News for hackers. Stuff that matters.
Re:US SEC blames 'SIM swapping' for its X account hack by kevincox on Tuesday January 23, 2024 @09:17AM (#39103546)
This is one of the reasons that I try to avoid giving companies my number. I'm always worry that they will decide that it is a valid recovery mechanism for my account. (Either that it is required locking me out or that it is sufficient allowing takeover)
Re:US SEC blames 'SIM swapping' for its X account hack by lupire on Tuesday January 23, 2024 @09:34AM (#39103792)
Which worse? Your SIM as an alternate password, or public information about you being your alternate password? ("Security" questions and "identity verification")
Re:US SEC blames 'SIM swapping' for its X account hack by saurik on Tuesday January 23, 2024 @11:16AM (#39105324)
You don't have to give true answers to security questions, FWIW.
Re:US SEC blames 'SIM swapping' for its X account hack by dseGH3FETWJJy on Tuesday January 23, 2024 @11:59AM (#39106045)
Yep. All of my answers are GUIDs that I keep track of in 1Password.
Re:US SEC blames 'SIM swapping' for its X account hack by joshuaissac on Tuesday January 23, 2024 @01:51PM (#39107822)
I have read a suggestion that one should pick real (but randomly generated) words because, where it is possible to call the company that maintains your account, an attacker might claim that the recovery answer is a series of random characters, and there is a chance that the employee will accept this and allow the attacker access to the account.
Re:US SEC blames 'SIM swapping' for its X account hack by bonton89 on Tuesday January 23, 2024 @01:52PM (#39107837)
I thought this was a good strategy too until some one said that a customer service rep once asked him one of the questions over the phone and, lacking his backed up security questions at hand, he just said "it is a bunch of random characters" and was let through...

Probably the best bet is using a passphrase here but it might not be fool proof.

Re:US SEC blames 'SIM swapping' for its X account hack by xur17 on Tuesday January 23, 2024 @02:36PM (#39108529)
I've started to make up answers that could be accurate, but aren't obvious / the first thing someone would guess. For example, if the question is "where were you born?", I pick a random city.
Re:US SEC blames 'SIM swapping' for its X account hack by Am4TIfIsER0ppos on Tuesday January 23, 2024 @04:11PM (#39109903)
How about no alternatives? The password being the only authentication mechanism.