News for hackers. Stuff that matters.
Re:Personal information and ads on Twitter by kevin_thibedeau on Tuesday October 08, 2019 @07:13PM (#21198303)
What happens when you have a "proper" second factor and lose it?
Re:Personal information and ads on Twitter by danShumway on Tuesday October 08, 2019 @07:24PM (#21198384)
The consequences of getting locked out of my bank account because I've lost my 2FA method are pretty bad -- that would be a major inconvenience.

They are better than the consequences of getting locked out my bank account because someone stole my phone number -- especially since the first thing someone who SIM-swaps will do is change the recovery number to point to a separate phone they own. I'll have to go through the exact same recovery steps, just with the added pressure of having money siphoned from my account.

Most 2FA app setups come with one-time backup codes that you can write down in paper and stick inside a safe or your wallet. If you don't think customers will do that, and you're still worried about account recovery, using email instead of SMS is preferred. For all the crap I regularly give Google, their security team is top-notch, and I generally trust most people's Gmail accounts to be more secure then their phone numbers.

The only scenario I can think of where a service couldn't rely on email for account recovery is if you yourself are an email service like Fastmail.

Re:Personal information and ads on Twitter by koolba on Tuesday October 08, 2019 @07:52PM (#21198549)
A big difference is your bank (likely) has a physical branch where you could show up with your ID card, debit card, etc. the inconvenience can be addressed directly if there’s an emergency.

For online only businesses there’s no escape hatch.

Re:Personal information and ads on Twitter by danShumway on Tuesday October 08, 2019 @08:01PM (#21198597)
In my specific case, I use an online-only bank. But I'm being petty with that objection, my bank still has enough information about me that I could verify my identity via a combination of a scanned ID card, proof of residence, etc... In general, point taken, that's a good distinction for most people.

However, substitute 'bank' out for any online-only service and the problem persists, because any reasonably smart attacker who SIM-swaps my account will still immediately change the phone number to point to themselves. If my Amazon account gets hacked, and the attacker goes into account recovery and changes the phone number, Amazon still needs a non-SMS based escape hatch for me to get the account back. The problem hasn't gone away.

So why not just use the non-SMS escape hatch all the time?

In Amazon's case, if they don't have your phone number they'll do account recovery over email. That's almost strictly safer, and just about as convenient as SMS.