Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

291–300 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#291
post #203

If you've got anything in Authy that isn't using the authy custom authentication scheme (ie. just regular TOTP) now is the time to get it out. Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year. It requires getting the tokens loaded into the desktop app, then downgrading to an older version so you can use the ch…

> Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year Oh. Fucking great. So I'm locked in to using Authy forever now I guess. I hate 2FA. It literally does exactly nothing for security, it's just another tool for these big companies like Google and Twilio to put themselves between me and the services I need acces…

Well, then now might be a good wakeup call to move those tokens to one of the many opensource apps that allow exports? Like Aegins, Authenticator Pro, etc.?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#292

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/accoun…

Ugh. I hate that some apps require use of specific auth apps. This should not be a thing, we have great generic systems for this already.

Long story time:

There's this small web portal in Poland that for years provides a simple free email service (and an instant messenger with same login) with occasional "messages from our sponsors" in your inbox - you had to tick your "interests" during registration. In time banners started to appear and that was still fine because the Web was still a pretty innocent place and tracking was years ahead of us. At some point inbox was getting flooded with spam; either one you had to have or outside the service because the domain was popular and probably addresses were scrapped from the associated instant messenger. Then, banners started to be aware of inbox content and sponsored messages included tracking - milking your habits and activity become a thing.

Fast forward to some 10 years ago the service offers a premium plan where you can turn off banners around inbox, the permanent banners that pretend to be emails at the top of the list. Of course paying turns off only these banners and sponsored messages and every other spam will pile up. There's a built-in filtering option but since people started to using it to get rid of these mandatory messages - it stopped working at all. And any filter entry is a dummy one. At this point it's more an ads and spam gallery with an optional email service. Instant messenger was killed off in 2016 as people preferred global networks, and so were small but popular discussions forums turned off.

Around same time portal was bought by what for year was a bigger competition to them (not the only one ofc). The idea that both portals should use a single login appears. So people saw messages at login saying that you should transfer your account to this unified platform because it's more secure and there are some "benefits". Later, a darkpattern message was displayed saying that the unified login service will be the only way to use all services including email. And this unified login comes with company's own 2FA mobile app which you can't replace with a generic generator of any kind. Aaand in the end, nothing really happens. The darkpattern messages disappear and you can still log into the email with same plain password you used for years. The 2FA becomes suddenly optional but "recommended". People complaining in Appstore reviews about login issues and fact that no generic generator works are suggested to talk with support where apparently something can be arranged.

What my hot guesses are is that the company believed that domestic service popularity combined with mandatory 2FA app that does collect a lot of additional unnecessary information will provide a steady source of money for this service. People accustomed for years to an attractive short local domain won't force themselves to move elsewhere. But that didn't work as planned and honestly, I don't know how they managed to survive till today.

I did created few addresses there but over the years I managed to move elsewhere; what was once cool and fast and plausible become obnoxious to use.

If you remember poczta o2 you surely remember tlen emoticon: [10ton] - that's the best way to sum up what happen to this portal and service.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#293

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

As mentioned elsewhere, Aegis and Authenticator Pro are both good on Android. Both are available on Play Store and on F-Droid.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#294

Earlier quoted context omitted.

I recently had to help my father organize his medical visits. Dealing with his healthcare providers was a bit of a pain, but it was way worse because he has stopped answering calls, primarily because of the call spam rate. I think because he owns his own business, he never fails to hand out his contact info when he is shopping, and he owns his own business (so his contact info is published by the city). His phone pro…

I have a business with a published phone number and I probably get 20 spam calls a day, at least half of which leave “voicemails,” some of which are just really loud high pitched noises for whatever reason. It’s absolutely ridiculous. I wish I would have used a different number than my personal one back when I had started.

>I probably get 20 spam calls a day, at least half of which leave “voicemails,” some of which are just really loud high pitched noises for whatever reason.

That sounds like fax spam.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#295

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I’ve found some success is curbing spam calls with the “Silence Unknown Callers” feature in iPhone. However this presents a few challenges. Mainly missing calls from delivery agents, who's number is obviously not in my iPhone contacts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#296

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I'm an European and I get zero spam calls. I used to get a couple of cold calls per year for surveys, but I got unlisted via GDPR requests and now its down to zero. Companies do try collecting your phone number, but then I answer NO to the obligatory "do you want the latest offers" question (in the EU, this is opt-in not opt-out). And it doesn't matter if my phone number leaks. This is similar to my email address use…

>And I find it odd when people call me on WhatsApp.

Given that you're European, do you not have any friends/family outside your country, in neighboring EU countries? Wouldn't they have to pay high per-minute rates to call you?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#297

Earlier quoted context omitted.

I think we just don't have very much competition in telecommunications so things never get fixed. Why bother? It's easier to extract rent off largely the same offerings as the rest of your market (difficult to understand pricing tiers that function as a congestion tax more than a transaction, often region-specific monopolies or duopolies, indistinguishable quality of service) and bring home large profits, market effi…

Almost no-one is pro-spam, it’s pretty much universally hated, and in many cases it’s already illegal so it’s more of a matter of enforcement. It is also trivial to detect. Sure there probably is some regulatory capture but if anything at all can be regulated it’s spam calls / messages. If the government can’t regulate spam then what could it be expected to regulate. The general population is increasing worried about…

>If the government can’t regulate spam then what could it be expected to regulate.

The (US) government does an excellent job of regulating many things, such as commercial airplane design and construction. Oh wait...

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#298

Earlier quoted context omitted.

i'm jealous of you. I recently had a day where I got 25 phone calls. 23 were spam. Turning on iOS "ignore unrecognize phone numbers" has been amazing (i assume android has the same feature)

Wow. I was wondering why people were fussing about the odd spam call! The most I have had is 2 in a day and my number is in websites, social media, whatever. Almost all spam is instantly recognisable. Mostly visa and parcel delivery scams. In do not block unknown numbers because lots of organisations use them here (UK) This includes people I really do want to be able to contact me if they want to such as the police.

> here (UK)

I think it's mostly just an issue in the US/North America

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#299
post #212

Earlier quoted context omitted.

The telephone companies make money based on minutes of usage. There is a very large financial incentive for the really big telcos to allow spam calls. Spam callers are likely the most lucrative customer of the telephone network for the telephone companies.

> The telephone companies make money based on minutes of usage. I don't see how that could be correct. Once you pay your monthly fee, the fewer minutes you tie up the company's resources the better for them. That's true too for pay-ahead plans.

Your provider get paid by the caller's provider for taking the call, and the marginal costs of a phone call are close to zero.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#300

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/accoun…

Authy uses a standardized QR code to seed your TOTP. This isn't true.

It's either Authy or 2FA through SMS, no other option.
Post reply on HN