News for hackers. Stuff that matters.

A comment on Hackers Claim They Breached T-Mobile More Than 100 Times in 2022. Parent comment

Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by koolba on Tuesday February 28, 2023 @02:04PM (#34973384)
They were able to reset your Google password using only the simjacked phone? Or was the password the same as the T-mobile one as well?

It’s hardly a second factor if it can be used to entirely replace the primary one.

[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by delfinom on Tuesday February 28, 2023 @02:08PM (#34973442)
Google still allows you to setup recovery phone numbers unforunately.

https://support.google.com/accounts/answer/183723?hl=en&co=G...

I think years ago I found my number there with no-recollection of every agreeing to it and quickly yeeted it. (You can remove the number but keep recovery email)

[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by gleenn on Tuesday February 28, 2023 @02:46PM (#34973870)
It's subtle with the UI but you can choose not to allow SMS by removing your phone number from Google after setting up alternative 2FA. If they don't have a number they can't sim-jack
[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by mike_d on Tuesday February 28, 2023 @03:00PM (#34974014)
This is one of the most important pieces of security advice that is often overlooked: remove your phone number from EVERYTHING.

You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere.

1. https://landing.google.com/advancedprotection/

[ Parent | on HN ]
Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by lima on Tuesday February 28, 2023 @03:21PM (#34974297)
Big benefit of Advanced Protection: you can go tell less technical users to set it up and it will enforce all these best practices (no SMS, two keys, no giving random apps access to GMail...).
[ Parent | on HN ]