Your Privacy is at Risk

What people said

judge2020 · 2022-03 · Reference

But, to add, sim swap attacks are a known issue and anything of value becomes a target. The main issue is that retail employees in 'authorized reseller' locations are allowed to make changes to accounts with the PIN of the account holder, but that is often easy to guess or is easy to figure out by anyone that does enough digging into someone's life. [LINK] [VIDEO] (tldr he got cold called to set up 'extra security', gave the attacker a PIN number, and the attacker used that to impersonate them within a T-Mobile store and swap the sim card from the phone into a new phone, thus receiving SMS 2fa codes for their accounts).

Read the original HN comment ↗

shawn · 2018-09 · Reference

Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access). This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me." And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Github prompt that looks completely authentic, and now I have your Github password. Wanna bet you don't have 2FA turned on, even though you know you really ought to? And even if you do, it's getting easier to social engineer your way past AT&T's lovely customer support: [VIDEO] Ok, what's the point? This: Every character in the URL bar unrelated to the apex name is a deadly distraction. Right now, how do you know you're actually on HN instead of some knockoff? "ycombinator.com". How many characters do you have to read unrelated to that? " [LINK] . /item?id=17927972" The most vital part of a URL for vetting identity is also, usually, the hardest to see. Now, I don't know whether google made this change in order to assist with this. But it's one possible justification, and a step in a good direct

Read the original HN comment ↗

css · 2018-08 · Reference

Either some sort of ss7 exploit [0] or the attackers socially engineered the cell service provider [1]. This happened to some big YouTubers in the past [2]. [0] [LINK] [1] [LINK] [2] [VIDEO]

Read the original HN comment ↗