News for hackers. Stuff that matters.

A comment on The FastMail Security Mindset. Parent comment

Re:The FastMail Security Mindset by ghouse on Tuesday December 05, 2017 @03:16PM (#15855380)
No, I did not. And I certainly should have.

However, 2fa would not have prevented the problem. The problem is twofold -- 1) account recovery (using email, SMS, or anything other than a secret key) is an effective attack vector. Especially SMS. 2) a human who will change the account recovery settings (in my case, FM changing the account recovery email address).

[ Parent | on HN ]
Re:The FastMail Security Mindset by nvarsj on Tuesday December 05, 2017 @03:32PM (#15855543)
Hmm you think they would have bypassed your 2fa as well? I wonder if FM can comment on that - it would be concerning. The "sms backdoor" is the same with gmail, etc. unless you explicitly disable it.
[ Parent | on HN ]
Re:The FastMail Security Mindset by brongondwana on Tuesday December 05, 2017 @06:01PM (#15856929)
Our account recovery process won't allow you through at all if you lose your password, and your 2FA, and your recovery key, then you're not getting that account back.
[ Parent | on HN ]
Re:The FastMail Security Mindset by soufron on Tuesday December 05, 2017 @03:48PM (#15855782)
What is the sms backdoor?
[ Parent | on HN ]
Re:The FastMail Security Mindset by rbritton on Tuesday December 05, 2017 @03:55PM (#15855864)
Probably this [0]. They can get phone companies to issue a SIM for your number, which will then receive the SMS reset or 2FA code.

[0]: https://www.wired.com/2016/06/hey-stop-using-texts-two-facto...

[ Parent | on HN ]
Re:The FastMail Security Mindset by snowpanda on Tuesday December 05, 2017 @07:43PM (#15857597)
Sim swapping:

http://www.fraud.org/sim_swapping_alert

[ Parent | on HN ]