Hacker News Reader

Comment by pram | Hacker News Reader

How do you even mitigate sim swapping attacks? I’m getting super paranoid from all the recent news but it seems like you literally can’t do anything about it because the phone companies are so shitty lol

View on HN

Don't give services your phone number. Refuse to use services that demand your phone number.

Twitter has been a gigantic PITA about this. Consequently, I have to use nitter for everything. To be fair, I think I come out ahead, actually.

Companies need to start being fined real money for losing PII (personally identifiable information). Once the idea of holding PII translates into "This might cost us $100 million" companies will stop keeping PII.

Use TOTP instead of SMS.

Passkey will be helpful in this regard.

https://developer.apple.com/videos/play/wwdc2022/10092/

My understanding of passkeys is simple but how is this different to any of the password managers right now? I use 1password which generates unique passwords and on all my devices already, and has done for over a decade at this point.

Answers to these questions can be found at https://support.apple.com/en-us/HT213305

Use a second SIM+number exclusively for all 2FA that is not publically known (ie, not shared with friends or family or used for chat apps). They can't really SIM swap you if they don't know your number.

That doesn't help if the attackers manage to social-engineer telcos using other public information such as your name.

Yes. It does make it much harder though. They'd have to try every telco. Bonus points for using an online/obscure telco or sms relay.

Still vulnerable to a breach that exposes user data at any one of the services you've signed up for, unless you use a separate SIM for each.

SIM Lock. My iPhone has a physical AT&T SIM that i lock. I don't want it to be an esim yet so I can swap it to a different phone which will prompt me for a PIN to unlock it.

Wrong type of sim swapping. What I suspect they are talking about is when someone uses social engineering to convince your phone provider to swap your account (and the phone number attached to it) to another sim. They then perform the SMS recovery/2fa method.

Often the first you know about it is when you realise that your phone have been disconnected from the network.

> How do you even mitigate sim swapping attacks?

Google Voice.

Which won't work for many regions, and Google Voice numbers are blocked from a LOT of services—including PayPal which, lol, requires you to be authenticated to talk with support about issues of authentication (needless to say, I've refused to use them ever since).

Looks like I got lucky too. I went to check my account and my number needed to be reactivated. I used a free service to "verify my number" (because I don't have a US number, and would prefer not to hand it to Google anyhow) to get back the number I had had. I wouldn't be shocked if this continued as people are "abusing" the service--which is nightmare because of how many services still require a phone number despite it being known as a security issue for SMS and when it requires a US number and you are an expat, you're pretty screwed.

Google Voice randomly (?) disappeared my GV number I'd used for this purpose for over a decade -- or perhaps someone swapped it out. It's not clear to me.

My GV account still contains VMs and missed calls up to a date, then nothing since. But the account remains active.

> Google Voice

Q: How do you avoid your personal data being hoovered up by advertisers?

A: Route all your personal communication through the largest advertising agency in the world.

Nuts to that.

Also, only available in the US.

That does not seem to be the threat model for 2FA though

Imagine the panic when you realize Google reclaimed your number for inactivity because you haven't been sending texts or making calls, only receiving them, and you missed the couple of emails notifying you about the change. Now your number is under some random person's control.

Until Google cancels you free Gmail account because you were doing academic research in Google Docs about a topic that is on a “bad words” list written by some activist employee somewhere.

No support to get your Voice number back

Don't use SMS 2FA

You are still fairly resistant to sim-swapping in this case because they also need your password. The real concern with sim-swapping is password resets via sms.

Reply on news.ycombinator.com