Your Privacy is at Risk
Why Hacker News recommends it
HN cites it as a well-known example of SIM-swap social engineering that defeated even a carrier PIN, in discussions of SMS-based two-factor authentication.
What it is
h3h3Productions describes how a hacker took over their phone number by getting a SIM card from T-Mobile, and gives security advice such as using a hardware key and an authenticator app.
Recommended by 0 HN commenters across 0 different months, 2016 to 2022.
What Hacker News said
Cites Kortaggio · 2016-07 · on “NIST declares the age of SMS-based 2-factor authentication over”
One of the biggest weaknesses of SMS 2FA that I didn't see the article cover is when an attacker can socially engineer their way into your account with your cell service provider. I'm thinking of a high-profile example when an attacker tried to take over h3h3's YouTube account by requesting his SIM card from T-mobile by pretending to be a T-mobile employee: [this video]
Cites nbadg · 2016-09 · on “On Phone Numbers and Identity”
Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit. [1] [LINK] [2] [this video] [3] [LINK]
Cites css · 2018-08 · on “Reddit Security Incident”
Either some sort of ss7 exploit [0] or the attackers socially engineered the cell service provider [1]. This happened to some big YouTubers in the past [2]. [0] [LINK] [1] [LINK] [2] [this video]
Cites shawn · 2018-09 · on “Chrome 69: “www.” subdomain missing from URL”
Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access). This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me." And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Githu
Cites judge2020 · 2022-03 · on “Ask HN: Is there a pure SMS based UI?”
But, to add, sim swap attacks are a known issue and anything of value becomes a target. The main issue is that retail employees in 'authorized reseller' locations are allowed to make changes to accounts with the PIN of the account holder, but that is often easy to guess or is easy to figure out by anyone that does enough digging into someone's life. [LINK] [this video] (tldr he got cold called to set up 'extra security', gave the attacker a PIN number, and the attacker used that to impersonate them within a T-Mobile store and swap the sim card from the phone into a new phone, thus receiving SMS 2fa codes for their accounts).