Hacker News Reader

Comment by Rjevski | Hacker News Reader

Pretty nice read, and I too am curious about how these hackers manage to steal handles, especially the part where the hacker himself admits that there are others out there who want to steal that handle - isn't basic security (no malware, secure email password and 2FA) sufficient?

View on HN

A hacker stole my IG account. They found my phone number then called AT&T in the dead of night and convinced them to forward my number to a Google Voive account. Then they contacted my web host and used the number to verify it was “me”. From there they had everything they needed.

That is terrifying. How can you prevent someone from being able to do this?

Maybe don't submit your cell phone number as your official contact? Submit a number that is less prone to social engineering changing it, like a VoIP provider number that has no live human support.

I don’t know how they got my number. AT&T said I should have a verbal passcode one the account AFTER the damage was done. That would have been helpful for them to mention when I set up the account. Or you could buy a prepaid burner and use that.

If you use 2FA through an app instead of receiving text messages (assuming the service in question supports this) that would limit the ability to use the social engineering angle.

A proper mobile provider. Failing that, don't use your phone number for anything security-related (no SMS 2FA, etc).

Reply on news.ycombinator.com