Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

131–140 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#131

Post by SoftTalker »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I make and receive regular phone calls all the time. However I only answer those that are from numbers I have in my address book. I do the same with text messages, I have my default view set to "Known Senders" so I'm not even really aware of others. If I'm expecting an unknown sender message, such as a TFA code, it's easy enough to just look in "Unknown Senders" for it.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#132

Post by Ghexor »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

How convenient for the data collecting companies that so generously sponsor the new & free services, that our democratically controlled communication infrastructure looses in value.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#135

Post by rvnx »

darkr wrote: post #119

This doesn’t surprise me. I found an information exposure vuln on the user registration endpoint a while ago (given a phone number of an authy user who had previously registered via another customer, retrieve all other numbers/devices/timestamps, email addresses and other info for that user). It took them two years to fix it.

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint

Isn’t it what you are describing?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#136

Post by hypeatei »

Yhippa wrote: post #121
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

What did you end up moving to?

Storing 2FA in Bitwarden (my password manager) and Aegis as a fallback. Also making offline backups of each periodically.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#137

Post by ToucanLoucan »

cjbgkagh wrote: post #128
darby_nine wrote: post #120

Earlier quoted context omitted.

I think we just don't have very much competition in telecommunications so things never get fixed. Why bother? It's easier to extract rent off largely the same offerings as the rest of your market (difficult to understand pricing tiers that function as a congestion tax more than a transaction, often region-specific monopolies or duopolies, indistinguishable quality of service) and bring home large profits, market effi…

Almost no-one is pro-spam, it’s pretty much universally hated, and in many cases it’s already illegal so it’s more of a matter of enforcement. It is also trivial to detect. Sure there probably is some regulatory capture but if anything at all can be regulated it’s spam calls / messages. If the government can’t regulate spam then what could it be expected to regulate. The general population is increasing worried about…

> Almost no-one is pro-spam

In fact there are really only two groups that are pro-spam: spammers, obviously, and the entities that provide them services from which they may spam.

Oh sure basically any provider of any service be it phone, web hosting, email, etc. will say they don't want spammers, and the email providers may actually mean it what with them not wanting their server's scores trashed and be unable to get email to anyone (though plenty others don't give a shit), but website hosts, telephone companies, and SMS providers? They utterly do not care and in fact go out of their way to not know when spammers are (mis)using their services.

Meanwhile like that other commenter said, everyone is incentivized to enter walled garden services that actually do the barest minimum of enforcement for spam activity. I doubt they're conspiring in a dark room somewhere, but neither side is going to upset at the other in that situation.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#138

Post by hypeatei »

NelsonMinar wrote: post #108
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

The lack of export in Authy is a really ugly choice they made. When I migrated to Aegis I used some hack that involved a desktop Electron app's javascript console. I wonder if that still works?

They don't offer Authy Desktop anymore officially and you need a specific version. Not sure if the hack still works if you have it installed.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#139

Post by ilrwbwrkhv »

sethammons wrote: post #115
ilrwbwrkhv wrote: post #86

Jesus fucking Christ. Can these companies learn how to write software? Quality is dropping like dogs. Twilio used to be a good company and now they are utter shite. Such a shame. Leetcode and bad hiring practices have done this to our industry.

Neither bad hiring not leet code is a problem with Twilio properties in my experience. Quality however, that gets railroaded by "deliverables" -- the problem is craftsmanship is hard to maintain and manage as companies scale while priority shifts to product announcements.

There needs to be penalties. Massive penalties for breaches like this. That is the real problem. Nothing will happen to Twilio even though they caused such loss. They need to suffer economically for this, then quality will improve.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#140

Post by hypeatei »

pnw wrote: post #126
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

Has anyone found a single open-source app that supports both mobile and desktop though? That was the attraction of Authy before they killed their desktop apps.

Most password managers support it and offer mobile + desktop clients.
Post reply on HN