Hacker News Reader

Comment by dado3212 | Hacker News Reader

Is there anything you can do to prevent this? Does Verizon have an option to lock your account against SIM swapping attempts without heightened security procedures (OTP, etc?)

View on HN

I gave up trying to solve this at the mobile operator level, they don't care, they don't get fined/sued enough and legislators are too incompetent/slow to fix this.

I just never use any service that forces 2FA by SMS. If it not avoidable for some reason, I make this account completely isolated from the rest of my online identity (new email just for it, regularly change password).

If your bank/financial institution forces 2FA by SMS, it is time to change, most of the serious ones have their own app that handles 2FA. I'm yet to find one that allows to use your own OTP generators, so I'm usually forced to use their app for now.

This is the happy path imho. Mobile providers cannot be trusted to be reliable identity providers.

The attack in the article had zero mention of SMS 2FA.

They swapped the sim to get access to credit card fraud alerts, delivered via SMS.

My CC company sends fraud alerts via email as well as SMS. They all should.

If they used SMS to identify the customer, isn't it a form of authentification? Having the credit card/credit card info is the first factor and the second factor seems to only have been being able to receive the SMS to confirm it wasn't fraud.

I've experienced better banking apps which did use SMS at the initialization, but coupled it with other identifying factors (eg the phone IMEI or a code sent through postal services). If these app needed to be reinstalled the whole verification process would have to be redone.

I don’t think there are any banks in the Us that use Authenticators to enforce 2FA. Although I have seen Robinhood does app based 2FA.

App-based 2FA is offered for both checking and investment accounts at Fidelity, Schwab, and E-Trade. (The common factor is that these are all brokerages first, and banking providers second.) There may be others, but those are the ones I know of.

I think switching to Google Fi seems to be the best option we have right now with respect to any sim swap attacks. Fi doesn’t have physical stores and it’s associated with my Google account which I can secure using non SMS based 2FA options. Unfortunately Fi is also a liability in the sense that Google can kill my account any time.

Maybe you know something I don't, but switching to an entirely-virtual provider in response to a difficult-to-execute physical threat seems a bit misguided to me.

Google also has notoriously nonexistent customer service. It does not instill confidence that anyone should rely on them for something as critical as identity management. The threat of them fucking you over when you need their help far outweighs the threat of hackers and scammers.

(Virtual money was supposed to be more secure than physical coin. That experiment didn't work so well either.)

It doesn’t seem that difficult-to-execute if the attack is targeted. Google Fi is known to have pretty good customer service, unlike rest of the free Google products. Again, considering everything, I came to the conclusion that Fi is the best option for me right now. YMMV.

Google Fi’s implementation of verification also seems more robust and secure: https://support.google.com/fi/answer/9834243?hl=en

I think no tech support is the only real defense against SIM swap.. Then you need other redundancies that are equally impervious to social attack to be able to withstand a lock out from one of them. Actual security is a real pain, pretending you have it while having a tech support that can bypass it isn't nearly as painful and gives the same sense of security until it is tested.

Ok, that's pretty funny. Neglect-as-a-service!

No customer service is the removal of that specific attack vector

Use prepaid and don't associate your real name with your cellular account, which has a multitude of privacy benefits as well. Verizon will let you set a six-digit PIN which you can use instead. Also, stop using SMS-based MFA.

I would love to stop using SMS-based 2FA, but nobody really has any agency in that decision if a service they rely on doesn't care to switch away.

Reply on news.ycombinator.com