How to bypass Sprint/T-Mobile 2FA in under 5 minutes
reddit.com
reddit.com
It is easy to blame a single person or a single company for poor practices, but I have yet to encounter any real solution to this problem that allows someone to prove they are who they say they are which is able to hit the sweet spot between too many false positives (hijacked accounts) and too many false negatives (valid customers locked out).
If I was a security-minded person looking for startup ideas, this is the problem I would be looking to solve.
Almost every phone and laptop today supports it, and you can optionally have a backup in the form of a $10 keychain device or 24 words written on paper.
This does mean people will be best off to keep at least one backup safe with other things they can't afford to lose like their SSN card and drivers license.
Once WebAuthn is setup then day to day as long as a person has not lost -all- their devices, then remote identity verification can be fast tracked.
If they have lost all their devices it would be like if they lost all citizenship paperwork and will be a longer, generally in person, process involving reference verification and a waiting period.
Google and github supprot WebAuthn, but most services only support OATH-TOTP, OATH-HOTP or even worse only their own app.
If the google or microsoft TOTP app is spyware, I have bigger problems.
I don't see what's dumb about them either.
- they involve storing secrets on a readable filesystem
- are tied to a particular instance of a filesystem, not actually tied to a piece of hardware, which fails the "something you have" part of 2FA
- either (a) fail if you reinstall your OS, OR (b) need to transmit secrets to Google and Microsoft to allow you to reinstall the OS, both bad
With Yubikey TOTP you cannot read back the secret, the hardware itself doesn't provide an interface to do that.
For apps that do allow export/transfer, it's up to the user if they want to keep the secret safe. But really at some point it's up to the user no matter what method or hardware you use.
And since most sites don't have an easy way to have multiple tokens, allowing export/transfer also reduces the temptation to insecurely store a copy of enrollment QR codes.
All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.
We can (finally) take AWS off that list.
I can say I was pleasantly surprised recently by being able to enroll multiple MFA Tokens and device types, for a single IAM SSO User.
Don't know the restrictions on it, but https://aws.amazon.com/iam/features/mfa/ probably has more details.
I really wish people would stop doing this.
It's not "many services" it's one service. "Many women have played the role of Ellen Ripley in the Alien movies (looking at you, Sigourney Weaver)". No. One woman did that and you just named her, not many.
Don't use "many" to mean, "Well, one, but when I wrote that it didn't seem like I had a point worth making". If you instead present this as "AWS is broken" then we see what the problem actually is and who needs to fix it.
You can't duplicate entry level devices like Yubikeys but hardware wallets like Ledger and Trezor both support backup of FIDO seeds in the form of 24 english words you can store endless ways, or recover to a secondary device.
I have duplicates of all my MFA keys.
These devices are also more secure as they show you the website you are approving on screen to avoid being tricked by malware.
You simply need to choose a security key that supports BIP39 backups like a Trezor or Ledger.
As an alternative most sites support enrolling multiple keys.
Hotels aren’t safe for valuables and people travel alone. We’re getting pretty far removed from convenience here as well. Might as well suggest people keep their keys shoved up their ass.
You can store it in a subdermal implant, under the sole of your shoe, a belt buckle, or in a finger ring or other jewelry.
Options are endless.
It is not permissible to use digital backup copies of paper identity documents in most countries but with digital identity you can make all the backups you want and store them places hard to lose. Travelers would be wise to do so. It is free and reasonably easy. There is just a training gap, the tech is here.
Personally I keep an AES encrypted backup needed for emergency recovery of my digital life implanted in my body. Others I know use NFC rings.
It may not be an instant solution, but should normally result in a temporary passport you can use to travel home with, then once home you should be able to bootstrap from there.
The problem is, no matter what you tell the average person, they are not capable of such diligence.
Ask anyone who makes diligent backups why they do it. You will hear a story of pain that taught them.
This is sadly just how most humans work.
There are those which will never, ever learn. Ever. And it is a large part of the population.
That's cool, I didn't realise it was possible to backup the webauthn secret this way.
