News for hackers. Stuff that matters.

A comment on Companies must stop requiring people to link their phone numbers. Parent comment

Re:Companies must stop requiring people to link their phone ... by j0ba on Thursday February 18, 2021 @09:03AM (#26179885)
OTPs are great, until someone calls up your phone company and social engineers their underpaid support staff into giving them control of your phone number.

This is not speculative. I've literally had to help relatives with this exact security breach.

Using phone numbers for 2FA is insecure for that very reason. You are entrusting all your personal security with the phone company. Using a OTP by phone number as your only authentication factor is much less secure than a password + 2FA.

An authenticator app, such as Authy, faces none of those security issues.

[ Parent | on HN ]
Re:Companies must stop requiring people to link their phone ... by ramraj07 on Thursday February 18, 2021 @09:38AM (#26180224)
I'm presenting the thesis that this system works in places like India and Brazil. I don't have data on my hand that such number transfer social engineering hacks are possible/prevalant here, do you have any?
[ Parent | on HN ]
Re:Companies must stop requiring people to link their phone ... by jwandborg on Thursday February 18, 2021 @11:12AM (#26181614)
"here" is relative. Here's one data, this one from Canada: https://youtu.be/LlcAHkjbARs at 3:48
[ Parent | on HN ]
Re:Companies must stop requiring people to link their phone ... by ramraj07 on Thursday February 18, 2021 @08:24PM (#26188308)
Seems like it's a problem in countries where companies bend over backwards to appease customers, also including when they shouldn't. In other places the agent will just go you're SOL if you called asking to change ownership.
[ Parent | on HN ]
Re:Companies must stop requiring people to link their phone ... by httpsterio on Thursday February 18, 2021 @10:13PM (#26189182)
Very untrue, it's a pretty common way of stealing social media accounts like Twitter and YouTube accounts. Happens all over the place, definitely in places like USA.
[ Parent | on HN ]