Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

51–60 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#51

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I‘m using Raivo. It hasn’t let me down, yet

[deleted]

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#52

I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credent…

Have you looked into the settings? On android you can see a cellphone-number and e-mail there. If they are missing, I guess it's not known to them.

Nothing in the iOS Settings app for Authy, but tapping the little gear icon in the app UI shows my phone number and email! I guess I did enter them at some point and forgot. Thanks.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#53

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I'm of the opinion that it's basically fine yo store them in your password manager. Yes if your password manager is broken into you lose everything (same as having no 2fa in that case), but you still prevent people from guessing your password and often avoid having to deal with email- or text-based 2fa. And if your password manager is broken into, there's a good chance your device has been broken into, in which case it doesn't matter where you store your 2fa.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#54

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

If you do not need QR codes, oathtool is great. You can protect your tokens, recovery codes etc. with gpg -c or similar, so the encryption is entirely separate from the authentication mechanism.

And you actually know what is going on. Works for GitHub.

https://www.nongnu.org/oath-toolkit/

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#55

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

For Android I'd recommend Aegis

https://f-droid.org/packages/com.beemdevelopment.aegis/

Or if you have a YubiKey you could also use it for TOTPs

Windows, Linux, Android: https://github.com/Yubico/yubioath-flutter

iOs: https://github.com/Yubico/yubioath-ios

I personally use Bitwarden for TOTPs (with a self hosted vaultwarden instance), it's by far not the most secure way to store your passwords and TOTPs next to each other, but it saves so much time.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#56

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I've implanted my 2FA token in my arm and just hope it never breaks :D

Which one did you get? Did you get the Apex Flex from Dangerous Things? How do you like it/how was the process?

https://dangerousthings.com/product/apex-flex/

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#57

There really has to be steep repercussions for companies that fail to protect user data like this. At this point I can't help but feel that there is wilful neglect with the aim of exfiltrating data with unknowable aim. Our digital data must be recognized as human rights but lately the world has been vocal about it but silent when it comes to action and enforcement. More and more reason why people no longer trust clou…

I agree the US in particular should have better data protection laws and consequences.

But phone numbers aren’t something I’d consider confidential in most cases. Hell, we used to publish our phone numbers in physical books and give them to the whole town for free (literally).

The data was even monetized with ads plastering every page. I guess the digital age isn’t all that different from the analog age (in certain ways!)

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#58

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

For Android I'd recommend Aegis https://f-droid.org/packages/com.beemdevelopment.aegis/ Or if you have a YubiKey you could also use it for TOTPs Windows, Linux, Android: https://github.com/Yubico/yubioath-flutter iOs: https://github.com/Yubico/yubioath-ios I personally use Bitwarden for TOTPs (with a self hosted vaultwarden instance), it's by far not the most secure way to store your passwords and TOTPs next to each…

This.

I migrated to Aegis a while back because I wasn't happy with how hard it is to get secrets out of Authy, or that someone else is managing them, and they they need my phone number (guess I was right, again).

I use Folder Sync on my Android to sync the Aegis auto-backups to a MinIO bucket I host at home.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#59

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I'm of the opinion that it's basically fine yo store them in your password manager. Yes if your password manager is broken into you lose everything (same as having no 2fa in that case), but you still prevent people from guessing your password and often avoid having to deal with email- or text-based 2fa. And if your password manager is broken into, there's a good chance your device has been broken into, in which case…

I mix it up and store some 2FA on different apps.

When it’s not a system I’m deeply concerned about I will just use the 2FA on the password manager.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#60

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I use andOTP https://github.com/andOTP/andOTP and my favorite feature is the database of 2FA can be backed up PGP-encrypted and reimported on another device. But sadly it is no longer maintained. The latest version on Google Play Store is from 2021 and can still be installed and works fine on Android 14.
Post reply on HN