News for hackers. Stuff that matters.

A comment on Looking back at how Signal works. Parent comment

Re:Looking back at how Signal works by walrus01 on Friday June 05, 2020 @08:18PM (#23435528)
One of the other problems with using phone numbers, is that it provides an opening for adversaries. Now they know your phone number, which can be used for social-engineering attacks to attempt to bypass 2FA for any other online services tied to your phone number. Either for 2FA or for account-recovery/i-forgot-my-password functionality. 2FA by SMS is wrong and broken and nobody should use it, but they do.

Adversaries will attempt to social engineer customer service for your phone carrier into issuing them a new SIM or porting out the number, so they can receive verification SMS and phone calls.

[ Parent | on HN ]
Re:Looking back at how Signal works by goatsi on Saturday June 06, 2020 @01:45AM (#23437114)
Signal uses a registration pin to prevent that exact attack.
[ Parent | on HN ]
Re:Looking back at how Signal works by vinay427 on Saturday June 06, 2020 @02:56AM (#23437358)
Maybe I misread, but the GP doesn't seem to be talking about impersonating a user on Signal, but rather impersonating that user on other websites that depend on SMS 2FA sent to their phone number that is now visible through Signal.
[ Parent | on HN ]