I googled but couldn't find any documentation on how to set this up, could you let me know how you set this up?
Not being able to make backup of the Webauthn secret is why I have stuck with TOTP so far.
If you're running something like a phone company in the US, millions of the people you service probably aren't citizens. If your process is "longer, generally in person, process involving reference verification and a waiting period", then your competitor will get those customers instead. Prepaid plans first became very popular in the US in part because they do not require bank accounts or SSNs.
Eh.
I'm super excited for WebAuthn, but unless my sources are out of date it's far from being supported everywhere (https://webauthn.me/browser-support).
A giant challenge with WebAuthn is the lack of platform authenticator integrations, particularly on Linux. You basically need to buy a separate key. And if you're on Android and you swapped out Chrome for Firefox (which you should do) then even the physical key stops working.
I desperately want to start using WebAuthn everywhere and I desperately want to start encouraging devs to swap over to it for most new logins. But I don't think I can. I don't know that I own a single phone or desktop that as configured can use WebAuthn without a security key. If I'm doing something wrong, or if there's some config option that just hasn't gotten flipped by default on platforms like Firefox Linux, then I'd love to know.
Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for.
In a typical implementation someone must be present at the machine expecting a tap, and tapping.
That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
Giving up WebAuthn and thus trading security for privacy by dumping Chrome for Firefox is a raw deal. If privacy is a concern run a de-googled ROM like CalyxOS which ships defanged Chromium so you get to have vital security features like WebAuthn without giving up privacy.
Yes, Chrome phoning home is a concern to me, but a much bigger concern is the lack of mobile extension and adblock support. Defanged Chromium doesn't solve that problem. Even desktop deGoogled Chromium is just an inferior browser when it comes to privacy right now; it has fewer extension APIs than Firefox and it's missing built in Firefox privacy features like containers.
But on mobile, giving up the ability to run extensions entirely? I'm not sure I can substantively argue whether giving up adblocking is a bigger security tradeoff than giving up webauthn. But it's definitely a pretty big privacy tradeoff given the current state of the mobile web.
I don't know, maybe this is a solved problem. I haven't really looked into CalyxOS. Does it patch mobile Chromium to support extensions? Can I trust the devs to do that securely?
----
Edit: so I did look into this, and it looks like MicroG just doesn't support WebAuthn at all: https://github.com/microg/GmsCore/issues/849, https://bugs.chromium.org/p/chromium/issues/detail?id=997538
So if anything, that gives me a lot more confidence to claim that this is not widely supported yet and people shouldn't be calling WebAuthn a universal drop-in replacement for other systems.
Not to say that WebAuthn is bad, I expect these problems will be solved over time and support will widen. I do think WebAuthn is the obviously correct long-term solution. But I think the "virtually all" language used here is not currently accurate. At best I'm seeing some (very small) repos trying to work around the problem, and I'm not convinced it's good security practice to entrust login tokens to under-audited 3rd-party services."
How does anyone keep their drivers license in a safe? If they don't drive?
Driving is without a license in your "immediate possession" is definitely against the law in California[1] and I've never met someone that intentionally leaves it at home. Restaurants that card for alcohol also makes this a no-go for most people.
1: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
Of course, in the UK car registration plates are issued and attached by the dealer, before a car's first sale, and they never expire. So they can find the registered keeper of a vehicle just by looking at the plates.
Yet another situation where foreign registered vehicles are essentially immune from UK traffic enforcement.
(It makes no sence because they have a digital picture of you provided by DMV in their cruisers, along with proof of insurance?)
Always have backups of these. I know people who lost all their docs and ID in a fire and it took over a year to recover.
At one point all they had to go on was an old scan of a drivers license they could fax people as "proof" of ID.
Both of those things are trivial to replace.
Getting access to an AWS root account you are locked out of however just requires -photos- of identity documents and billing verification etc.
I would way rather have the latter problem.
How does the business know the DNA used to set up an account for Bob comes from him and not from attacker Bill? They would have to take his ID at his first visit so you’re still vulnerable to ID fraud.
