Hacker News Reader

Comment by ctvo | Hacker News Reader

2FA on everything. No password reused. Only similarity is both had the T-Mobile number attached to them.

I initially thought only Amazon was compromised. I thought it was due to us throwing away a FireTV device (assumption: we didn't log out and de-register) that was then used to order items.

And then I found they added filters to my Gmail account to hide the Amazon orders, and went into full panic mode.

View on HN

So both were compromised through TMobile sim swap, which was the backup for not having access to your 2FA?

I wonder then what the point is of having 2FA at all if you can just click a few buttons to bypass them with an SMS.

Were you specifically targeted in any way that would make the attackers go find your phone number and perform the swap?

Wouldn’t this still mean they cracked your gmail password? Or am I not understanding how this was executed?

Interesting. Was your 2FA setup to use Google Authenticator or regular SMS? It's been a while since I used Google services but from what I recall from a previous company where we used Gmail was that the only way to do 2FA with Google Authenticator if you lost access to the phone was with a backup code you are given at 2FA setup time. Is that no longer the case?

2FA with authenticator. As someone correctly points out, Google appears to keep SMS as a recovery option unless you specifically opt out?

Edit: I can't actually find a help article, but it's under "Try another way to sign-in" and they'll text you a verification code to your registered account phone number.

Just noticed that Authy’s answer to the FAQ of “ Is the Authy App Susceptible to a SIM Swap?” does not have the word “No” in it.

Does anyone know if Authy uses SMS for any kind of recovery? I don’t see an option in the security settings

https://support.authy.com/hc/en-us/articles/360012427914-Is-...

SMS is just used to sign in. Everything is encrypted, and you can't access any data without a password. If you don't have the password, you don't get the data. There is no recovery.

Your OTP secrets should be e2e encrypted if you set up a backup passphrase. Worst case: someone can download your encrypted seeds.

I’ll agree though that Authy’s docs are really ambiguous about account recovery.

Reply on news.ycombinator.com