Unlonely

watch livestreams on https://www.unlonely.app/

UnlonelyNFCsV2

tldr; i got sim-swapped yesterday

first noticed our unlonely_app twitter getting hacked. attackers bought similar unlonely dot xyz or unlonely dot claim domains and copied our landing page. luckily, we caught this early and were able to prevent further losses for users.

then i got an email saying my personal coinbase account had a password change. i quickly logged into coinbase, changed passwords, and luckily coinbase had labeled previous attempts as "suspicious" so they were preventing money moving out. additionally, thanks to @jessepollak i got my account locked quickly.

the biggest weakness in my security was my 2FA Authy app on my phone. once the attacker successfully sim-swapped me, they had access to my Authy which meant access to all my 2FA codes. my Authy is more secure now, but it's clear i need to find an alternative to mobile-phone based 2FA asap.

the second biggest weakness was T-Mobile. they couldn't tell me exactly how someone sim-swapped me, and it's generally concerning how easily they were able to pull this off. I now have sim-swapping locked, but regardless i'm quite angry with how little information they were able to provide.

our twitter is still hacked. hoping to get this resolved quickly (if anyone can help us here that would be great). my telegram is still logged out on my phone but hopefully this gets resolved soon as well.

happy with how quickly @grace handled everything, and thankful for people who helped us.
honestly, i'm honored to have been the victim of such a targeted attack. 

there's a chinese saying: 树大招风 which means the big tree attracts wind. we will be doubling down on our security, and will continue growing the tree.

then my personal telegram got compromised. got a notification that my tg had a new sign-in. started seeing messages i didn't send, messages get deleted, and i got kicked from our unlonely power users groupchat.

How tf is sim-swapping still a thing? I would get so mad if it happened to me

Nerding, plants, humble servant of cats 🐈 | Operations & Community Lead & Council Member at @novadao | Operations at @imgn | /allotment /gardening /vaping

yup very important to disable multi-device

Oooft, sorry to hear about this, but glad that it sounds like it's under control now. FYI in Authy, a few best practises from my experience:

- Backup must use a backup encryption key.
- Very important: DISABLE "Allow multi-device" option. If you need to add another device, toggle it on, add it, and disable again.

cma.xyz. Founder /paragraph, ceo /mirror, previously at Google & Coinbase 

yup
@dwr.eth has best-practice's that i would love to learn more about

With Authy, if someone has access to your phone number they can access all your 2FA codes? No need to login to anything else (eg iCloud)?

In any case that's wild, really sorry to hear about this!

/max • /bracket • @quickcast • /coys • maxp.co

im not sure, i did ask why they don't default sim lock and they said its bc its a bad UX, say if you broke your phone and wanted to get a new one. however, they still couldn't tell me exactly how i got sim-swapped.

will t-mobile sim lock anyone or just those that have been compromised?

they always seem like the weakest link in all of these attacks 🙃

sorry to hear this! I would use Google Fi over other cellular providers simply because its harder to sim swap

So sorry to hear this happened to you, @briang! I was also a victim of a SIM-swap and know how helpless it makes you feel. (Also why I ultimately started 3NUM.)

When you catch your breath, I'd love to send you an invite to our alpha to help protect you in the future.

Damn sorry to hear that… it’s a good idea to split up personal and professional accounts as much as possible 

And while there are no 💯 fool proof ways to prevent sim swapping there are certain providers (ahem… t-m) which are absolute dog shit 💩 - worth paying a little more for better security