Hacker News Reader

Comment by catlikesshrimp | Hacker News Reader

And this is where paranoids have the upper hand. Have a secondary secret phone number from another carrier exclusively for sms confirmations, using a dumb phone, which must be turned off when not expecting an automated code. Preferably a prepaid sim bought anonymously. Extra points if bought in another country and has coverage in your area.

View on HN

Does that help against an attacker determined enough to hack you that he'll pay $1000 for a SIM swap? Surely he has channels to figure out your "secret" phone number since you registered it with the service he's trying to hack into.

It is more difficult to sim swap a foreign number from another company. Not impossible, of course.

There is also that some services don't accept foreign numbers for authentication. Nor virtual phone numbers.

But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.

But it adds a layer of protection, doesn't it? Your known public phone number is one, your verification phone is another one from another carrier.

Is that really an additional layer of protection, or the same layer, slightly obscured? But probably not obscured from the attacker that managed to get your password and just needs the SMS verification code to get into your account.

You can probably figure out most people's default phone number by googling their name and going to one of those crappy white pages sites. Then try to login/do a password reset to their services and compare the masked phone number to the ones on the site. No advanced hacking or special channels required.

The trouble with compartmentalizing with a separate phone is that the company with your money probably also sold your secret phone number (that they only required for security) so it will probably also show up on that whitepages site.

> secret phone number

You have to give this phone number to a bunch of services that you use, i.e. all the ones that do sms confirmations. One data breach, and it isn't "secret" anymore.

Reply on news.ycombinator.com