We can argue back and forth but IMO the DNA idea has two problems: 1 It is too invasive as it requires customers to reveal their DNA to the business. 2 It is impractical. Firstly, the technology doesn’t exist. Secondly, it requires a physical visit to authenticate.
BBC News - India's living dead: 'They stared at me like I was a ghost' https://www.bbc.co.uk/news/stories-58259497
Wouldn't a finger print be easier?
Why would you need to go to the store plenty of dna sequencing happens over the mail for ancestry and alike. Partner with them and offer discounted dna results.
Ideally you do this once and keep a card and use it everywhere.
As to doing it by mail, that may be potentially doable, but one would need to think through how to prevent e.g. stolen saliva, MITM mail sample interceptions, etc.
Biometrics are never perfect. Sometimes they can be forged (even something as simple as a printout of a human face looking in a camera), other times you take advantage of a tech vulnerability to feed the desired biometric data in directly without needing to produce anything physical at all.
https://en.wikipedia.org/wiki/John_Schneeberger
>John Schneeberger (born 1961) is a North Rhodesian-born former physician who drugged and raped one of his female patients and also his stepdaughter while a physician in Canada. For years, he evaded arrest by implanting a fake blood sample inside a plastic tube in his arm, which confounded DNA test results.
>During his 1999 trial, Schneeberger revealed the method he used to foil the DNA tests. He implanted a 15 cm Penrose drain filled with another man's blood and anticoagulants in his arm.[5] During tests, he tricked the laboratory technician into taking the blood sample from the place the tube was planted.
I can think of a number of solutions. One of them might be taking advantage of timing + an external contact:
0. Require a point of contact upon signup.
1. If any change requires bypassing ordinary authentication, ask contact to approve.
2. If they approve within M minutes, authorize.
3. If they don't reply within H hours, authorize.
4. If contact rejects operation, then deny.
5. If customer disputes denial, require them to wait O(days) for some out-of-band resolution mechanism (like mail verification, video call + ID verification, or whatever makes sense given the context).
(You can also allow the customer to customize the behavior here if they're e.g. particularly paranoid and want longer delays or explicit approval or whatever... lots of possible variations on this method.)
Generally speaking, there are three classes of auth, who you are, what you have, and what you know. Single factor auth is meaningless, which is why many people are stumped by this situation. Use two factor auth, which is verification from two separate categories. Certain industries use 1.5 auth.
There are also software and hardware tokens. Those are generally what you have (and might spill into what you know), but are also time-bound.
Ultimately, security is risk-management. Risk can also be transfered, such as by using a different identity provider. Then it is no longer the company's issue to solve.
https://www.nearlyfreespeech.net/about/faq#LostEverything
It's on the paranoid end of usable, it seems to me
You're quite right that it is about striking that balance. We do it by keeping the app focused on recovery codes. From there, users can optionally assemble their own personal recovery team of trusted contacts.
Either way, users get the same universal account recovery experience for every one of their accounts on every service.
We're getting there. Authentication comes down to three things, "Something you know (a password in your head), something you have (a private key, or a phone that gives you a code), and something you are (your face, a retinal scan, or a fingerprint)".
In most cases, people won't lose what they are. There are of course exceptions, such as injuries by fire - which brings us right back to step one, hounding poor support agents with a (possibly fabricated) sob story. The weakest link is often the support folks who can press a button and allow the attacker to authenticate.
Why?
The person on the other end usually doesn't speak the same language, or if they do--it's not their native tongue.
There's no point in getting mad when they don't quite understand why you are calling in the first place.
Companies need to stop outsourcing Customer Service to the cheapest country.
Having a command over the customer's language might prevent a lot of security mixups?
This has never stopped people getting angry.
I think the solution is third-party attestation.
The government can offer an identity service - it doesn't need to be linked to your real-person, but could simply require proof of residency (by say, mailing you a postcard that you would bring in), but once established, you could use this service to attest your identity to third-parties.
