News for hackers. Stuff that matters.

A comment on Personal information and ads on Twitter. Parent comment

Re:Personal information and ads on Twitter by majewsky on Wednesday October 09, 2019 @04:58AM (#21201345)
> But you can also gain back a phone number

...at which point the attacker has already taken over all your important online accounts and changed them to a different phone number.

[ Parent | on HN ]
Re:Personal information and ads on Twitter by laughinghan on Wednesday October 09, 2019 @01:50PM (#21205814)
Not without your password. The comment I was replying to specifically referred to the phone number as a 2nd factor. This excludes services like Twitter where a phone number can be the sole factor used to reset your password (which is awful security, obviously).

Also, you're specifically talking about SIM-jacking. The vast majority of people have upgraded phones, or broken or lost and then replaced a phone, far more times than they have been SIM-jacked. What do they do about their TOTP tokens in those scenarios?

[ Parent | on HN ]