Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

141–150 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#141

Post by TeMPOraL »

Ghexor wrote: post #132
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

How convenient for the data collecting companies that so generously sponsor the new & free services, that our democratically controlled communication infrastructure looses in value.

Advertising is a cancer on modern society. It will metastasize to any new communications medium, public or private, and destroy it from within. People will switch to new medium that offer less spam, but advertisers quickly follow to strip-mine the new channel. A cycle of life, so to speak.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#142

Post by cjbgkagh »

ToucanLoucan wrote: post #137
cjbgkagh wrote: post #128

Earlier quoted context omitted.

Almost no-one is pro-spam, it’s pretty much universally hated, and in many cases it’s already illegal so it’s more of a matter of enforcement. It is also trivial to detect. Sure there probably is some regulatory capture but if anything at all can be regulated it’s spam calls / messages. If the government can’t regulate spam then what could it be expected to regulate. The general population is increasing worried about…

> Almost no-one is pro-spam In fact there are really only two groups that are pro-spam: spammers, obviously, and the entities that provide them services from which they may spam. Oh sure basically any provider of any service be it phone, web hosting, email, etc. will say they don't want spammers, and the email providers may actually mean it what with them not wanting their server's scores trashed and be unable to get…

Hence my other example of the inability to police prisons enough to prevent abuse, I didn't allege an explicit scheming but a happy little accident. Allowing a problem to fester when it benefits you is totally normal and expected behavior. But if there is a role for government at all it would be regulate such dysfunctions.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#143

Post by ingatorp »

yieldcrv wrote: post #122
selbyk wrote: post #117

Earlier quoted context omitted.

I'm a bit confused how this is relevant. Authy is a OTP app, nothing to do with SMS.

Authy uses SMS based recovery of your entire account, a weaker link that a single service using SMS based OTP

You can always disable multi-device, so it can act like a regular OTP auth app.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#144

Post by bonestamp2 »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call

Doctors and dentists.

Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required.

Sometimes you know what number they're going to be calling from ahead of time, but often you don't... especially if you're in a large medical network that has different offices for different specialists, etc. It's a really sad situation if you get sick and you're trying not to miss these important calls, especially when it's a long wait for a specialist and then you miss their call when they get to your name on the waiting list.

This will literally cost some people their lives and legislators need to act on making spoof calls impossible -- there's no reason why anyone should be allowed to spoof a number that they can't receive calls at.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#145

Post by treflop »

darby_nine wrote: post #120
cjbgkagh wrote: post #110

Earlier quoted context omitted.

I think that is intentional, AFAIK phone communication is more protected than other types so allowing spam to continue unabated is in the governments interest. Outsourcing the harassment to 3rd parties, similar to how prison torture is outsourced to the inmates. The government could fix these things but would rather not.

I think we just don't have very much competition in telecommunications so things never get fixed. Why bother? It's easier to extract rent off largely the same offerings as the rest of your market (difficult to understand pricing tiers that function as a congestion tax more than a transaction, often region-specific monopolies or duopolies, indistinguishable quality of service) and bring home large profits, market effi…

Email is easier to mitigate spam with. The whole body of the message is given upfront.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#146

Post by bonestamp2 »

godzillabrennus wrote: post #134

Authy is basically unsupported. Not surprised. I switched my accounts to 1Password when they announced the end of life of the macOS app.

That makes sense. In case it helps others... when they announced end of life of the mac app, that was because Apple Silicon macs can run the iOS version of Authy. So, if you have an M series mac then you can still use and get updates to authy.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#147

Post by bonestamp2 »

I recently setup a focus profile on my iPhone that only lets calls ring through from knowns contacts. There is going to be an adjustment period as I discover people and companies (such as doctors/hospitals) that I want to allow calls from and add them to the whitelist. But otherwise, it has been really nice to cut down on all of the interruptions.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#148

Post by gz5 »

consider* putting endpoints on a private overlay network in which network access is cryptography-gated (e.g. x.509 cert based).

then, a misconfigured endpoint (or a zero day etc.) can't be exploited by any_actor_on_the_internet - actors need to first complete the provisioning process you choose to enforce to be authorized to use the private overlay.

*not one size fits all, e.g. bad option if endpoints need to accept requests from unknowns.

however, many endpoints only need to accept requests from known (identified, authenticated, authorized) endpoints, and the added friction to id/authN/authZ get use the private overlay is not a business impediment.

there is a stigma here due to the horrors of NAC on private enterprise WANs. but NAC goals can be accomplished without that baggage via internet overlays and modern cryptography.

to be clear, i am by no means advocating to abandon traditional methods of endpoint auth - this it is just another layer which recognizes that single layers are rarely airtight (e.g. what just happened to Authy and Twilio).

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#149

Post by tmpz22 »

bonestamp2 wrote: post #144
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call

Social services are another example. Many services are county-administered and thus don't have a centralized online platform. As always our most vulnerable populations suffer the most from techno-greed. Not the families of software engineers who built the system.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#150

Post by tmpz22 »

duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

Holy shit why is this even a question?? You. Write. Tests.

You build into your testing framework/library a mechanism that will craft sessions across your range of authentication-levels - unauthenticated (no-session), authenticated but unauthorized, etc. You mandate new endpoints must have permissions test in code review.

Simple, straight forward, and absolutely the bare minimum of competency for any endpoint returning personal data.

Post reply on HN