Hacker News Reader

Comment by pmarreck | Hacker News Reader

I have turned off phone 2FA on all services that permit me to do so after getting hacked by someone using that exploit. Typically I use Google 2FA via Authy or Authy itself

View on HN

> Google 2FA via Authy

"Google 2FA" is TOTP, an open standard, not a Google produced solution.

https://tools.ietf.org/html/rfc6238

Thanks for the clarification. I knew it was open-source, didn't realize it was an RFC.

you should be aware that Authy can by default be taken over with just your sim card. I believe with the right settings you can disable this behaviour

Yes, you have to disable “multiple devices”. You just have to remember to re-enable it if you want to install Authy on a new phone and reinstall from backup.

I've been considering getting a second, secret SIM card exclusively for use with services where SMS 2FA is the only option.

I've been using Google Voice for that purpose for years, and it has been perfect. The phone number that is for 2FA only, shouldn't be as easy to social engineer your typical telcom, since it is all controlled from within my Google account, and I get immediate security notifications if something fishy is up.

That's a great plan, and it definitely reduces your risk to being exposed to SIM hijacking. Unfortunately, I suspect services that enforce poor security standards are probably not following best practices in their backend either. This means your secret number stops being secret if their database ever leaks.

It's still better than using the same number as you use for everything else, but it's important to understand the caveats.

This is standard practice for public figures like YouTubers who often get griefed

Reply on news.ycombinator.com