Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by potatolicious on Monday June 12, 2017 @02:12AM (#14535439)

Not to mention you lose your Authenticator if you upgrade/lose/break your phone, but U2F keys are (practically) forever.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by tokenizerrr on Monday June 12, 2017 @07:36AM (#14536430)

    adb backup com.google.android.apps.authenticator2

all the codes are stored in the sqlite3 database which you can open with standard command line tools.

there are also more user friendly backup apps such as helium, but adb works quite nicely.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by discreditable on Monday June 12, 2017 @03:08PM (#14540079)

Last I checked, adb backup doesn't backup the secrets. Has that changed?

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by tokenizerrr on Monday June 12, 2017 @04:04PM (#14540605)

I don't know but I've been using this technique for a year or two now with great success. The Google authenticator just stores its secrets in the salute db every app gets.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by tokenizerrr on Monday June 12, 2017 @07:36PM (#14541987)

Autocorrect kicked in there... sqlite* (it is absurdly difficult to put an asterisk at the end of a message on HN. it seems to require a trailing whitespace[1] for it to show up, however the input is trimmed, so...)

[1] https://news.ycombinator.com/formatdoc

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by discreditable on Tuesday June 13, 2017 @11:27AM (#14545482)

Have you tried a restore on a factory-reset device?

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by tokenizerrr on Tuesday June 13, 2017 @11:50AM (#14545699)

I have not, but I have extracted the backup with https://sourceforge.net/projects/adbextractor/ and inspected the contents, visually confirming the secrets are there. Even if a restore doesn't work, I can re-enter them manually from the information in the sqlite database. However I fully expect a restore to work.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by davchana on Monday June 12, 2017 @02:56AM (#14535548)

Thats exactly why I copy and save every 2fa QR Code in my KeePass database, along with backup codes. Phone changed? No worries, install Google Auth, rescan those QRs, and voila, your 2fa system is back and running !! :)

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by ArlenBales on Monday June 12, 2017 @07:44AM (#14536460)

Most 2FA services that allow authenticators offer recovery codes. I keep the recovery code saved in my password manager, and if I ever lost my phone I use that to log into the site and then get a new QR code.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by davchana on Thursday June 15, 2017 @07:27AM (#14559355)

Yes, that's also a way, but why not save the QR code first time you see it, instead of loosing it, resetting with recovery code, and then again getting a new one? Recovery codes are fine, and should be kept safe and such, but also the Original QR code can also be saved and screenshot. That way, phone lost? open database, load QR code, scan in new phone.

[ Parent | on HN ]

Re:Hackers Are Hijacking Phone Numbers and Breaking into Ema... by FabHK on Monday June 12, 2017 @04:57AM (#14535911)

Authy allows multiple devices (and encrypted backups) - that ensures fairly good security (if good password is chosen) and availability, doesn't it?

[ Parent | on HN ]