T-Mobile Database Breach Exposes 2M Customers' Data

Re:T-Mobile Database Breach Exposes 2M Customers' Data by hippich on Tuesday August 28, 2018 @11:02AM (#17859303)

Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms "two factory" authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can't provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by acomar on Tuesday August 28, 2018 @11:09AM (#17859363)

There are a few sites that won't accept this and won't even accept a Google Voice/VOIP number because they do some kind of check. Very frustrating.

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by r00fus on Wednesday August 29, 2018 @12:49AM (#17865725)

Can you provide a number (i.e. POTS) that has no SMS capability?

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by gowld on Tuesday August 28, 2018 @11:31AM (#17859580)

What's the point of having a lock (OTP) if the lock is removed upon an attacker's request?

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by inetknght on Tuesday August 28, 2018 @11:49AM (#17859727)

SMS is not two factor authentication, no matter what ISPs or websites tell you.

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by chayesfss on Tuesday August 28, 2018 @11:53AM (#17859762)

Actually it is a form of 2fa, might not be one you like but it’s better than 1fa or kba which is double single factor

[ Parent | on HN ]

Re:T-Mobile Database Breach Exposes 2M Customers' Data by weej on Tuesday August 28, 2018 @12:09PM (#17859925)

Agreed. Although poor security with easy hijacking, it's still a form of 2FA. Even NIST doesn't recommend it as a factor to use for authentication.

[ Parent | on HN ]