Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

311–320 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#311

Post by holigot »

pnw wrote: post #127
prophesi wrote: post #85

Earlier quoted context omitted.

For Android, if you happen to use Keepass as your password manager, I really like KeePassDX[0]. If the camera app you use doesn't support QR scanning, though, you'd need an app for that (and I don't think any FOSS camera apps implement this, as for as I can tell). This one[1] seems the most up-to-date, by a German research group. You'd share the link as text to the KeePassDX app, search for the entry it's for, and it…

I started with Keepassium but ended up with Strongbox which has been great.

Don‘t know if Strongbox is working well? Developed by a single programmer… and no Audits available.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#312

Post by zenkan »

eviks wrote: post #275
zenkan wrote: post #267

One major problem I see with this hack is that the phone numbers exposed in the leak is the single factor of authentication needed to get access to an Authy account, including all the MFA tokens that the account has saved. If there are any high-profile victims in this list SIM Swapping those phone numbers should be a very attractive approach. I think security cautious companies should consider turning off multi-devic…

But it's not the single factor? > There are account recovery options outside of multi-device, but those require the attacker to compromise your primary email. These also take a minimum of 24 hours, during which you would receive email notifications, and could request a cancellation https://help.twilio.com/articles/19753631468059 And for multi device you can require current device to approve new ones

I just had to try it out now to make sure I'm correct on this and I believe I am. Here's what I found:

Multi-entity is enabled by default when creating an account. Enrolling a second device is possible via an OTP code received via a text message. This makes the phone number (in my mind at least) the default single-factor needed to access an Authy account.

As far as I can tell, the user has to either enroll either a second device, or manually disable multi-device support to make Authy SIM swapping resistant. I have not been an active Authy user for many years now so I might be mistaken here, but I strongly suspect a majority of Authys non-technical users have not done either. Meaning they would be susceptible to SIM Swapping attacks.

My old Authy account definitely was, at least.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#313

Post by j1elo »

brewdad wrote: post #266
jordigh wrote: post #188

Took a while, but this commenter is finally correct: > Why does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. > This is not in the spirit of 2FA. https://news.ycombinator.com/ite…

The entire use case for Authy is the cloud backup and syncing across devices. If you don’t want that, use any of the other free and more open 2FA apps.

Then make it an independent email+password thing, so in case of a leak, something as critical and personal as a phone number doesn't get involved in the stolen data.

(I know the irony of this in particular being Authy, but nevertheless phone numbers should NOT be risked to be exposed anyhow)

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#314

Post by gryn »

Tepix wrote: post #269
deepGem wrote: post #238

Earlier quoted context omitted.

It's high time someone disrupted the damn desk phone network of these hospitals. It's definitely not a technical hurdle in 2024. All calls go on the data network. You route your calls out of the main router and any call that gets routed in such manner will have the ID of the router. Tag the router id to the hospital or hotel and be done with. Is it not this simple ? With dual SIMs any phone can serve 2 lines so emplo…

It's an american problem. Spam calls aren't a big issue in Germany. Complain to your government.

Not sure, I get them in france at the very least twice a week. Other people I know complain about the same thing.

I settled on never answering my phone if not in my contact list, if the caller is not a spammer they leave a voicemail.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#315

Post by paradite »

bonestamp2 wrote: post #144
pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

Where I live, they moved to Whatsapp (dentist) and dedicated app (public hospitals) for messaging and notification.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#316

Post by bad_user »

shiroiushi wrote: post #296
bad_user wrote: post #270

Earlier quoted context omitted.

I'm an European and I get zero spam calls. I used to get a couple of cold calls per year for surveys, but I got unlisted via GDPR requests and now its down to zero. Companies do try collecting your phone number, but then I answer NO to the obligatory "do you want the latest offers" question (in the EU, this is opt-in not opt-out). And it doesn't matter if my phone number leaks. This is similar to my email address use…

>And I find it odd when people call me on WhatsApp. Given that you're European, do you not have any friends/family outside your country, in neighboring EU countries? Wouldn't they have to pay high per-minute rates to call you?

Inside the EU / EES we usually have minutes included.

Right now my plan, with Orange, costs 7.5 EUR / month with unlimited 5G (for real), 16 GB of data when roaming, unlimited minutes when roaming in EU/EES, and 600 international minutes in EU/EES. We do have great deals here, BTW, I'm sure it's more expensive in other EU countries.

I'd have to upgrade for another 100 minutes with US / Canada, however, I have another plan from Digi that charges per minute but that's dirt cheap.

