Scary Security Stuff

[Miska]

Google Authenticator is pretty decent. And looks familiar to those experienced with RSA SecurID. Too bad far too many companies rely on SMS which is insecure. It is not much better here with banking sector, relying on SMS and some other less-than-great home grown implementations...

 

Too bad so far the only place apart from Google where I can use Google Authenticator is GitHub.

 

Only one local bank supports and supplies SecurID-type 2F authentication device on request.

 

[asdf1000]

2 hours ago, Miska said:

Too bad so far the only place apart from Google where I can use Google Authenticator is GitHub.

 

I use it for this forum, for 3 other forums, for my NAS, for Amazon, for Facebook, Skype/Microsoft.

 

Plus Google.

 

[Currawong]

If you're a potential target for a SIM-swap attack, the solution would be to get a second phone with a number that you ONLY use for account recovery. Then even if someone does a SIM swap attack on your regular phone number, since it isn't connected with any of your online accounts, it can be used to break into them.

[Teresa]

Thanks @Jud for yet another reason to never get a cell phone, I'm glad I stuck with my corded landline phone. 😁

[mansr]

3 hours ago, Teresa said:

Thanks @Jud for yet another reason to never get a cell phone, I'm glad I stuck with my corded landline phone. 😁

Those can be "hacked' with a pair of crocodile clips.

[Allan F]

On 11/8/2019 at 10:44 PM, AnotherSpin said:

"...When you ain't got nothing, you got nothing to lose"

"...You're invisible now, you've got no secrets to conceal."

[Ralf11]

How does it feel?
To be without a phone
Like a complete unknown

[AudioDoctor]

If you all think its easy to get into an account with 2FA enabled I would be thrilled if one of you can regain my access to my Dropbox account...

 

Thanks.

 

yes this is real go ahead, try.  I can't even get in and I am the one that set up the damned thing.

[Jud]

2 hours ago, AudioDoctor said:

If you all think its easy to get into an account with 2FA enabled I would be thrilled if one of you can regain my access to my Dropbox account...

 

Thanks.

 

yes this is real go ahead, try.  I can't even get in and I am the one that set up the damned thing.

I lost access to a 2FA account somehow (phone change or some time without app, whatever, don’t recall) and was able to get 10 or so 1-time codes to use in order to get back in and if it should ever happen again. I don’t recall whether I used personal info or a PIN; I’m guessing the former.

[AudioDoctor]

19 minutes ago, Jud said:

I lost access to a 2FA account somehow (phone change or some time without app, whatever, don’t recall) and was able to get 10 or so 1-time codes to use in order to get back in and if it should ever happen again. I don’t recall whether I used personal info or a PIN; I’m guessing the former.

 

Yeah, it's my fault for losing the one time codes. But not my fault for losing the phone...

[Jud]

1 minute ago, AudioDoctor said:

 

Yeah, it's my fault for losing the one time codes. But not my fault for losing the phone...

And of course where do people who retain these things tend to keep them these days? Email, the cloud, email in the cloud....

[AudioDoctor]

8 minutes ago, Jud said:

And of course where do people who retain these things tend to keep them these days? Email, the cloud, email in the cloud....

 

I kept mine on my computer, but I guess I had accidentally deleted it.

[Jud]

At least in some cases, the harder you make it to accidentally delete the info, the more possible you make it that someone else might conceivably obtain it.

[Teresa]

21 hours ago, mansr said:

Those can be "hacked' with a pair of crocodile clips.

 

However, a corded landline phone has no hard drive, thus no information to steal except for the last number dialed.

[mansr]

4 hours ago, Teresa said:

However, a corded landline phone has no hard drive, thus no information to steal except for the last number dialed.

The information exchanged during a call can be stolen. This could be authentication codes for something.

[Jud]

34 minutes ago, mansr said:

The information exchanged during a call can be stolen. This could be authentication codes for something.

If they’re clever enough to ask and you’re dumb enough to give them. These days the only people who ask me for PINs over the phone are my television provider, and at the rate I’m paying I’d soon know if someone were affecting my service there.

[Jud]

By the way: You may say one shouldn’t do business with anyone who would provide access to accounts, phones, etc. But anyone who’s had to wind up a deceased loved one’s affairs is grateful it happens. Obituaries can be monitored and documents faked if it comes to that.

[mansr]

32 minutes ago, Jud said:

If they’re clever enough to ask and you’re dumb enough to give them. These days the only people who ask me for PINs over the phone are my television provider, and at the rate I’m paying I’d soon know if someone were affecting my service there.

I have seen 2FA with a synthetic voice reading a one-time code over a land line. In fact, I believe Google offers this as an option for account recovery.

[bobbmd]

@Jud AND OTHERS : there is a sept 12 2019 NYT series of articles entitled “protect your digital self in a few minutes a day” byline is a Thorin Klosowski it is a good read but of course haven’t implemented it just like everyone else!

[Jud]

1 hour ago, mansr said:

I have seen 2FA with a synthetic voice reading a one-time code over a land line. In fact, I believe Google offers this as an option for account recovery.

Heh, interesting. When I was helping to implement electronic transactions in our business segment I ran into plenty of people who thought for no particular reason things were ever so much more secure in paper and ink.

[Teresa]

21 hours ago, mansr said:

The information exchanged during a call can be stolen. This could be authentication codes for something.

 

I don't give such information over the telephone. I mainly confirm doctor appointments and refill prescriptions. And ever once in a while John Curl calls. Unlike my youth, I really hate using the phone, guess that is another reason I'm not interest in a cell phone. 

 

BTW when I refill prescriptions all Walmart asks me to confirm is the first four letters of my last name and when they are ready I pick them up in person.

 

When a computer dies I remove the hard drive and memory and hit them with a hammer and put them in a box in the closet and then take the dead computer (minus the hard drive and memory) to Best Buy to recycle. I would hate to do that with even more devices such as a cell phone, yet another reason I don't want a cell phone. The computer is enough to worry about.

 

18 hours ago, Jud said:

Heh, interesting. When I was helping to implement electronic transactions in our business segment I ran into plenty of people who thought for no particular reason things were ever so much more secure in paper and ink.

 

I'm one of the those who believes that paper and ink are safer, as long as everything with personal information is shredded before throwing away. I pay by check when I can and for the internet I use a non-reloadable prepaid debit card.

 

While I appreciate the large library of information of all types on the internet. I believe that it's creation was a mistake. And not just personal information, there is also disinformation, the manipulation of elections, and cyberwarfare.

 

P.S. I don't like scary security stuff and try to avoid anything that is risky.