Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

161–170 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#161

Post by blueelephanttea »

jmbwell wrote: post #66

iOS/iCloud has a built-in TOTP function also. Maybe better for friends and family than some people here. https://support.apple.com/guide/iphone/automatically-fill-in...

It's good. And the introduction of the Passwords app this fall will make it better.

But it seems to me that Apple only supports adding TOTP codes if you have a password for the account. Which is annoying if you want to split your passwords and second factor into two different places. (For example if you wanted Bitwarden for passwords and TOTP/Passkeys in Apple.)

You can of course put a dummy password in Apple. But that is kind of annoying.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#162

Post by DougN7 »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I’ve been impressed with my iPhone and/or carrier (AT&T in the US) for tagging incoming calls as spam or telemarketing. The phone does still ring but I know not to answer it.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#163

Post by tetha »

duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

Mh, I'm probably comparing apples to oranges and such.

But the last 2-3 times I setup a config management, I made sure to configure the local firewalls as deny-all by default, except for some necessities, like SSH access. And then you provide some convenient way to poke the necessary holes into the firewall to make stuff work. Then you add reviews and/or linting to make sure no one just goes "everything is public to everyone".

This way things are secure by default. No access - no security issues. And you have to make a decision to allow access to something. Given decent developers, this results in a pretty good minimum-privilege setup. And if you fuck up... in this day and age, it's better to hotfix too little access over losing all of your data imo.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#165

Post by joe_the_user »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

My phone number is from a different area code than I currently live in and I know no one from that area anymore. I can filter out 80% of spam just by ignoring calls from that area.

I wind-up using the phone because so many organizations malevolently misfeature they websites - doing what you want to (pay basic bill or whatever) is hard but upselling and new features, those you can do instantly.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#166

Post by teamspirit »

lifeinthevoid wrote: post #124
teamspirit wrote: post #105

Earlier quoted context omitted.

Right, I did the same a while back. Aegis for Android and 2FAS for iOS. Never looked back. Also, if anyone is going either direction, Android iOS, both of these open source options allow easy export.

2FAS also exists for Android, is Aegis superior or you don't use 2FAS on Android for another reason?

Didn’t realize it exists for Android. I use ios now but Aegis was great on Android.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#167

Post by [deleted] »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

[deleted]

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#168

Post by codersfocus »

thephyber wrote: post #156
bonestamp2 wrote: post #144

Earlier quoted context omitted.

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

I recently had to help my father organize his medical visits. Dealing with his healthcare providers was a bit of a pain, but it was way worse because he has stopped answering calls, primarily because of the call spam rate. I think because he owns his own business, he never fails to hand out his contact info when he is shopping, and he owns his own business (so his contact info is published by the city). His phone pro…

Why not get a second sim? Most phones can have 2 sims active, and a phone / text only plan is dirt cheap (3-6$/m).

Offer the second number with much greater discretion.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#169

Post by varjag »

treflop wrote: post #145
darby_nine wrote: post #120

Earlier quoted context omitted.

I think we just don't have very much competition in telecommunications so things never get fixed. Why bother? It's easier to extract rent off largely the same offerings as the rest of your market (difficult to understand pricing tiers that function as a congestion tax more than a transaction, often region-specific monopolies or duopolies, indistinguishable quality of service) and bring home large profits, market effi…

Email is easier to mitigate spam with. The whole body of the message is given upfront.

It's easy now. It was an unsolved problem two decades ago.

And it's not like there's no technical means for the phones either. Just enforcing caller ID would go a long way to curtail spam. Like in our great Red Tape Europe, even with uptick in recent years we have a tiny fraction of spam calls compared to the United States.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#170

Post by kylehotchkiss »

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing

  https://www.twilio.com/docs/sendgrid/ui/account-and-settings/two-factor-authentication
Post reply on HN