On 2023-11-09 22:23, AJL wrote:
> On 11/9/2023 1:30 PM, Carlos E. R. wrote:
>> On 2023-11-09 20:49, AJL wrote:
>>> On 11/9/23 12:15 PM, Carlos E. R. wrote:
>
>>>> They could pose as you in their machines.
>
>>> How if no user/password info?
>
>> Obtained earlier "somehow".
>
> "Somehow" = magic?

No. Criminals do those things. I'm not one of them, so I don't know how.
Sites are breached, passwords sold and circulated. Seems to be just a
matter of time.

>
>>> And if they had it somehow and tried to log in I'd get a uncalled
>>> for text code that'd tell me someone had my UN/PW and was trying to
>>> break in my AMEX account and I'd change it.
>
>> There is a window of opportunity. They do it fast and reconfigure so
>>  you get no more warnings and your phone invalidated.
>
> How would they get my username/password. Please no more magic...

Ask them bad guys.

>
>> The fact is that SIM swap fraud is a thing, not a rumour. People
>> have lost money.
>
> Yup. That's why I have a security code registered with my phone
> provider. No code, no business transacted.
>
>> They ask the system to send the 2FA via email.
>
> No username/password no email/text 2FA. And if they break into the AMEX
> servers to get them no biggie. As long as it's NOT MY FAULT I'm covered
> there too...
>
>

--
Cheers,
Carlos E.R.

On 2023-11-09 22:23, AJL wrote:
> On 11/9/2023 12:20 PM, Carlos E. R. wrote:
>
>> imagine I use the app in the phone to connect to the bank. The bank
>> sends a code by SMS to the *same* phone,
>
>> the app reads automatically the message and logins.
>
> Doesn't work that way on any of my apps. The 2FA code is sent by text as
> a number that I then have to then reenter into the app.
>
>> Now suppose my phone is stolen...
>
> Hopefully your phone AND your phone bank app are BOTH LOCKED. That way
> the thief has to go through TWO LOCKS to enter your bank app. Pretty
> unlikely, don't you think...

I hope, but could happen.

Some bank apps here use a 4 digit pin code. Others use 8.

>
> On my phone the 2FA text code only had to authorize the AMEX app ONCE.
> After that only the user name and PW is required to open the app.
> (Though AMEX can be set to require a 2FA code on every app entry I find
> that a bit too much of a hassle for what little added security it may
> give (IMO-YMMV).
>
> I'm still waiting to see why SMS is a poor way to send a 2FA codes.
> Though I'll admit that pushing "Yes" on a Google Authenticator screen to
> authorize an app is sure a lot easier...

Well, experts in the field have said so.

--
Cheers,
Carlos E.R.

On 11/9/2023 2:31 PM, Carlos E. R. wrote:
> On 2023-11-09 22:23, AJL wrote:

>> Hopefully your phone AND your phone bank app are BOTH LOCKED. That
>> way the thief has to go through TWO LOCKS to enter your bank app.
>> Pretty unlikely, don't you think...
>
> I hope, but could happen.

By the time a thief could break your locks you could have your passwords
changed.

My Google stuff (like Gmail) doesn't have a password once you get past
my phone lock screen lock. If my phone were stolen I'm counting on that
lock screen lock to hold at least an hour or so until I can change my
Google password...

> Some bank apps here use a 4 digit pin code. Others use 8.

Same as above. Change the password quickly if stolen. Then the pin will
no longer work.

>> I'm still waiting to see why SMS is a poor way to send a 2FA
>> codes.

> Well, experts in the field have said so.

Got me there. But still waiting for a reason why. Though text is
unencrypted what good would a timed 6 digit number intercept do anyone?
And the good part of using a text is that I'd know IMMEDIATELY if
someone's trying to log in to one of my accounts and can take immediate
action. Not so with encrypted email...

On 11/9/2023 2:28 PM, Carlos E. R. wrote:
> On 2023-11-09 22:23, AJL wrote:

> Criminals do those things. I'm not one of them, so I don't know how.

Ok, got the lack of subject knowledge admission...

> Sites are breached,

And people are careless choosing and keeping their PWs.

> passwords sold and circulated.

(Sh)it happens. That's why 2FA is in use.

> Seems to be just a matter of time.

Not for me...

>> How would they get my username/password. Please no more magic...

> Ask them bad guys.

So far they're falling down on the job with my stuff...

On 2023-11-09 23:08, AJL wrote:
> On 11/9/2023 2:31 PM, Carlos E. R. wrote:
>> On 2023-11-09 22:23, AJL wrote:
>
>>> Hopefully your phone AND your phone bank app are BOTH LOCKED. That
>>> way the thief has to go through TWO LOCKS to enter your bank app.
>>> Pretty unlikely, don't you think...
>>
>> I hope, but could happen.
>
> By the time a thief could break your locks you could have your passwords
> changed.
>
> My Google stuff (like Gmail) doesn't have a password once you get past
> my phone lock screen lock. If my phone were stolen I'm counting on that
> lock screen lock to hold at least an hour or so until I can change my
> Google password...

How? I am on the street, probably, far from home and with no phone.

>
>> Some bank apps here use a 4 digit pin code. Others use 8.
>
> Same as above. Change the password quickly if stolen. Then the pin will
> no longer work.
>
>>> I'm still waiting to see why SMS is a poor way to send a 2FA
>>> codes.
>
>> Well, experts in the field have said so.
>
> Got me there. But still waiting for a reason why. Though text is
> unencrypted what good would a timed 6 digit number intercept do anyone?

If they got your user and password in advance, a lot.

> And the good part of using a text is that I'd know IMMEDIATELY if
> someone's trying to log in to one of my accounts and can take immediate
> action. Not so with encrypted email...
>
>

--
Cheers,
Carlos E.R.

On 11/9/2023 3:23 PM, Carlos E. R. wrote:
> On 2023-11-09 23:08, AJL wrote:

>> By the time a thief could break your [phone] locks you could have
>> your passwords changed.

> How? I am on the street, probably, far from home and with no phone.

Guess you're outta luck then. I normally have an (gasp) iPhone nearby
(wife's). Then I'm also usually within 30 minutes of home. Guess YMMV
(your mileage is a lot bigger than mine) fits better than usual here... ;)

>> still waiting for a reason why [text 2FA is bad].

> If they got your user and password in advance, a lot.

So how do they get my user name and password? Wait isn't this is where
we came in. You can have the last word. It's nap time for me...