Comment by jaden | Hacker News Reader

Comment by jaden | Hacker News Reader

This is frightening. If you're using texts for 2-factor auth you're at the mercy of your phone service provider's customer service. And they're trying to balance being helpful with security, which can be in opposition. Losing $100,000 with no hope of recovery is the kind of thing that could sink many people's finances.

His summary of how to avoid having this happen to you:

  * Use a hardware wallet to secure your crypto
  * SMS-based 2FA is not enough
  * Reduce your online footprint
  * Use Google Voice for 2FA
  * Create a secondary email address
  * Use an offline password manager

> * Use Google Voice for 2FA

I like this idea, insofar as the Voice number is not vulnerable to the SIM port attack.

But then I worry that it's yet-another-thing I'm to my Google account, which Google could always shut down at a moment's notice, with no explanation, and no recourse.

Using Google voice may not do all you had hoped:

https://news.ycombinator.com/item?id=19886705

There may not be a choice. Vanguard refused to log me in until I configured 2-factor SMS.

I would consider that an alarming sign that I need to change investment companies asap (probably after loudly complaining and trying to change it, since Vanguard is somewhat unique).

Fidelity also only uses SMS-based 2FA :-/

Vanguard can work with Yubikeys now.

Vanguard also offers 2FA with voice-automated calls. I wonder, would getting a landline and using that with a Yubikey be any more secure?

https://investor.vanguard.com/security/security-keys

Good list, and I would add using multisig for serious amounts.

Reply on news.ycombinator.com