There are companies that increasingly offer this service (like Facebook, Google, Amazon, and Apple) but I think they struggle to avoid conflicts-of-interest in offering this service, so they make me nervous how popular they are becoming in the US and UK.
Where I live, the government provides a smartcard which you can use with government websites and a few non-government sites, and this is used as a second-factor for making critical changes. If I lose this smartcard, I have to go into a government office with some documentation to start the process of getting a new one (where it will be mailed to me, and I can bring it in with documentation to be activated).
I don't find this onerous; I don't have to use the smartcard to do any "normal" things -- the non-government sites (and some of the government sites) allow me to log in using just a password and a mobile-app, but if I were to lose my phone (or my password), I know I have a government-provided recovery mechanism.
Finally, anticipating a particular antagonist of this idea: As far as I know, the government doesn't actually know what services I use this smartcard with (unless the company shares this information, but we already know Facebook and Google and probably Amazon and Apple do) and I have multiple cards with different identifying details on them, so I think any privacy risk is minimal.
This is part of what I was referring to by "conflicts of interest": I don't see how any private corporation could possibly be trusted to do this.
I was pointing them out more from a product perspective, I think the fact that it’s so genuinely useful product validates everything you said.
T-Mobile has determined that unauthorized access to some of your information, or others on your account, has occurred, like name, address, phone number and DOB. Importantly, we have NO information that indicates your SSN, personal financial or payment information, credit/debit card information, account numbers, or account passwords were accessed. We take the protection of our customers seriously. Learn more about practices that keep your account secure and general recommendations for protecting yourself: t-mo.co/Protect
It's such a shit feeling knowing my name and info are out there and that it's only a matter of time before they make attempts on my accounts or identity, I'm one of tens of millions and can only hope that I'm far down the list. I'm usually pretty good with online security, I don't even reuse usernames or emails to sign up for different services, use 2fa for anything important, use containerized tabs for social websites, use VPNs on non-familiar site so some random guy's blog doesn't have my IP, etc... and there goes my cell phone provider fucking things up for me anyways. I don't even know if this is actionable info, should I even bother? Should I get a new number and replace my number at all services that use this number?
I got the email from my employeer this year that my application for unemployment was reject because I'm still working (I didn't apply). I had an tax check stolen and attempted to cash.. (the bank stopped that one.. Dominican Republic bank cashed that one..), IBM backup tapes with maybe my personal information went missing..
A friend who is supper vigilant had someone apply for a credit card with his credentials.. The card company sent him a letter asking if he had moved.. The card was approved and ready to go.
Its sad, but you have to stay vigilant. I don't know if its worth getting a new cell number. It is kinda your identity now.
That information shouldn't be a risk. It's too easy to get for everybody.
Information posted in the phone books during the time of phone books couldn't really be weaponized against you like it can be now. So yes, times have changed. Just because something used to be done doesn't mean it should still be done that way.
For my part, I think both can be pursued. Let's do what we can to help keep things private. Let's also do what we can to keep things irrelevant.
Especially common for folks that move a lot. Students, for example.
even as a second qualifier to reduce the number of exactly 1 hits on a unique number it's not very useful.
But, I fully ack that it is a poor piece of information to do this.
It really feels like the answer is "do nothing, and hope no one ruins your life". Which isn't a great place to be.
Address? If you own a home, already a matter of public record.
Phone #, not secret at all (heck it is part of many people's email signatures!)
Talk to an investigative journalist some time and find out exactly what info can be had publicly.
On a related topic, a few years back I went to a presentation from a member of TMO's marketing team. They mentioned how they used a ad-tech company to real time query the mortgage status of people who visited TMO's homepage in order to help dynamically determine what line of phones to show. Live in a nice neighborhood and didn't have a bunch of late payments? iPhones showed up.
To be clear, their is a vendor out there with an API that offers up, in real time, what your current mortgage status is. "You" of course are determined by a bunch of other web trackers.
