[HN Gopher] Ask HN: How do I protect myself against SIM swap att...
___________________________________________________________________
Ask HN: How do I protect myself against SIM swap attacks?
I am on T-mobile in the US if that helps.
Author : benrapscallion
Score : 31 points
Date : 2021-12-30 16:14 UTC (6 hours ago)
| alphabettsy wrote:
| https://www.t-mobile.com/support/plans-features/account-take...
| kmos17 wrote:
| in my experience it's pure PR bs with no teeth in response to
| public pressure. Getting past the code verification is trivial
| in stores. Employees do not enforce verification at all or even
| when they do a decent fake id would easily defeat it since
| tmobile doesn't bother sending a 2fa verification to your
| device.
| alfu wrote:
| Yes, I listened to a podcast that describes an attacker
| getting access even though the victim's account had a PIN
| (https://darknetdiaries.com/transcript/97/):
|
| >MILES: [MUSIC] They were able to get ahold of T-Mobile and
| manipulate their way in through either doing it in person or
| doing it over the phone, and convince somebody to change out
| the SIM for them.
| dookahku wrote:
| I use Google Fi because the SIM card is attached to my Gmail
| account where I can use A real 2FA
| toomuchtodo wrote:
| Does Google Fi support eSIM?
| devoutsalsa wrote:
| Yes.
| toomuchtodo wrote:
| Tremendous, thank you!
| CAPSLOCKSSTUCK wrote:
| One answer I haven't seen mentioned yet is to use a carrier who
| lacks a physical presence (e.g. many MVNOs). I'm not sure if the
| MVNO security infrastructure can be circumvented by employees at
| the source network's physical stores, however. E.g. if I use
| Boost Mobile, can a Verizon store employee override the PIN I've
| set?
|
| Of course the best answer is to not rely on SMS or voice call
| 2FA, but as others point out, some services only support these
| insecure options.
| ridaj wrote:
| Use authenticator app for 2FA, not your phone number.
|
| But be really sure you want to do this. The main reason I would
| not recommend ordinary consumers do this, is that if you lose
| your SIM (eg, stolen or lost phone), you can go to a mobile phone
| shop and get a new SIM card issued to you after verifying your
| identity. With other forms of 2FA, you do not have access to the
| same real-life-based identity verification service, and it is
| also essentially the source of SIM-swap risk.
| pkrotich wrote:
| Authenticator app can also stop working when you migrate to a
| new phone - a friend got locked out recently after migration.
| Apparently you need to follow some steps [0]
|
| [0] https://www.alphr.com/transfer-google-authenticator-codes-
| ne...
| yumraj wrote:
| You can use Authy and install it on multiple
| devices/computers
| Zizizizz wrote:
| Andotp or aegis authenticator are both great open source 2fa
| apps that let you export and backup your 2fa to cold storage
| somewhere incase of these situations
| embeng4096 wrote:
| Yes, ordinary consumers are starting to use TOTP more but still
| may not be aware of what you pointed out.
|
| To mitigate the risk of losing my 2FA credentials I use the
| FOSS app andOTP (Aegis is similar, but better UI, from what I
| hear). It can export your data as both cleartext and encrypted
| JSON so you can import into a new phone as desired.
| ridaj wrote:
| I'm aware of solutions that can help prepare for a backup. I
| don't think most people should trust themselves to handle
| backup responsibilities. Speaking as someone locked out of an
| encrypted disk full of old photos that I carefully wrote down
| the passphrase to on a piece of paper for safekeeping...
| Since then lost.
| missedthecue wrote:
| Don't use text messages as 2FA in the first place.
| andrei_says_ wrote:
| Not up to me in many cases.
| dookahku wrote:
| That's a good idea but it's not a practical solution because
| most websites don't give you the choice.
| greatjack613 wrote:
| I use google voice locked with 2fa like the rest of my google
| account.
|
| And yes, I have never been rejected from a service for using a
| google voice number as my 2fa source. Heck, even my google
| account uses 2fa through the google voice number - as one option
| :)
| drakonka wrote:
| I've never even heard of Google Voice and now feel like I've
| been living under a rock. Could you elaborate on how you use
| this? For example:
|
| * Do you use the same Google Voice number as your actual Google
| account phone number, or just for other sites? If the former,
| how does it work with Google 2FA (ie if you are logged out of
| Google account I imagine you can't access you Voice number
| either?)
|
| * Are you concerned with losing access to your Google Voice
| number if Google decides to ban your account one day? Regular
| phone numbers seem a bit less nebulous in that phone providers
| don't seem to just suddenly decide to ban you and your number
| as much as Google, Amazon, et al. Then again I have no data to
| back up this impression.
|
| * What made you pick Google Voice over another VoIP option?
|
| * Do you worry about Voice going away with Google Fi?
| Sinema wrote:
| Not 2FA per se but Google Voice numbers do not work for certain
| services at all. Zelle is a recent example I ran into but I've
| had others before that wouldn't accept it or would accept it
| but fail silently.
| jrootabega wrote:
| Have a separate sim/phone dedicated to 2fa.
|
| Send test sms to yourself at least twice a day
| b3morales wrote:
| Could you elaborate? What makes the secondary one more secure
| than the first one?
| dmitrygr wrote:
| Nobody knows about it. Sim swappers will attack your number.
| The one they know.
| jrootabega wrote:
| They may be able to bribe phone company employees to look
| you up by name, but you'd at least be blocking one route of
| compromise
| dmitrygr wrote:
| Which company? :)
| jrootabega wrote:
| All of them, probably
| Zircom wrote:
| Having a separate number/SIM solely for 2fa makes it harder
| for attackers to know the number they need to initiate a
| simswap in the first place, since it won't be publicly
| associated with you the same way your normal phone number is,
| like being listed on your LinkedIn or resume, or obtained
| from a social media or other account info leak, or able to be
| socially engineered or phished out of friends/family.
| b3morales wrote:
| All good points, thank you.
___________________________________________________________________
(page generated 2021-12-30 23:01 UTC)