Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

101–110 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#101

Post by pembrook »

While this sucks, my phone is in so many data breaches at this point it doesn’t matter.

The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email.

If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I can’t remember the last time I talked on the traditional phone network or received a legitimate call. Which isn’t great because those aforementioned platforms are all proprietary walled gardens with terrible incentives — once they capture the market fully they will eventually dump ads all over your calls. Don’t believe me? Just look at what Gmail did to monetize the lock-in on your inbox.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#102

Post by jgrahamc »

toomuchtodo wrote: post #96
snowwrestler wrote: post #23

I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credent…

Cloudflare should probably deprecate their Authy provider, considering they support other more secure MFA options (hardware and virtual WebAuthN). I believe Wise (ex TransferWise) and Plastiq also use Authy natively for SMS OTP server side, but provide no mechanism to disable SMS 2FA (boo). https://authy.com/guides/cloudflare/

There's no "Use Authy" option any more in Cloudflare. It just says:

    Mobile App Authentication
    Secure your account with TOTP two-factor authentication.
And clicking the button gives you a generic QR code to use with app of your choice.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#103

Post by kardianos »

duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

This is really, really, simple.

1. build a single endpoint handler that handles auth, then looks up the endpoint on the path. 2. Never create direct endpoints, just register endpoints in the system that the auth endpoint works under.

You know table driven tests?

Use table driven endpoints. It works and makes things so much simpler and secure.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#104

Post by toomuchtodo »

jgrahamc wrote: post #102
toomuchtodo wrote: post #96

Earlier quoted context omitted.

Cloudflare should probably deprecate their Authy provider, considering they support other more secure MFA options (hardware and virtual WebAuthN). I believe Wise (ex TransferWise) and Plastiq also use Authy natively for SMS OTP server side, but provide no mechanism to disable SMS 2FA (boo). https://authy.com/guides/cloudflare/

There's no "Use Authy" option any more in Cloudflare. It just says: Mobile App Authentication Secure your account with TOTP two-factor authentication. And clicking the button gives you a generic QR code to use with app of your choice.

Thank you for correcting me, Cloudflare was presented as an Authy token that would be destroyed when I deleted my Authy account and some of the docs I found led me to believe this was still actively in use. I retract the Cloudflare part of my above comment.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#105

Post by teamspirit »

Zetaphor wrote: post #99
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

I also just recently left for Aegis and have been very happy. I feel much better knowing that my 2FA is completely offline

Right, I did the same a while back. Aegis for Android and 2FAS for iOS. Never looked back.

Also, if anyone is going either direction, Android iOS, both of these open source options allow easy export.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#106

Post by jgrahamc »

toomuchtodo wrote: post #104
jgrahamc wrote: post #102

Earlier quoted context omitted.

There's no "Use Authy" option any more in Cloudflare. It just says: Mobile App Authentication Secure your account with TOTP two-factor authentication. And clicking the button gives you a generic QR code to use with app of your choice.

Thank you for correcting me, Cloudflare was presented as an Authy token that would be destroyed when I deleted my Authy account and some of the docs I found led me to believe this was still actively in use. I retract the Cloudflare part of my above comment.

No need to apologize. We did use Authy for a long time but allowed more general TOTP solutions from 2017 and have really pushed hard for people to use hardware keys.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#107

Post by ezekg »

FabHK wrote: post #78
ezekg wrote: post #20

Earlier quoted context omitted.

Do what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.

You can enable multi device, and have it on multiple devices, then disable it. https://authy.com/blog/understanding-authys-multi-device-fea...

Yep. I've done this. Lots of people I know use "burner" phones without cellular for 2FA.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#108

Post by NelsonMinar »

hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

The lack of export in Authy is a really ugly choice they made. When I migrated to Aegis I used some hack that involved a desktop Electron app's javascript console. I wonder if that still works?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#109

Post by jonathanlydall »

When I tried SendGrid it was super annoying that I had to install yet another Authenticator app on my phone. Now it’s become a point of data loss.

It’s bizarre to me that Twilio decided to get into the Authenticator business at all, especially while SendGrid had plenty enough problems to keep them busy.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#110

Post by cjbgkagh »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I think that is intentional, AFAIK phone communication is more protected than other types so allowing spam to continue unabated is in the governments interest. Outsourcing the harassment to 3rd parties, similar to how prison torture is outsourced to the inmates. The government could fix these things but would rather not.
Post reply on HN