A few weeks ago Best Buy sold off the the fact that I was in their store looking at robotic vacuum cleaners. (Either that or some app on my phone was using really good location tracking, but Android has seriously cut down on that, AFAIK background apps aren't granular enough anymore to get section-in-store data) While I was impressed with the ad tech that made that level of targeting possible, it also means I am not likely to step inside a best buy again.
If they can 'electronify' a price tag, you know they have some precise beacons in that store.
https://www.wired.com/2017/05/hundreds-apps-can-listen-beaco...
I watched a video review of a drone on YouTube and that was a huge mistake, got slammed with drone ads for weeks afterwards.
Watching any video mentioning “Planet X” seems to sign you up for a semi truck full of crazy also.
Here's a guide to removing your phone number from all security functions: https://blog.kraken.com/post/219/security-advisory-mobile-ph...
Just made a separate post about it here, since it doesn't appear to have been posted at HN before: https://news.ycombinator.com/edit?id=28283321
(Switched to correct-horse-battery-staple style for those after that.)
Scammer: "Oh, I just entered a long stream of random digits, but I can't find where I wrote it down"
Operator: "Good enough. How large a credit line did you say you wanted?"
Operator: ...
(Real) me: Err.. all of it? [hoping p,q,r-th characters will be enough]
Operator: Yes please.
I feel like failure by services to allow multiple 2FA providers concurrently is a common weakness that is rarely criticized.
as to solving sms 2fa security, it's flawed by design, even if it was e2ee
https://news.ycombinator.com/item?id=28203374
https://news.ycombinator.com/item?id=28194815
https://www.gsa.gov/blog/2021/02/18/logingov-to-provide-auth...
https://www.congress.gov/bill/116th-congress/house-bill/8215...
https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...
The US Postal Service (USPS) has successfully piloted a service to check people’s identity in-person at both USPS locations and at people’s homes using their existing portable tablets used for mail delivery [1]. I'd agree that it's uphill, but it (competent digital identity implementation) is necessary for the reliable functioning of government and commerce in the twenty first century. Otherwise, SIM swaps, identity fraud, and similar will continue to be a (costly) thing.
iOS 15 is rolling out digital IDs in Wallet. I'm excited to see if this enabled a faster deployment with solid primitives.
[1] https://gcn.com/articles/2013/01/28/usps-pilot-cloud-federal...
If you make that frictionless, privacy and alt accounts are gone.
For this to work, your digital identity needs to be something that the courts will directly accept as your personal identity. The fact that it is currently indirect is what causes all the problems. For example, nobody knows if some digital identity (eg. SMS verification proving ownership of a phone number) is tied 1-1 with a natural person. When companies assume it is, that's where the crack can get opened by fraudsters.
The only way to fix is this for the courts to be able to _directly_ trust an authority that issues digital identities. The only such issuer I can see working is the government.
In the US I suppose that could be a state government or the federal government, since courts (whether state or federal) will generally be able to trust digital identities issued by the other. But I don't see how this can be fixed by anyone _other_ than governments.
Having said that, I suppose it might be possible for credit agencies to issue digital identities. I haven't thought this possibility through.
Apple has a second factor system where you can authorize a new device using another Apple device. While this is convenient, not everybody has 2 Apple devices (for each Apple login). Worse, they use a dark pattern to make enabling this (other device auth) the default choice, so it's really easy to setup when you update your iPhone.
I was eating at a restaurant once -- IN PERSON -- and the fucking web interface they force everyone to use to order food wanted a SMS 2FA. WTF? No. I don't require your waitress to disclose her phone number to order food. And in return, you don't ask for mine. Just take my food order, swipe my credit card, and bring the food to the table, there is no need to disclose a phone number.
I think the ideal law should be: Any business that wants 2FA MUST support at least U2F hardware keys. It's okay to also offer SMS but not okay to offer only SMS.
You're missing the point.
Twilio and Apple (et. al) are not using 2FA for you. It's not to protect you or to help you.
They are faced with a brutal and unceasing spam/scam/puppet onslaught. Forcing you to burn a physical SIM identity to create and maintain an account is just a blunt mechanism to slow this process down.
