Been reading a lot about folks getting SIM swapped lately. We posted this SIM-swap horror story a few days ago, and followed up with this story on the strategy that other countries are using but that the US is not.
Came across the headline linked post from Tony Sheng. An interesting read, wondering if it’s simply alarmist or insightful.
In a nutshell, Tony got SIM-swapped and went into great detail on the process and what he did to minimize harm. His highest priority:
Disassociated my phone number from my email address. If you connect your phone number to your email, then a hacker with your phone number can reset your password and take over your email address.
Once they have your email and your phone number, they can reset passwords on pretty much all your accounts for which you don’t have physical 2FA (like a Yubikey).
Step 1 is far and away the most important. If you haven’t done this yet. Stop reading and do it now.
Not sure how you do that. Do you use a secondary email address for verification? YubiKey is a hardware dongle. Secure, but not convenient.
Opinions on this? Please tweet at me with how you solve this problem.
Use Google Voice for those cases where SMS is the only or is the last ditch 2FA method. The corresponding Google account should have 2FA enabled using an authenticator app (like Authy) and preferably also a YubiKey.
I use my own domain for email. None of it is tied to my phone number – not the domain registration, DNS service, or mail service (all different providers). Additionally, every single company or organization I do business with gets its own unique email address at my domain for correspondence (that part’s not hard to figure out; it’s usually companyname@mydomain.com).
Still, many websites infuriatingly use the phone number as a poor 2-factor authentication method, or worse, as a password reset option. I should definitely look into seeing if I can remove it from some of those; I already know some of my banks won’t let me do that, because they require the phone number for that purpose (and don’t offer authenticator app-based 2FA).
Am I missing something? I’m not sure where your confusion lies. I use Authy or some other similar third party authentication app to generate the 2-factor codes required to log into my email.
Is there something I am not seeing in your question?
Easy. Just use Authy to authorize your main email. The code to authorize will be in Authy app on your phone, not hacker phone even though they got your SIM, so the hackers can’t do shit.
If your main email (you’re using on bank accounts) is from Apple’s (@me.com or @icloud.com) just turn on 2FA and the hackers can’t do shit either because it will need another of your actual device to authorize.
They can’t get into your main email, they can’t do and won’t know shit so why the panic, Dave?
Don’t use hardware key. Hardware can break, be lost and be stolen.