The Most Expensive Lesson of My Life: Details of SIM Port Hack

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by TheChaplain on Tuesday May 21, 2019 @07:49PM (#19976319)

I wish Google, Twitter et al would listen to this, but alas...

[ Parent | on HN ]

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by jdeibele on Tuesday May 21, 2019 @08:04PM (#19976419)

At least Google allows you to turn off SMS as a "2FA" source.

You can set up Google Authenticator (or Authy) and a Yubikey as 2FA sources, then remove your phone number.

Much to my surprise, I was able to do this with PayPal where I set up two Symantec VIP Access IDs and was able to remove the phone number.

I wish I could do this with other accounts.

[ Parent | on HN ]

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by neuralspark on Tuesday May 21, 2019 @07:55PM (#19976355)

Google offers 2FA using TOTP, and has for several years.

[ Parent | on HN ]

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by sneak on Tuesday May 21, 2019 @08:01PM (#19976397)

And U2F tokens, which are even better than TOTP as they are immune to phishing. TOTP codes can be and commonly are phished.

U2F is the current state of the art for 2FA. App/Device-based 2fa (krypton, Google App’s “approve on other device”, authy’s “approve on other device”, keybase, et c) are second.

TOTP is in a lot of ways more trouble than it is worth.

[ Parent | on HN ]

Re:The Most Expensive Lesson of My Life: Details of SIM Port... by codedokode on Wednesday May 22, 2019 @05:11AM (#19979313)

Also physical tokens can be easier to use if the support for them is built into OS and doesn't require installing or configuring additional software.

[ Parent | on HN ]