2

So apparently this is a new game that kids are doing. First they find a valid cell phone number that receives texts, then they start spamming it with 2FA requests with fake facebook/google account creations for the sake of being pests. The recipient can't block these, because facebook and google both require 2FA for logins, and these messages can come at any time of the day or night. Is there a life hack that will allow me to only receive 2FA notifications when I am legitimately attempting to log in?

3
  • 2FA - Two Factor Authorization - both required password(s) have become compromised.
    – Stan
    Commented Jul 20, 2021 at 14:04
  • @Stan the A typically stands for Authentication ("who the person is") rather than Authorization ("what they may do")
    – Caius Jard
    Commented Aug 17, 2021 at 6:39
  • @CaiusJard TY for the clarification
    – Stan
    Commented Aug 17, 2021 at 12:56

3 Answers 3

4

The obvious trick is to block the number used by the 2FA sender.

You then unblock it when you are expecting a code, then block it again after you've received it.

1
  • You can also change your Google 2FA default method to not be SMS based (also SMS isn't great security-wise) thus no need to unblock Google at all. I don't know if Facebook uses authenticator apps.
    – pboss3010
    Commented Jul 21, 2021 at 12:25
0

I am not sure if this question is in scope of lifehacks at all. But anyway my suggestion would be:

  1. Buy two-factor authorization hardware security key (token) e.g. YubiKey by Yubico, Titan Security Key by Google or any other hardware of such type

  2. Enable hardware 2FA on Google/Facebook or any other service that support this instead of using phone number for this. Here are instructions for Google and here for Facebook. The good thing is that you can buy one single token and use it in multiple services.

  3. Block permanently incomming calls/messages from number used for standard 2FA by these services.

Note. This answer is similar to the one posted by @Chenmunka, however it suggests hardware 2FA keys so that you don't need to unblock numbers at all.

0

Facebook supports authenticator app based auth; Google Auth, Authy, Last Pass, Fortitoken, Microsoft Authenticator and a boatload of other apps use the same algorithm - basically a sequence of random numbers unique to you, that changes every 30 seconds. By their servers and your phone being sync'd on their clocks they can both generate the same 6 digit number at the same time thereby you prove you have the app logged in and up in front of you. The server normally also calculates what the numbers were N lots of 30 seconds ago and into the future in case your clock is slightly adrift. Make sure your cellphone clock is accurate/set it to auto update from the internet/cell network

You might even have an app installed already that generates the codes; you only need one app

Switch your 2FA to that, and block the SMS based 2FA from facebook

An app based auth is perhaps more versatile than other methods; it's free or cheap and doesn't involve bespoke hardware, you can install it on multiple devices so you can still access (and change, quickly) your security to prevent issues in case of loss or theft of one device - you can also often back up the barcode/code underneath it and use it to restore the auth onto another device later.

Of minor concern with SMS based 2FA is that it isn't very secure; there are ways to subvert SMS messaging and reroute messages that contain codes without you ever having seen it be sent - it's not a 2FA method I use when other choices are available

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.