Hacker News Reader

Comment by pmarreck | Hacker News Reader

Geez, it's a good thing I removed cell 2FA from all my accounts after getting hacked (SIM card transfer via social engineering)

View on HN

The problem with Twitter is they don't allow adding more than one security key (like Yubikey, NitroKey etc) per account. Google, FB, Github and almost everyone else who supports security keys does support multiple keys. Without it, I wouldn't disable SMS auth on Twitter, yet (the security key could die at any point, hypothetically speaking; which is why you have a backup or two).

Why wouldn't you just record the authenticator code somewhere?

You can easily generator OTP codes the same as any of the "authenticator" apps using, for example, oathtool [1]

You don't even need the code to be stored on a computer. Just write it down somewhere safe if you're paranoid about getting hacked. The seed codes are usually 16 characters or so.

[1] https://www.nongnu.org/oath-toolkit/oathtool.1.html

You're right, that's exactly what I've got. I'd forgotten the exact setup I have on Twitter. I just checked and I've got a TOTP app (with backup codes on paper) + Yubikey. I'd disabled SMS for 2FA last year, around the time when Jack Dorsey's Twitter account was compromised with a SIM swap attack.

Yes. Anyone who want the protection from the SIM swap attack should remove phone 2FA from their accounts, and should consider accounts that do not support such configuration as vulnerable.

Whether you consider the SIM swap attack a threat worth protecting from would depend on many factors, even though the threat itself is very real, and almost all phone numbers are vulnerable to the attack. I have yet to learn any phone service provider that is not vulnerable to this attack. I've heard people speculating that Google Fi might be one such provider, but I don't know if Fi customer service actually is not vulnerable.

SIM swapping should not be an attack. It's called "Two-factor Authentication", not "OK Whichever Authentication".

It absolutely is an attack. SIM swap is a targeted attack. In a targeted attack scenario, phishing (for id and password) will succeed with high enough probability. Also, the account recovery path often requires only the phone number, effectively making the recovery phone number as the single factor.

I'm remarking on the last sentence of your comment~

>(SIM card transfer via social engineering)

How exactly does this happen?

Impersonate as the client of the phone company and request a new SIM card under the pretense that your current SIM card was stolen/lost.

Or bribe company staff to give you the SIM card.

Phone company staff are error-prone humans just like you and me who in general don't earn well enough for their responsibilities.

Aha! I'm an idiot; I thought this referred to social engineering of the person who owns the handset/SIM, not phone company staff.

That makes a lot more sense. Thanks!

Reply on news.ycombinator.com