not really an average person isn't he?

How is he not an average person, as far as security goes? 1) he didn't use a password app 2) he thought google drive was a safe place for his stuff 3) he thought google drive was a secure place for his stuff All three things, which I would bet are fairly common assumptions (the last 2 are certainly part of Google's marketing!), turned out to bite him.

He is a public personality and in that role has been related to Bitcoin. And he also has his phone number and email publicly visible on the internet.

https://gizmodo.com/a-tv-anchor-tries-to-gift-bitcoin-on-air...

It seems like this only happens to people who have poor opsec about their email addresses, phone numbers, and are publicly related to the cryptocurrency movement. I mean, I'm sure it happens to other people, but that's the only case I've ever heard about.

I would personally be wary about publicly listing the email I use with my bank, or my phone number, and I've done what I can to scrub the internet of these values. If you have to be publicly reachable through a medium other than Facebook or Twitter, have a separate email and phone number through which you conduct your serious personal business. But most people do not need this kind of public reachability, or else have it through work. For those types of people, it would behoove them to keep their profile small.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#222

Post by vel0city » Mon, Jun 17, 2019, 6:27 PM UTC

daphneokeefe wrote: post #147

jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

What is your contingency plan for when that physical key is lost, stolen or damaged?

Multiple physical keys in multiple formats stored in multiple places. I've got a few security keys: one on a keyring, one in a locked file cabinet, one locked in a safe. Backup codes are printed on good quality acid-free paper with good toner and then are put in acid-free envelopes or laminated, stored in a safe at home and a trusted family member's house.

I'm far more concerned with an attacker from the internet or destruction from a fire or natural disaster than someone using my computer at my home who happens to have my username/password combination as well.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#223

Post by gambiting » Mon, Jun 17, 2019, 6:38 PM UTC

If you haven't yet, remove your telephone number as a recovery option for your Gmail account. And also, why can't US fix the shit that is transferring SIM cards? In the UK you can request a SIM transfer code but it takes at least a few days - there's plenty of time to catch it and stop it before someone transfers your SIM. Why can't American operators do the same? Just say "you have received your request, please wait 7 days for it to be processed" - why does it have to be instant?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#224

Post by Gwypaas » Mon, Jun 17, 2019, 6:39 PM UTC

zyx321 wrote: post #69

tpetry wrote: post #8

The industry needs to learn that sms 2fa is not secure because getting a sim for someone else is so easy. And this happening in every country.

In times like these, I am glad to live in a stone age country like German, where it is near-impossible to get a new SIM without going to the store in person and presenting a government-issued ID.

Or a country like Sweden where you have to authenticate customer service through 2 FA using an application connected to your bank account, where you input a password or fingerprint.

And then the change only happens after you confirm a text message sent to your phone asking you to approve the request.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#225

Post by carapace » Mon, Jun 17, 2019, 6:39 PM UTC

So the same pattern unfolds:

Someone trusts faceless uncaring tech companies with all of their most crucial data.

Companies get hacked. User's life is crashed. Companies feel nothing and have pathetic "support".

"Thankfully", insider access grants privileges.

> Thankfully, I have a good friend at $COMPANY who was very concerned with my plight and was able to get $PRIVILEGED_SUPPORT

My point is that we have set up these systems that have us all skating on thin ice, and when people inevitable fall through (or are pulled under by thieves) we have almost no recourse, unless we happen to be well-connected to the internal workings of these machines.

We're turning the world into Morlocks and Eloi. We've got to wake up and slow this shit down.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#226

Post by [deleted] » Mon, Jun 17, 2019, 6:39 PM UTC

8ytecoder wrote: post #111

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

This is why I panicked when they announced they won't sync Google Photos with Google Drive anymore. With the sync, I can setup one of my computers to constantly download the photos and then copy it onto a local backup and an online backup. If my Google Account gets locked - I'll just copy the photos into something else and move on with my life. They removed that saying it's confusing to users - all the while it was a…

[deleted]

Re: SIM swap horror story: I've lost decades of data and Google won't help

#227

Post by ericwood » Mon, Jun 17, 2019, 6:40 PM UTC

rikkus wrote: post #200

8ytecoder wrote: post #111

Earlier quoted context omitted.

This is why I panicked when they announced they won't sync Google Photos with Google Drive anymore. With the sync, I can setup one of my computers to constantly download the photos and then copy it onto a local backup and an online backup. If my Google Account gets locked - I'll just copy the photos into something else and move on with my life. They removed that saying it's confusing to users - all the while it was a…

Would you mind elaborating on your iCloud setup to handle this please?

The most common way to do this is to have the Photos app on MacOS set to "download originals," then use whatever backup solution you like best. I highly recommend setting this up. Last month through some sort of iCloud glitch my fiancé lost almost all of her photos from before the beginning of this year. We've escalated it to their highest tiers of support but the photos are gone. Redundancy is important, and even the best providers aren't foolproof. It was devastating to lose all of those memories.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#228

Post by pergadad » Mon, Jun 17, 2019, 6:41 PM UTC

ghaff wrote: post #38

flarex wrote: post #28

Earlier quoted context omitted.

Why doesn't Google get rid of SMS recovery completely? It's a huge security flaw that can be easily exploited.

Probably because the more barriers you put in the way of scams, social engineering, etc. the harder you make it for people to legitimately get back into their accounts and the more likely it is that you'll instead read stories about how someone "forgot their credentials and lost access to everything in their account and Google won't do anything about it." No opinion on SMS specifically but there are tradeoffs.

Google is a pain as there's no way to talk to a human. I have lost access to an old Gmail account as my phone broke. Without authenticator I can't get in. I can't set up authenticator anew because I don't have the password anymore. I still have same phone and plenty of emails - just no way to get in.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#229

Post by yellowapple » Mon, Jun 17, 2019, 6:47 PM UTC

ijpoijpoihpiuoh wrote: post #217

daphneokeefe wrote: post #147

Earlier quoted context omitted.

What is your contingency plan for when that physical key is lost, stolen or damaged?

You should have emergency backup keys as well printed on real paper. I have a set stored with our important files, and another in my nightstand. Having my phone stolen would be a damnable inconvenience, since that is my second factor -- although not via SIM, but via Google's in-app authentication. But it wouldn't be fatal.

I use andOTP, which is compatible with Google Authenticator and actually allows backing up the private keys (one of the key missing features of Google Authenticator, though maybe they've fixed that).

Re: SIM swap horror story: I've lost decades of data and Google won't help

#230

Post by ChuckMcM » Mon, Jun 17, 2019, 6:48 PM UTC

Back before phones we had things like fire safes that would hold your "precious memories" so when your house burned down you wouldn't lose them. That is so much harder to do these days.

One of the things I do is periodically spool off ephemeral data to BD-R's (write once Blu-Ray disks). At 25GB a pop they aren't super dense but I don't actually generate more 'new' data than that in a given month. It was something I do because when I started in this business I made backups because crappy disk drives would lose data. But these days you can get crypto ransomed and poof all that data unavailable?

There is no doubt a market for some new 'best practices' for data security. Perhaps No Starch Press will get someone to collect those ideas into a book.