News for hackers. Stuff that matters.

A comment on Listen to a SIM-Jacking, Account-Stealing Ransom. Parent comment

Re:Listen to a SIM-Jacking, Account-Stealing Ransom by joewee on Thursday October 11, 2018 @02:29PM (#18195905)
Many of these services, I believe google is one, still require mobile phone as a fallback option.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by nobodyshere on Thursday October 11, 2018 @04:31PM (#18196809)
Google requires at least 2 ways of 2fa protection. You can enable a third one and disable the phone completely.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by jandrese on Thursday October 11, 2018 @07:47PM (#18197961)
Requiring the phone number is mostly an anti-bot/spammer measure. Once they've seen your phone number you don't need to let them use it anymore.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by seppin on Thursday October 11, 2018 @02:45PM (#18196025)
Paypal, an actual bank, still only allows SMS 2fa. It's stupid.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by Avamander on Thursday October 11, 2018 @03:05PM (#18196173)
Wrong. TOTP is supported, although hidden.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by jdeibele on Thursday October 11, 2018 @04:55PM (#18196959)
https://www.paypal-community.com/t5/Tips-from-Moderators/Pay...

It uses Verisign's VIP app instead of Google Authenticator (or Authy or whatever).

[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by Avamander on Friday October 12, 2018 @02:36PM (#18203639)
You can use any TOTP app.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by seppin on Thursday October 18, 2018 @12:59PM (#18250008)
It's not hidden, it's de facto disabled for 99% of users. Fix this, Paypal.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by npunt on Thursday October 11, 2018 @05:59PM (#18197363)
According to some threads I've read it doesn't work in all circumstances.

Personally I wouldn't risk it since it could mean risking getting locked out of your account.

[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by Avamander on Friday October 12, 2018 @02:38PM (#18203647)
I've been using it for a few years now and I haven't encountered a place where I couldn't use it. It might force you to enter the TOTP code at the end of your password though, but it works.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by rafaelm on Thursday October 11, 2018 @07:33PM (#18197882)
And even this option is not available in all countries. I've almost stopped using Paypal completely because of this.
[ Parent | on HN ]