Re:SMS phishing is way too easy
by remuskaos on Friday June 24, 2022 @05:02PM
(#31869263)
I think one common way to "bypass" 2FA is to have the carrier send you (the attacker) a second SIM card. If I'm not misremembering, the text message is then delivered to both cards, the original holder and the attacker. So sending two numbers would not defend against this type of 2FA bypass.
[ Parent
| on HN ]
You are right, a duplicate SIM will stop the two-number method described from adding any protection.
But it will still protect against the fake messages like the ones being discussed here, and if someone has a duplicate SIM you are buggered in a number of other ways too.
Though this method, and several others that are effectively the same, only offers any protection if the user has the ware-with-all to bother verifying the other number. Unfortunately that means that in many cases it won't help at all because many would not be aware of the other number and expect to find it when the fake messages come in - unless the user knows to expect and require it the fact a fake message doesn't have it makes no difference.
Re:SMS phishing is way too easy
by MauranKilom on Friday June 24, 2022 @07:44PM
(#31870935)
> ware-with-all
The word you're looking for is "wherewithal", I believe.
Werewithal (or werwithal) forthcoming dictionary definition: transformational withal, typically during a full moon, though it regularly manifests in Hacker News posts, causes not yet fully determined. The withals can be complex.
If that happens though you are screwed no matter what they do. The above does sound like a big improvement though and is sort of like what Google does when you turn on advanced protection and it occasionally will ask you to match the number on your computer screen to the one on your phone