News for hackers. Stuff that matters.
Re:Ask HN: Carrier “lost” my number in a port request by ckdarby on Wednesday November 02, 2022 @07:59AM (#33434311)
I doubt it being hundreds of hours.

Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

Moving forward you should look at Yubikey where you can with the backup being your phone via Authenticator app.

Re:Ask HN: Carrier “lost” my number in a port request by jobigoud on Wednesday November 02, 2022 @08:07AM (#33434390)
You can already do backups with Authy but I think OP's issue is for SMS-based 2FA which is still very common.
Re:Ask HN: Carrier “lost” my number in a port request by OJFord on Wednesday November 02, 2022 @08:15AM (#33434482)
> SMS-based 2FA which is still very common

It's not like it's showing any signs of going away either, financial institutions even are newly implementing it.

Re:Ask HN: Carrier “lost” my number in a port request by realgeniushere on Wednesday November 02, 2022 @08:13AM (#33434464)
Don’t you need your phone number to authenticate with Authy to get into the backups?
Re:Ask HN: Carrier “lost” my number in a port request by OJFord on Wednesday November 02, 2022 @08:16AM (#33434491)
No. That might be a possible backup, but the usual way is any current logged-in device + password.
Re:Ask HN: Carrier “lost” my number in a port request by realgeniushere on Wednesday November 02, 2022 @08:17AM (#33434508)
Uhh, if you need a currently logged in device to bypass the phone number login, then I wouldn’t say it’s a “possible backup”. Phone number is the primary authentication mechanism for Authy.
Re:Ask HN: Carrier “lost” my number in a port request by n0mn on Wednesday November 02, 2022 @08:47AM (#33434845)
If you have “Allow Multi-Device” enabled, your keys are stored on Authy’s servers. You simply download Authy on a new device, sign into your account and you are done.
Re:Ask HN: Carrier “lost” my number in a port request by realgeniushere on Wednesday November 02, 2022 @10:23AM (#33436266)
How do you sign into your Authy account? For me, it asks to send an SMS to my phone.
Re:Ask HN: Carrier “lost” my number in a port request by alanbernstein on Wednesday November 02, 2022 @09:17AM (#33435238)
Huh? I use Authy because it allows me to use TOTP codes, from multiple devices, including devices without cell service. I switched to it from Google Authenticator specifically for that reason.
Re:Ask HN: Carrier “lost” my number in a port request by realgeniushere on Wednesday November 02, 2022 @11:20AM (#33437282)
Okay, so how do you sign in to Authy if you don’t have another signed in device handy? I believe the only options are phone call or sms.
Re:Ask HN: Carrier “lost” my number in a port request by jandrese on Wednesday November 02, 2022 @11:15AM (#33437178)
SMS is not suitable for 2FA. It has a massive "help desk" hole that is obnoxiously easy to exploit. SMS is only useful as a proof of stake, IE something you do to initially set up a second factor to prove that you have some skin in the game, but not as the second factor itself. Honestly, even that proof of stake stuff is separate from setting up 2FA, it's mostly about slowing down botnet signups.

There are times where SMS 2 factor is worse than no 2 factor at all. Common number porting attacks allow an attacker to be far more convincing to the support staff when they call to say that they forgot the password but still have access to the second factor.

Re:Ask HN: Carrier “lost” my number in a port request by tsol on Wednesday November 02, 2022 @09:10AM (#33435111)
>Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

I've never heard of this. If I lose my number, can I still regain Google account access by mailing my info in?

Re:Ask HN: Carrier “lost” my number in a port request by weberer on Wednesday November 02, 2022 @09:11AM (#33435138)
No. Google will lock you out forever.