Top all-time · #8576
Stories by Lucky225 on Medium
Personal blog · lucky225.medium.comsecurity
Stories by Lucky225 on Medium is a personal blog at lucky225.medium.com about security. Since 2021, 9 different Hacker News readers have linked it 9 times, most often “It’s time to stop using SMS for security”. It is still writing: the last post was on 2026-08-22, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
Medium posts arguing SMS should not be used for two-factor authentication, using a cheap online service that hijacked texts as the example. Linked in HN threads on SMS security and Krebs coverage.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- It’s time to stop using SMS for security8 people · 8 mentions · first linked 2021-03-15
What Hacker News says?
The recently discussed[1][2] method of hijacking SMS with almost zero effort was an eye opener to me. I had thought it required social engineering my carrier. Nope, just a $15 service. [1] https://news.ycombinator.com/item?id=26469738 [2] https://lucky225.medium.com/its-time-to-stop-using-sms-for-a... [3] https://krebsonsecurity.com/2021/03/can-we-stop-pretending-s... Edit...added [3] above. Apparently, it's a $16 s…
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “5G: The outsourced elephant in the room”Submitted It’s time to stop using SMS for security as a story · 174 points
HN discussionhttps://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “A hacker got all my texts for $16”Submitted It's time to stop using SMS (2021) as a story · 45 points
HN discussionI haven't been able to verify these sort of claims any more than I've been able to speculate it was blanket telco Letters-of-Authorization (LoAs) [0][1] or classic SIM swaps that resulted in the account takeovers. I'm not claiming you're wrong, but given the timing of the LoA fraud and the attacks, it seemed likely to me that this was not an actual web vulnerability. What makes you believe a specific exploit like th…
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “Coinbase Breach Notification”Submitted PG&E and Experian exposed partial SSNs through website as a story · 6 points
HN discussionCan we stop submitting Krebs articles and just submit the source instead? Such as this: https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “Can We Stop Pretending SMS Is Secure Now?”It works for at least one mobile carrier, as demonstrated in the article Krebs references [1]. One carrier is enough. The ability to hijack text messages through an online service was also shown in an article Krebs' source mentioned [2]. Perhaps you're right that upstream agreements with mobile carriers should already be blocked, but in practice it's been proven not to be. There was a change to NetNumber's systems o…
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “Can We Stop Pretending SMS Is Secure Now?”While I'm sure that Fi and Google Voice are better than almost any other carrier based SMS security, this does nothing to convince me to ever use SMS 2FA. "Your Fi number is tied to your Google Account." -- I'm sure you've seen cases of people's google accounts being randomly locked for no reason. Now you lose access to make a call too! The last thing I'd ever trust security to is SMS. Lots of good technical details…
Comment linking /its-time-to-stop-using-sms-for-anything-203c41361c80
on “Google introduces mandatory 2-Step Verification for Google Accounts”
