T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don't use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I'd spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue.

https://www.t-mobile.com/offers/t-mobile-digits

Not to mention digits SUCKS.

My wife used this for her business since it was free at the time. It cost her literally thousands of dollars of missed/unconnected calls and dozens of hours of customer service.

Is there any way to turn off Digits?

Reminds me of this:

https://www.ccn.com/bitcoin-investor-sues-att-for-224-millio...

https://cointelegraph.com/news/california-police-arrest-teen...

Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms "two factory" authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can't provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.

There are a few sites that won't accept this and won't even accept a Google Voice/VOIP number because they do some kind of check. Very frustrating.

Can you provide a number (i.e. POTS) that has no SMS capability?

What's the point of having a lock (OTP) if the lock is removed upon an attacker's request?

SMS is not two factor authentication, no matter what ISPs or websites tell you.

Actually it is a form of 2fa, might not be one you like but it’s better than 1fa or kba which is double single factor

Agreed. Although poor security with easy hijacking, it's still a form of 2FA. Even NIST doesn't recommend it as a factor to use for authentication.

That's bad but at least they checked. Apple recently swapped out a phone for me at the store. The genius called Sprint and they activated the new phone on my Dad's line without asking me for ID or my account code.

Imagine if this were to happen to a journalist or politician. The stakes are quite high.

Honestly, I think one of the best things to happen for the rest of us is for a prominent Senator to have this happen to them. Then hopefully we'd get some legislation holding these companies responsible when they do that.

I remember this being a common tactic to break in to youtube/twitter accounts with 2FA enabled a few years back, really shocked its still going on.

Do they actually support third party 2FA for their customers?