4

Several Q&As here highlight the danger of phone hacking. For example, this.

In a nutshell, the solution is to NOT give your phone number, except to your bank or government.

Unfortunately, that is a very impractical solution for a simple reason: phones have been created first to communicate with people. 2FA came as a second thought. In other words, I need to give a phone number to many different companies that will absolutely make sure NOT to follow best security practices (my plumber, the school for my kids, etc.)

So I was wondering, what are the solutions to keep the convenience of being able to communicate with many different people, but stay safe?

I have thought about the following solutions:

1) Get a burner phone, with a different phone number. Give that new phone number to my bank and government services. My "real phone" is considered unsafe.

  • Pros: seems safe
  • Cons: Impractical. The sim on the burner phone will deactivate after 3 months without usage. Do not want to carry 2 phone numbers, therefore will miss potentially important calls.

To solve the cons, I looked into solutions to transfer calls/SMS from one safe phone number to my main (unsafe) phone number:

2) Get an app like Viber (Google voice is not an option outside of the US) that gives you a different ("alias") phone number, and redirects it to my main phone number. Use the alias as my safe phone number (for banking).

  • Pros: convenient, only 1 phone, do not miss call/messages
  • Cons: seems unsafe, as if a hacker hacks my real (unsafe) phone number, he can still receive the SMS sent to the alias, and therefore gain access to my bank. Also, I need to trust the provider. In many cases, they seem to be smallish companies, so hard for me to trust.

3) Same setup, but my safe number is my real phone number. The alias is the unsafe one.

  • Pros: seems to be the safest (but please let me know if I miss something)
  • Cons: I need to change my phone number, so that's highly inconvenient (I've obviously already shared it with many people)

So my questions are the following:

  • Are there flaws in my reasoning above?
  • Are there other (ideally better) solutions that I am missing?
Improve this question
3
  • The flaw in your logic is your premise. i.e. That to be secure you must eliminate all the flaws in the security protection. That's an impossible task. 2FA, like every other security measure is hackable. Trying to further protect this through treating your phone number like a secret is more than a little paranoid. Attackers pick the weakest point in a system to attack, and the 2FA is unlikely to be that weakest point.
    – Steve Sether
    Commented May 21, 2018 at 17:52
  • I'm not sure I agree with your comment. Phone hacks have been increasingly common.
    – DevShark
    Commented Jun 11, 2018 at 16:13
  • You misunderstand my comment. I agree it's possible to hack texts. What I don't agree with is that the solution is, therefor to keep your phone number a secret. That's essentially impossible unless you want to go through extreme measures like having a secret phone number. You'd be better off strengthening the OTHER part of your 2 factor, as well as limiting the risk of being hacked in the first place. The point is, given enough effort, someone can certainly hack you, even if it's with a lead pipe.
    – Steve Sether
    Commented Jun 11, 2018 at 19:08

4 Answers 4

Reset to default
1

sadly, there is no way to guarantee your phone not being hacked.
I do recommend your last option on the issue of safety using the alias number as the unsafe. That does provide an extra layer of software to get down to your actual phone number.
But, for us to use the dang item, we must therefore open up at least one possible way for it to get broken into.
If we were to make an unhackable computer, it would have to never be on. Unhackable phone number, never use it. etc.

Improve this answer
0

Most modern Chinese smartphones are "Dual SIM", i.e. they can have two SIM cards with two separate numbers.

The usual purpose of the feature is to have separate call and data providers, or for using a local SIM for data and calls while roaming. The phones themselves are close enough in quality to the established Korean brands to consider.

You can designate one SIM card as primary and only use the other for 2FA. Send a SMS through it every few months to keep it active.

  • Pros: Effectively option 1 with just a single phone.
  • Cons: Not resistant to theft/hacking of the smartphone itself. But this is shared with all other options that don't use two physical phones.
Improve this answer
0

Think you've summed it up pretty well, except for the issue that you would probably need 2 new numbers for option 3, as your current number is already out there, and you wouldn't want your new safe number still on your various records.

There are APIs (and I think services) which let you receive SMS and voicemail without a phone number, so forwarding might not be necessary in every case, but you still run the risk of not receiving communication in a timely fashion, and you would have the hassle of logging in to this service for your auth codes etc.

Personally I don't want the hassle of changing my phone number. Phone hacking has been done in the wild for banking https://www.theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw/ but it is not yet super prevalent. Maybe I'm hopelessly optimistic but TOTP is getting more common and Web Auth N is getting a big boost right now so I'm going to hold out for now...changing bank could also be an option...

Improve this answer
0

I'd look into writing an app with trello.

Trello is just one company that can receive SMS.

You write yourself a website that can talk with trello. You login to your website with a username, password, and the TOTP. There you can see your SMS messages.

You never give this trello number to anyone except your bank, and you can get use your phone as a phone.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .