Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

191–200 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#191

Post by grardb »

yread wrote: post #179
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

Is this like an American thing? I'm in the Netherlands and i get like 1 spam call per two months (business internet/electricity salesperson usually)

Definitely. I'm American and I've lived in the Netherlands for the past three years. The difference is night and day.

Whenever I visit, I switch to my US SIM card and am immediately bombarded with spam texts (mostly from political parties) and scam calls. In my experience, Android is pretty good at marking calls and texts as "potential scams," but they're still there. In the Netherlands, I've gotten a few scam attempts via WhatsApp. Other than that, I think I've received one phone call soliciting donations to the Red Cross, and nothing else.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#192

Post by iamtheworstdev »

TacticalCoder wrote: post #190
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I really don't get that. I don't get these, on neither of my phones (I've got two numbers). When it rings, it's virtually always friends or family. Sometimes the bank/insurance/doctor. Very exceptionally do I get a commercial or scam call. I think it's not an argument good enough to excuse to excuse Authy here: "my phone alre…

i'm jealous of you. I recently had a day where I got 25 phone calls. 23 were spam. Turning on iOS "ignore unrecognize phone numbers" has been amazing (i assume android has the same feature)

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#193

Post by Angostura »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

Interesting. Here in the UK I get about 1 spam phone call a year.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#194

Post by calderwoodra »

kylehotchkiss wrote: post #170

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/accoun…

Even worse.. 2FA is mandatory on Twilio products, so either install authy or don't use Twilio - no exceptions.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#195

Post by instagib »

For iPhone, put the phone in do not disturb. It will send all calls to voicemail. If someone is on your emergency contacts, favorites, or 1by1 focus then a repeated call will actually ring your phone. Otherwise no notification. Not even a text counter increase unless the person taps (notify anyway).

Tried to do the same on an android phone and it didn’t work.

You can also port your phone to google voice or Fi and give away all your call information to them. Very few spam calls get through their filter.

I like the change phone area code to out of area and block all phone calls from that area that some call services provide.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#196

Post by kccqzy »

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call

Doctors, dentists, moving companies, home improvement contractors, recruiters, etc. These are some of the most important phone calls I've received in recent memory.

I don't know what world you live in, but I religiously block phone numbers after just one spam call. And I usually don't give out my phone number. (I'm much happier giving out email addresses since I have an infinite supply of addresses.) I never get enough spam calls that I feel like the phone system is going the way of the fax machine.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#197

Post by rcostin2k2 »

instagib wrote: post #195

For iPhone, put the phone in do not disturb. It will send all calls to voicemail. If someone is on your emergency contacts, favorites, or 1by1 focus then a repeated call will actually ring your phone. Otherwise no notification. Not even a text counter increase unless the person taps (notify anyway). Tried to do the same on an android phone and it didn’t work. You can also port your phone to google voice or Fi and giv…

Actually, I have a Samsung S20+ and "Do not disturb" works pretty well, even scheduled

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#198

Post by graemep »

iamtheworstdev wrote: post #192
TacticalCoder wrote: post #190

Earlier quoted context omitted.

> If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I really don't get that. I don't get these, on neither of my phones (I've got two numbers). When it rings, it's virtually always friends or family. Sometimes the bank/insurance/doctor. Very exceptionally do I get a commercial or scam call. I think it's not an argument good enough to excuse to excuse Authy here: "my phone alre…

i'm jealous of you. I recently had a day where I got 25 phone calls. 23 were spam. Turning on iOS "ignore unrecognize phone numbers" has been amazing (i assume android has the same feature)

Wow. I was wondering why people were fussing about the odd spam call! The most I have had is 2 in a day and my number is in websites, social media, whatever.

Almost all spam is instantly recognisable. Mostly visa and parcel delivery scams.

In do not block unknown numbers because lots of organisations use them here (UK) This includes people I really do want to be able to contact me if they want to such as the police.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#199

Post by unshavedyak »

bonestamp2 wrote: post #144
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

Getting a new, out of state number can sometimes help.

My phone is out of state due to my previous address, and 95% of spam i get is spoofed to that old town or the surrounding area.

No doctors office/etc calls me from that area. It works pretty nice

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#200

Post by denkmoon »

If you've got anything in Authy that isn't using the authy custom authentication scheme (ie. just regular TOTP) now is the time to get it out.

Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year. It requires getting the tokens loaded into the desktop app, then downgrading to an older version so you can use the chrome remote debugger to run a javascript function against the desktop app (embedded chromium) which pulls out the raw tokens and gives them to you.

Post reply on HN