News for hackers. Stuff that matters.
Re:Google is going to turn on 2FA by default by bagels on Saturday May 08, 2021 @12:34PM (#27088608)
I don't enable it because of the social engineering attacks against mobile carriers, tricking them to hand out SIM cards to crooks.
Re:Google is going to turn on 2FA by default by JimDabell on Saturday May 08, 2021 @12:40PM (#27088671)
Enabling SMS 2FA doesn't make your account less secure. At worst, if somebody targets you with SIMjacking, it simply doesn't make you more secure.

If you don’t have 2FA enabled for your account, you are in the least secure position compared with enabling any 2FA method.

Either way, there’s no need to use SMS for 2FA with Google, they support many other forms of 2FA.

Re:Google is going to turn on 2FA by default by PeterisP on Saturday May 08, 2021 @01:02PM (#27088879)
Often enabling SMS 2FA also enables SMS as a password reset option, which does make you less secure, since SIMjacking is easier than guessing a reasonable not-reused password.
Re:Google is going to turn on 2FA by default by fr2null on Saturday May 08, 2021 @01:27PM (#27089101)
If that is the case though, you are not really enabling SMS 2FA. It is just SMS (1F) authentication.

Real 2FA would (theoretically) never make your account less secure than 1FA, because even if the second factor has 0 security, it shouldn't decrease the security of the first factor.

However, it is true that this may not always be the case for imperfect implementations, like your example. I can aldo imagine that social engineering might have a higher succes ratio if the intruder can say "it really is me! I have the correct second factor, I just lost my first factor...".

Re:Google is going to turn on 2FA by default by CarelessExpert on Saturday May 08, 2021 @01:24PM (#27089064)
With Google you can disable SMS-based account recovery independent of your 2FA options.
Re:Google is going to turn on 2FA by default by GhostVII on Saturday May 08, 2021 @12:44PM (#27088710)
I think Google actually allowed you to just use your phone number to recover your account, so it was effective 1FA. In that case it would be less secure. They might have changed it now though.
Re:Google is going to turn on 2FA by default by CarelessExpert on Saturday May 08, 2021 @12:38PM (#27088649)
Which is irrelevant given Google uses a combination of TOTP, and for connected Android phones or iOS devices running certain Google apps, a confirmation prompt on the phone.
Re:Google is going to turn on 2FA by default by remus on Saturday May 08, 2021 @12:42PM (#27088691)
SMS based 2SV is just one option, there are many better methods you can enable for a google account.
Re:Google is going to turn on 2FA by default by danuker on Saturday May 08, 2021 @12:38PM (#27088647)
I recommend andOTP downloaded from F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/
Re:Google is going to turn on 2FA by default by boromisp on Saturday May 08, 2021 @01:19PM (#27089020)
An other option: Aegis Authenticator https://f-droid.org/packages/com.beemdevelopment.aegis
Re:Google is going to turn on 2FA by default by CarelessExpert on Saturday May 08, 2021 @12:48PM (#27088753)
Also for the desktop I just use KeepassXC with my TOTP creds in their own database.
Re:Google is going to turn on 2FA by default by twobitshifter on Saturday May 08, 2021 @09:48PM (#27092437)
Isn’t switching between two databases a hassle?
Re:Google is going to turn on 2FA by default by ysangkok on Sunday May 09, 2021 @01:24AM (#27093458)
No, KeepassXC provides a "Recently used databases" listing, so the effort required is 2-3 clicks and a password prompt.
Re:Google is going to turn on 2FA by default by CarelessExpert on Sunday May 09, 2021 @11:34AM (#27096818)
You can have more than one database open at a time.
Re:Google is going to turn on 2FA by default by forgotpwd16 on Saturday May 08, 2021 @07:29PM (#27091757)
In my country I've been required to go with my ID to a carrier shop to get a new SIM. How does that work elsewhere?
Re:Google is going to turn on 2FA by default by tialaramex on Sunday May 09, 2021 @02:10AM (#27093653)
Even if your carrier actually enforces such a policy, the actual implementation is trusted to that part-timer on minimum wage you showed the ID to. They push "OK" on the ID check step, and it's done.

What do you suppose happens when the hot guy in the club who bought them and all their friends a round of drinks says they can make a month's salary in ten minutes if they allow a few of his mates to skip that "annoying" ID check?

And I'm sure that afterwards, once the carrier figures out who was responsible, they'll get fired. But meanwhile your accounts were taken over and leveraged for some scam or (if you own "cool" things like a short Twitter handle or that rare drop in a video game) sold to the highest bidder.

Re:Google is going to turn on 2FA by default by ztcfegzgf on Sunday May 09, 2021 @02:40AM (#27093781)
you do realize that the same can be done for a bank-account, right?

at the end of the day someone is sitting at a computer and given an id-card from a stranger and clicking the "yes, i verified their id card".

Re:Google is going to turn on 2FA by default by tialaramex on Sunday May 09, 2021 @08:13AM (#27095352)
The bank account is the responsibility of the bank, the employer of these "strangers" you're talking about.

Whereas, of course, the reason we're discussing SIM attacks isn't that some bad guys might use your monthly download credits, or make a phone call that you pay for (the phone company would of course undo these charges once it was apparent that their employee caused the problem) but instead that this can be leveraged to gain access to all sorts of accounts your phone company has no responsibility for whatsoever.

The security was totally appropriate for the scope in which it was intended to be used, but that doesn't make it magically appropriate for all possible scopes.

Re:Google is going to turn on 2FA by default by reaperducer on Saturday May 08, 2021 @07:54PM (#27091900)
In some countries you can buy a SIM card, or even a dozen SIM cards, with no more hassle than buying a loaf of bread.