Currently working on finishing moving passwords from a Google account to my password manager and resetting them all, as well as replacing anything that uses an SMS 2FA with a time based authenticator or other alternative where possible. Planning on getting a FIDO key to use where I can. Also setting up a Voice number on an account that's used for nothing else besides 2FA in the instances where there is no better form of authentication.
Edit:for whatever its worth att does keep a record of what employees accessed an account and when, and notes when managers bypass the pin, so doing this an an employee seems really stupid to me.
To step out of the regulated financial system is to open oneself up to these liabilities with little recourse.
That is not to say that telecom companies should not fix this. They absolutely should.
https://www.foxla.com/news/fox-11-tracks-down-verizon-employ...
Pins obviously have other issues that make no sense, like the incredibly low complexity allowed that would never be acceptable for a password. But even aside from that I guess AT&T also want everyone to turn their pin off? I hope they do lose a lawsuit and actually have to start giving a shit about pin swapping and make things more secure by default.
One time there was something wrong on their end and no one could do anything until the system to verify my pin was back up.
i.e. can a supervisor override lack of a PIN?
Also, don't have your life savings in crypto, but if you must, then please for the love of everything holy don't put it someplace where a SIM swap attack is enough to get it out. Irreversible transactions are kind of the whole point of it, so you need to be much more careful with crypto credentials than, say, your bank password or credit card.
Edit: https://twitter.com/skunkworker/status/1131297869703438337
@ChaseSupport Hey Chase, when will offline TOTP be added for a more secure login?
Thank you for reaching out! What we have is the multi-factor authentication on all online accounts. You can visit https://tinyurl.com/y7r2fztd for more info on how we protect and secure your information. ^AA
I'm waiting for the days our banks will accept multiple 2FA solutions.
The only solution is not using the phone. The phone reached it's limit. It's not trustworthy communication method.
Just as a sidenote, the problem isn't that the transactions are irreversible, they're also irreversible for banks. You never reverse the actual transaction, you just create another transaction in the opposite direction. Sometimes banks accidentally sent money to the wrong (foreign) bank and kissed them goodbye. The other bank had no obligation to send it back and if the 2 don't have a relationship and don't plan on having one it's free money for the recipient.
The difference with crypto is that you're basically dealing with "untrustworthy" parties since there's no central trustworthy authority over the whole network. The advantage is that nobody can control the network. The disadvantage is that you have no leverage over the receiving party.
It's like a private individual ad-hoc lending money to a friend vs. lending money to a total stranger. There's probably no legal obligation to return it but friends most likely will.
Exactly. Cryptocurrency, in my view, are meant to be intermediary currency. Keeping a lot of it is just too risky.
Tech nerds seem to like cryptocurrencies because it's a cool and fancy gadget, but the reality is that normal banks are more secure. If your money gets stolen, banks can trace it, cancel transactions, and there are insurances in place to recover your money. Governments are involved in bank security.
Currencies are not trivial things. Only libertarians and anti-government, anti-federal-reserve people will actually prefer cryptocurrencies to their own risk.
I get that the AT&T employee is guilty, but the victim was asking for it.
Suppose you lose all your physical keys: I don't think you can social engineer hack Coinbase (pretty sure most companies won't allow people to just give away your password/send a reset email to some other email).
Or suppose you get them to send me an email to reset my password. But my email also has FIDO u2f! And I know as a fact you can't social hack my email provider.
It’s not so much a problem as it is a balance of security, redundancy, and effort. You decide where you want to be on that balance of considerations.
Then also setup TOTP, so if you lose both keys and have a working cell phone with the app installed you can still login.
Some websites allow TOTP which is still safer than SMS, but if I lose one, I'll get another one while I use the 2nd.
We’ve collectively given up our rights to sue in many instances (including when signing up for HN-backed services run by people who should know better).
See: https://www.nytimes.com/2015/11/01/business/dealbook/arbitra...
Of course the victim could probably have protected his "life savings" better, but that's not the point.
Also insurance doesn't always hold up in cases like this, especially if the company was aware of the weakness and chose to do nothing about it.
Ideally it wouldn't be possible for a single employee to do this.
I mean this is a bank, are these guys for real?
> It essentially destroyed our financial future, our entire life savings was stolen
Who keeps their entire life savings in crypto?
And AT&T is the industry leader.
I’m still wondering why I can’t use Touch ID to do U2F...
Especially if you’re going around with that much crypto always always remember:
Not your keys, not your coins.
Always store cold storage and set aside some for trading if you want. And if you’re trading, always use FIDO U2F physical keys.
Translation: "All telcos are equally bad at this, so who are you going to switch to? So why should we bother fixing it? What's in it for us?"
