Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SIM swap horror story: I've lost decades of data and Google won't help

zdnet.com

Post reply on HN
Print view View original

271–280 of 303 posts

Re: SIM swap horror story: I've lost decades of data and Google won't help

#271

Post by jchw »

mikelward wrote: post #82
jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

Or use your Android phone as your second factor. https://security.googleblog.com/2019/06/use-your-android-pho...

That’s a great idea and would’ve saved me some time. Sadly, I had ordered and received my Titan kit before even realizing I still had an Android device, less that I could use it to bootstrap my iOS device...

I hope Apple some day supports NFC or maybe even USB U2F, both things Android has supported on phones for a bit.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#272

Post by zxcvbn4038 »

yellowapple wrote: post #232
zxcvbn4038 wrote: post #173

Earlier quoted context omitted.

When you first enable 2FA with Google you have to do SMS (at least that was the requirement last time I did it). However, once you've defined an alternative 2FA method (Google auth, u2f key, etc) then you can remove the SMS method completely. Believe it or not banks are really bad at security. They are so bad at it that they don't even realize how bad at it they are. But the banks all copy from each other so "what th…

> When you first enable 2FA with Google you have to do SMS (at least that was the requirement last time I did it) I don't remember that ever being the case, either when Google first launched Google Authenticator and 2FA (when I pretty soon after set it up) or when I later went through the setup process for my work account at my current job (a couple years ago).

That is awesome then! It was a lot of hassle for me to find a phone that accepts incoming calls (and wouldn't come back to me) so I could get past the first step - though to Google's credit the number I used never showed up anywhere so they didn't try to sell me out.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#273

Post by eeeeeeeeeeeee »

ericwood wrote: post #227
rikkus wrote: post #200

Earlier quoted context omitted.

Would you mind elaborating on your iCloud setup to handle this please?

The most common way to do this is to have the Photos app on MacOS set to "download originals," then use whatever backup solution you like best. I highly recommend setting this up. Last month through some sort of iCloud glitch my fiancé lost almost all of her photos from before the beginning of this year. We've escalated it to their highest tiers of support but the photos are gone. Redundancy is important, and even th…

This is how I do it too, then backups are done through Arq and Amazon. I consider Google Photos as a “share / social” area. I would never entrust masters with Google.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#274

Post by jchw »

calvinmorrison wrote: post #166
jchw wrote: post #61

Earlier quoted context omitted.

Absolutely, if you want. I am not advocating to use or not use Gmail or other services. But also be sure to use U2F on whatever you can, be it Fastmail or Proton Mail or what have you. I think Proton Mail is still working on their U2F support today, though.

FastMail has humans respond to all support tickets. Imagine being able to recover your email without spending 5 days talking to a google form? source: I work at fastmail. It's cool.

At the end of the day, there’s a lot of differences between the many webmail offerings. The apps, the support, the feature-sets, etc. If you have gotten used to things like the nuances of Gmail filters, switching anywhere can be challenging, I think, and the same could be said about the reverse. I’ve been considering using both Gmail and FastMail simultaneously for a while, especially for custom domains. Also, JMAP is cool.

I am mostly just suggesting that folks who read stories like these and fear similar predicaments take the time, effort, expense, etc. to properly secure whatever accounts they have.

Thought experiment: if someone steals an account with no 2FA, enables U2F and other security mechanisms, how will support verify who truly owns the account? Or the reverse: user enables U2F and someone calls in and tries to claim the account was stolen?

Having humans make judgements is important because the real world is complicated and people are imperfect, but using U2F in the first place can save you a huge headache, no matter what services you use. If support can just flip a bit and disable U2F, it isn’t very useful for the same reasons accounts get hijacked to begin with.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#275

Post by 8ytecoder »

ineedasername wrote: post #84

Google really fails hard in the face of providing support when issues like this occur. The average person has to try various automated account recovery options which, as in the author's case, are readily changeable the moment the account is compromised, rendering them somewhat useless, and then users are out of luck. It's a situation that is mind-boggling. Users as asked to place a significant chunk of their digital…

There’s also another bad side effect of Google. Google makes and gives away stuff for free and one of the reasons they do it is because they run a lean operation. They don’t provide any kind of support. Let’s say someone want to start a new company that provides all the same features of Google and provide solid support - there’s no way they can do it for free. Or even if it’s a reasonable price, people are going to pick free anyway. Except those of us who care. Just the fact Google and Facebook gives it away from free, in a sense, kills any possible paid service in the domains they operate. IMHO that qualifies as anti-competition and anti-trust. But the laws aren’t designed for this scenario at all.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#276

Post by prima-facie »

flarex wrote: post #28
jchw wrote: post #12

Anyone who wants to defend themselves, consider using U2F where you can and Google Advanced Protection. I just recently picked up a bluetooth security key because one is needed to log an iPhone into an account using advanced protection; there is no SMS backup loophole. The Titan key bundle comes with a bluetooth and USB key, which is enough to get started, though frankly you probably want a couple additional backup k…

Why doesn't Google get rid of SMS recovery completely? It's a huge security flaw that can be easily exploited.

I've just checked and Google now allows the removal of SMS based 2FA if you have an alternative 2FA method configured.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#278

Post by taeric »

everybodyknows wrote: post #214
tialaramex wrote: post #58

Earlier quoted context omitted.

Conventionally, one metaphorically chooses a _hill_ to die on, and lines in the sand are only crossed or redrawn, not died on. The insistence on using Chrome is arbitrary and I don't like it. The use of U2F rather than WebAuthn at least has a technical justification (older Android devices can't do WebAuthn, and while it's backward compatible in the sense that you can use a WebAuthn authentication having signed up wit…

You'd think Ubuntu chromium-browser might be acceptable for Google U2F setup -- but no, not when I tried a couple of months ago.

Worked for me. :(

What error did you see?

Re: SIM swap horror story: I've lost decades of data and Google won't help

#279

Post by taeric »

tialaramex wrote: post #58
taeric wrote: post #22

Earlier quoted context omitted.

You can use it in any browser. You have to register it in chrome. Crappy, but not a line in the sand I'm willing to die on.

Conventionally, one metaphorically chooses a _hill_ to die on, and lines in the sand are only crossed or redrawn, not died on. The insistence on using Chrome is arbitrary and I don't like it. The use of U2F rather than WebAuthn at least has a technical justification (older Android devices can't do WebAuthn, and while it's backward compatible in the sense that you can use a WebAuthn authentication having signed up wit…

Ha! That was an amusing mix of phrases. You got what I meant though, and provided some color. Agreed on it sucking.

Re: SIM swap horror story: I've lost decades of data and Google won't help

#280

Post by patio11 »

graeme wrote: post #219
abraham wrote: post #161

Earlier quoted context omitted.

You can get extra security from Google for free. https://landing.google.com/advancedprotection/

Patio11 just had an automated loss of access on his phone when enrolling. Lack of support hurts there too. https://mobile.twitter.com/patio11/status/114040469625693798...

This was quite unfun. (Fixed now, after I blackboxed what the actual problem was. Some Googlers are looking into the docs/error messages to fix that half.)
Post reply on HN