I have removed all SMS based 2FA from every account that allows it and you should too.
Twilio confirms data breach after hackers leak 33M Authy user phone numbers
111–120 of 408 posts
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#112How come companies don't care about encrypting their users' data in their databases? It's been possible for a very long time now. Yet, companies keep leaking. And people keep sleeping.
Why would that have helped? The endpoint was exposing the data, not the database. The endpoint would have simply decrypted.
encryption of data at rest is for hard drives that walk off, not for access.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#113I have removed all SMS based 2FA from every account that allows it and you should too.
and we should do product liability lawsuits on every service that only allows SMS based one time passwords, if they don't allow a client side only option
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#114> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…
This is really, really, simple. 1. build a single endpoint handler that handles auth, then looks up the endpoint on the path. 2. Never create direct endpoints, just register endpoints in the system that the auth endpoint works under. You know table driven tests? Use table driven endpoints. It works and makes things so much simpler and secure.
> 1. build a single endpoint handler that handles auth, then looks up the endpoint on the path. 2. Never create direct endpoints, just register endpoints in the system that the auth endpoint works under.
So like, an authn/authz middleware ?
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#115Jesus fucking Christ. Can these companies learn how to write software? Quality is dropping like dogs. Twilio used to be a good company and now they are utter shite. Such a shame. Leetcode and bad hiring practices have done this to our industry.
Neither bad hiring not leet code is a problem with Twilio properties in my experience. Quality however, that gets railroaded by "deliverables" -- the problem is craftsmanship is hard to maintain and manage as companies scale while priority shifts to product announcements.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#116We should have something similar to Apple's hide my email for phone numbers
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#117I have removed all SMS based 2FA from every account that allows it and you should too.
I'm a bit confused how this is relevant. Authy is a OTP app, nothing to do with SMS.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#118"Company who thought they'd lost all public trust loses last additional bit of trust they didn't even know they still had, more at 11."
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#119This doesn’t surprise me. I found an information exposure vuln on the user registration endpoint a while ago (given a phone number of an authy user who had previously registered via another customer, retrieve all other numbers/devices/timestamps, email addresses and other info for that user).
It took them two years to fix it.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#120While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…
I think that is intentional, AFAIK phone communication is more protected than other types so allowing spam to continue unabated is in the governments interest. Outsourcing the harassment to 3rd parties, similar to how prison torture is outsourced to the inmates. The government could fix these things but would rather not.
I think we just don't have very much competition in telecommunications so things never get fixed. Why bother? It's easier to extract rent off largely the same offerings as the rest of your market (difficult to understand pricing tiers that function as a congestion tax more than a transaction, often region-specific monopolies or duopolies, indistinguishable quality of service) and bring home large profits, market efficiency damned.
Yes, I'm exaggerating. No, it's not by much.