The Motherboard Guide to Not Getting Hacked

[steve2470]

https://motherboard.vice.com/en_us/article/bmv5a4/the-motherboard-guide-to-not-getting-hacked

TWO-FACTOR AUTHENTICATION

Having unique, strong passwords is a great first step, but even those can be stolen. So for your most important accounts (think your main email, your Facebook and Twitter accounts) you might want to add an extra layer of protection known as two-factor (or two-step or 2FA) authentication.

By enabling two-factor you'll need something more than just your password to log into those accounts. Usually, it's a numerical code sent to your cellphone, or it can be a code created by an ad-hoc app (which is great if your cellphone doesn't have coverage at the time you're logging in).

There's been a lot of attention recently around how mobile phones may not be suitable as 2FA devices. Activist Deray McKesson's phone number was hijacked, meaning hackers could then have the extra security codes protecting accounts sent straight to them. And the National Institute of Standards and Technology (NIST), a part of the US government that writes guidelines on rules and measurements, including security, recently discouraged the use of SMS-based 2FA.

The attack on Deray was low tech: It essentially involved getting his phone company to issue a new SIM card to the attackers. It's hard to defend against that, and there are other ways to get those codes sent via SMS, as text messages can, in theory, be intercepted by someone leveraging vulnerabilities in the backbone that carries our conversations. There is also the possibility of using an IMSI-catcher, otherwise known as a Stingray, to sweep up your communications, and verification texts too.

a lot more at the above link. I'm not in IT, so I'll leave it to others to evaluate the article.

[Sunlei]

1. everything is hackable, people are clever & can hack anything.

IMO, one shouldn't use the same cell phone or computer to use social media, surf around on that you use for things that have your credit cards stored on or do banking on. Like UBER, Door dash, online banking and your work computer.

IMO social media sites and NON- web based email are where majority of hacks are installed.

[RKP5637]

3. The best second line of defense, IMO, is the Yubikey!

https://www.yubico.com/

Usernames and passwords are not enough to keep online accounts safe. Two-factor authentication is now recommended to secure login to Internet services and protect against phishing attacks and credential theft. The YubiKey is supported by hundreds of the most popular online services including Google, Dropbox, Facebook and many more.

One touch, two factor
The YubiKey offers strong authentication with one touch or tap. Unlike two-factor authentication using SMS, the YubiKey does not require network connectivity or access to a mobile device. Just touch or tap the YubiKey to authenticate.

[steve2470]

4. +1 nt

[Thor_MN]

5. The key point: The target in the article was a "known" person.

Joe or Jane Nebody would not be the target of getting their cellphone SIM card replicated. The article inflates the danger to the average person. Unless you are for some reason noteworthy, the effort to hack your cell phone isn't worth it. If someone temporarily snags you with a stingray, what are the odds that they will be able to discover your internet accounts (that also require a password) from cellphone traffic.

IMO, this article trends towards the sensationalistic.