I do have acquaintances from US with which I communicate primarily via WhatsApp, but I don't need it for my family within EU.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#317

Post by aPoCoMiLogin »

pnw wrote: post #126
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

Has anyone found a single open-source app that supports both mobile and desktop though? That was the attraction of Authy before they killed their desktop apps.

i've switched to keepass right after first breach. it's not convenient to store the db on eg gdrive and sometimes it doesn't work, but that is way better than another SaaS app that will eventually leak my passwords/2fa codes.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#318

Post by chefandy »

Sanzig wrote: post #247
alister wrote: post #204

Earlier quoted context omitted.

> Getting a new, out of state number The problem with that idea is that when you make local calls, people think that you are the spammer. I too have an out-of-state number after having moved, and I can definitely confirm that when I make a local call, some people will not pick up after seeing the unusual area code on their caller ID. They told me so. There's another problem too: Even when I leave voicemail for a loca…

I moved from British Columbia (250 area code) to the Montreal suburbs (450 area code). The one digit difference was a huge issue: the number of times businesses and government agencies would helpfully "correct" my phone number when I gave it to them or when they tried to call it meant I missed a substantial number of important phone calls. I get it, my French isn't the greatest and I have a thick Anglo accent, but "d…

Wow that seems crazy to me. I grew up in the northeastern US where even 3 decades ago, before a large expansion, we had 7 area codes within an hour drive. It would be bizarre to make such an assumption about someone, even then. When I lived in Boston, there was tons. Eastern Massachusetts alone has 339, 351, 508, 617, 774, 781, 857, and 978 as local area codes.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#319

Post by xolox »

mort96 wrote: post #203
denkmoon wrote: post #200

If you've got anything in Authy that isn't using the authy custom authentication scheme (ie. just regular TOTP) now is the time to get it out. Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year. It requires getting the tokens loaded into the desktop app, then downgrading to an older version so you can use the ch…

> Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year Oh. Fucking great. So I'm locked in to using Authy forever now I guess. I hate 2FA. It literally does exactly nothing for security, it's just another tool for these big companies like Google and Twilio to put themselves between me and the services I need acces…

I'm really sorry for the situation you find yourself in and agree that it sucks. I'm replying because I want to mention that it is possible to use 2FA without any form of vendor lock-in (although I realize this doesn't help you retrospectively fix your existing issue). I'm not trying to be a wise ass, I just want to share some pointers for folks who are interested in avoiding or remedying this problem (which is a bit of a tricky problem).

I've been using pass (https://www.passwordstore.org/) for quite a few years now and it allows to use multiple GPG keys to encrypt secrets in different subfolders. So I have a default GPG key that encrypts all my regular passwords, protected by a master password that is easy enough that I can regularly type it in on my smartphone.

Then I have a second GPG key with a much more complicated password that I use to encrypt my 2FA secrets (strings like "FX5D MJE8 F9F9 XFE0" that can be used to "seed" apps like Google Authenticator). These 2FA secrets I never access on my smartphone, I only access them on my laptop where I have a proper keyboard to type in the absurdly long password required to unlock these.

I wrote a small Python script that takes a 2FA secret and uses it to generate a TOTP URL that is then fed to "qrencode" (a command line program available on Linux and MacOS) which renders a QR code that I can scan into a TOTP app like Google Authenticator (like if I was first signing up for 2FA via the original website or service, the only thing that changes is who generates the QR code and when).

Because I saved the original 2FA "seeds" (my term, not sure what the proper term is here, but it's akin to the seed you feed into a random number generator) I can regenerate the QR code whenever I wish, which means that if my smartphone dies and I lose the 2FA secrets loaded into Google Authenticator, I can take an empty new smartphone, install Google Authenticator, and rescan all of the QR codes that bootstrap my 2FA sequences via my laptop. The other side (the website or service where I enabled 2FA) never needs to know I went through this procedure, in fact fundamentally it cannot know.

I've been using this same scheme to share 2FA codes with a team of system administrators so that we can properly protect e.g. AWS root accounts while still providing multiple individuals access without being tied to a single smartphone or 2FA app.

So long story short, it is possible, although admittedly (my way) it does require some cobbling together of different tools in order to get a workflow that handles this smoothly. But I sleep better at night knowing that all of my important accounts are protected by 2FA yet I can never be locked out of them, even if I lose my smartphone or laptop (the actual password store git repository lives on my server where it is backed up to several disks every couple of hours).

Post reply on HN