It is a way of attaching some costs to creating a (Twilio/Apple) account.
They're not doing it for you.
Well, you asked ...
Getting back control of your gmail when all your 2FA and device codes have been reset is very difficult. I had to call in a favor with a friend who worked there. I use true 2FA on all my accounts now.
One thing you can do is call T-Mobile and setup a pass phrase. Phone based customer service won’t do anything for you until you give them that pass phrase.
The advantage of the attacker having a PUK is therefore that they could then physically put the SIM into their own phone, or use the SIM in the target's phone (if they have their phone PIN as well as the PUK). This of course means that they need to have physical possession of the target's SIM, and that the target needs to be unaware that their SIM has been taken, because as soon as they realize they don't have a SIM they'll obviously contact their carrier.
So the adversarial use-case of having a PUK is pretty limited. Which in turn explains why the security in giving it out is comparatively low.
I guess I'm not seeing the issue here too much. There are cases of social engineering carriers that are way more damaging.
You're then able to modify the contract and, for example, can get a second sim card. The affected phone number gets a "Welcome to our customer portal" message, but that's that.
I actually used this to get access to my own phone number after losing access to the connected mail account. :-D
Ah, very interesting. I was unaware of this usage of the PUK. If it's used for account ownership authentication, then absolutely carriers should be treating it way more securely.
So if I know yours (and your number) I can transfer it to a different network, registered to an account in my control.
PUK: Personal Unblocking Key
PAC: Porting Authorisation Code
PUKs are a 8 digit code burnt on the SIM at manifacture (or whenever the network personalises them), don't change, are not checked by the network, its "just" always you to reset the SIM Pin after entering it wrong 3 times. atleast here in the UK it's normally printed on the full size card of the Combi SIM you punch your desired SIM out of.
Not at lot people I come across use SIM Pins any more, but they help prevent someone taking the SIM out of your phone, placing it in another and authing to the cell network "as you" to be able to make/receive calls/sms. A PUK is only "good" for as long as it takes for the orig owner of the sim to report thier phone lost/stolen (A PUK will unlock a PIN blocked SIM even if its deactivated because it happens before the SIM exchanges any data with the network, but if the SIM is won't any any difference and honestly, I don't come across many PIN protected SIMs even from techies in my social group).
PACs are codes generated by the network at time of request (here in the UK you can get one simply by sms'ing PAC to 65075), they are valid for 30 days and is what you would give to a new network to port your number to them. However they are not the best method of attack IMO. They will still alert the customer that a PAC has been issued. (when I last asked for one I do so online and they still sms'ed me the code, so the orig owner can be alerted. Here in the UK it takes atleast 6 hours to port a number, but personally I've found it to be closer to 24 hours as long as the request is made Monday-Thursday (they don't process them over the weekends).
If you are in phsyical procession of the SIM to ask for a PAC via SMS/Phone in order to do a 2FA SMS attack, might as well do the 2FA SMS there and then and save waiting around for the number to port to a new networks SIM, if you are not in procession of the SIM and you are doing a social engineering attack it's much quicker to walk into a store of the networks and get a "replacement SIM" on the same network as you can walk out of the store with the SIM activated and the original one deactivated.
Stores should be validating ID's for an instant in-person replacement SIMs but often they do not, heck the last time I changed my phone in person (I buy my phone outright and have a SIM only plan) just the fact that I dropped the cash on a brand new phone was enough for them to to issue me a new SIM, but in the process they had reset the adult content block on the account and I had to show ID to prove I was over 18 (I'm clearly over 18 :-P) before they would remove the block. (Got new phone, they activated my new sim, I left the store with a new phone, went around the corner to a bar to set it up over a pint, found the content block, finsihed my pint and went back to the store to get them to unblock it. It only then dawned on me that they just gave someone access to my phone number (granted, it was me they gave the access to) with no checks, but wanted ID to disable the adult content block...)
> here in the UK you can get one simply by sms'ing PAC to 65075
I did not know that, thanks! Will try not to forget for whenever I need it..
