News for hackers. Stuff that matters.

A comment on Hackers Claim They Breached T-Mobile More Than 100 Times in 2022. Parent comment

Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by bogomipz on Tuesday February 28, 2023 @01:42PM (#34973118)
Interesting. Was your 2FA setup to use Google Authenticator or regular SMS? It's been a while since I used Google services but from what I recall from a previous company where we used Gmail was that the only way to do 2FA with Google Authenticator if you lost access to the phone was with a backup code you are given at 2FA setup time. Is that no longer the case?
[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by ctvo on Tuesday February 28, 2023 @01:48PM (#34973192)
2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out?

Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by danso on Tuesday February 28, 2023 @02:07PM (#34973429)
Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it.

Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings

https://support.authy.com/hc/en-us/articles/360012427914-Is-...

[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by askiiart on Tuesday February 28, 2023 @04:12PM (#34974929)
SMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.
[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by konha on Tuesday February 28, 2023 @04:15PM (#34974949)
Your OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds.

I’ll agree though that Authy’s docs are really ambiguous about account recovery.

[ Parent | on HN ]