A while ago, I wanted to log into my carriers customer portal, but my account was so old that they still had an ancient email address in their system that I didn't have access to anymore. Previously, one could just login via the phone number and a code sent via SMS, but suddenly they required a password that was sent to the mail address. One could also reset the mail adress with the PUK, but I lost that too while moving. :-P
Ended up "hacking" my own account, by calling customer support a few times. The first two customer support agents wanted me to click on a link on a mail they sent to my mail adress or to go to a physical store with my ID card, to prove I'm not an attacker, even after I told them my name, address, date of birth, customer ID, bank account number, etc.
The third one just gave me the PUK, with no questions attached, after telling him just my name and phone number. :-D
I was astonished to find that a multi-billion dollar company had such a massive flaw in their captcha system. That being said these kind of errors are really far too common.
Then again, somehow losing all 2FA methods is my nightmare reason for being hesitant to turn on 2FA for my Google account because their customer service is so completely awful. Like if my house burned down with my keys, phone, and previously authenticated PC stuck inside. I know, extremely unlikely, but without customer service that is willing to verify my identity without relying on an automated/AI algorithm, I feel safer with a strong unique password along with the other account recovery options.
Am I being unreasonable and missing some method of last resort with Google's 2FA?
One important difference is that Microsoft Authenticator supports recovery from iCloud (in cause you are on iOS; there is probably something similar for Android too), which is something that Google Authenticator does not. So in case my phone explodes, the only thing i need to recover all my 2FA stuff is a recovery key for iCloud (which i can print out and put in a few places, like a bank storage cell and my parents’ house), because my Apple stuff is behind 2FA as well. So essentially, i just pick up my recovery code, buy a new iphone, authenticate using the recovery code, it restores all my data from iCloud backup, and my Microsoft Authenticator app has all my 2FAs for all services i use it for there.
It is a fairly recent feature for Microsoft Authenticator on iOS iirc, they added it less than a year ago. A few other 2FA apps, like Authy, support that type of 2FA recovery too (and Authy specifically had that feature for much longer).
In my threat model, losing my phone is at least 1,000x more likely than the targeted attack it would take to compromise both auth factors for my most important accounts.
Besides, as others pointed out in another similar thread: after SMS hijacking and social engineering, the next weakest link is cookie theft.
The incentives are all wrong: Telco support people are incentivized to handle as many calls in as little time as possible and to be as helpful to customers as possible.
In 99% of calls, being "difficult" about this will cause customers with legitimate issues to be angry and will cause the ticket to stay open for much longer than what's necessary, so I totally understand where they are coming from.
I wish my Telco had an option where I could set a flag to never help me with account recovery at the promise of in return never getting angry at them for not helping me. Then "we can't help you" is the quickest way to solve such a ticket for them and it's also the safest for me.
Honestly, if I ever lose access to my phone account, I'd rather get a new number than have some helpful person hand over the keys to umpteen accounts I have on the internet which I can't secure adequately because of braindead policies at those accounts.
>As a infosec professional by trade, I just can’t believe how easy this was. Billion dollar company with absolutely no security awareness passed down to there techs
They aren't 'techs' manning the support chats. They are (often outsourced) lower skilled workers that follow a script and routine... if anything falls out of that script they are lost.
There are just way too many ways this can go wrong.
(1): Rhetorically, most likely because when their service system was developed this wasn't a concern and since then they never re-evaluated this part for security (or did and didn't care to change it).
Related question: What should happen to a customer who legitimately encounters this problem?
All other solutions posted in this thread won’t work.
Every hack, scam and cyber crime pushes us further towards this inevitable destination. As long as there are more honest people to be victimized than there are criminals and haxxors to profit, the world will demand traceable secure money. I’ll get super downvoted but think it through. It’s not a conclusion I came to easily or without deep lament.
To see/change your banking details they bring back the banking info (api call) and display it on screen, BUT their security is to 'quickly' bring up a modal(js) to 'hide' the sensitive information... of course just modify 'display:none' on modal and you can see everything :s