Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

341–350 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#341

Post by Tainnor »

Tepix wrote: post #269
deepGem wrote: post #238

Earlier quoted context omitted.

It's high time someone disrupted the damn desk phone network of these hospitals. It's definitely not a technical hurdle in 2024. All calls go on the data network. You route your calls out of the main router and any call that gets routed in such manner will have the ID of the router. Tag the router id to the hospital or hotel and be done with. Is it not this simple ? With dual SIMs any phone can serve 2 lines so emplo…

It's an american problem. Spam calls aren't a big issue in Germany. Complain to your government.

I never get spam calls, but I do get a lot of spam SMS messages - also in Germany. (They're almost always fake 2FA activation messages from some bank I'm not a customer of)

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#342

Post by nsajko »

pnw wrote: post #126
hypeatei wrote: post #69

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…

Has anyone found a single open-source app that supports both mobile and desktop though? That was the attraction of Authy before they killed their desktop apps.

Why do you need it to be a single app?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#343

Post by nsajko »

xolox wrote: post #319
mort96 wrote: post #203

Earlier quoted context omitted.

> Exporting the raw totp tokens can only be done from the desktop version that is currently deprecated and scheduled to be nuked from existence later this year Oh. Fucking great. So I'm locked in to using Authy forever now I guess. I hate 2FA. It literally does exactly nothing for security, it's just another tool for these big companies like Google and Twilio to put themselves between me and the services I need acces…

I'm really sorry for the situation you find yourself in and agree that it sucks. I'm replying because I want to mention that it is possible to use 2FA without any form of vendor lock-in (although I realize this doesn't help you retrospectively fix your existing issue). I'm not trying to be a wise ass, I just want to share some pointers for folks who are interested in avoiding or remedying this problem (which is a bit…

TLDR: use a password manager to store your secrets. An OTP secret key is just a secret.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#344

Post by memset »

vishnumohandas wrote: post #164

We built ente.io/auth If you need a cross platform authenticator, do check it out. FOSS, optional e2ee backups.

I switched to this from authy months ago and never looked back. Thank you!

I followed this guide - basically, run an older version of authy with devtools enabled and use the js console to export your items.

https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#345

Post by duckmysick »

jmvoodoo wrote: post #64
duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

One step we have taken is to build an auth system that requires you as the developer to explicitly specify the security of an endpoint using a decorator. If no decorator is provided, then the endpoint is completely locked down even to admins (effectively disabled). If an endpoint is decorated with something that is considered dangerous (i.e. public access), that triggers additional review steps. In addition, the auth…

That's pretty cool.

> that triggers additional review steps

Is this done by some sort of a linter running in CI?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#346

Post by Kwpolska »

pndy wrote: post #292
qingcharles wrote: post #177

Earlier quoted context omitted.

Ugh. I hate that some apps require use of specific auth apps. This should not be a thing, we have great generic systems for this already.

Long story time: There's this small web portal in Poland that for years provides a simple free email service (and an instant messenger with same login) with occasional "messages from our sponsors" in your inbox - you had to tick your "interests" during registration. In time banners started to appear and that was still fine because the Web was still a pretty innocent place and tracking was years ahead of us. At some p…

All the big email services in Poland (WP, Onet, Interia, O2, ...) were always crap riddled with ads. I don't know why people still stick with it instead of migrating to something like Gmail.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#347

Post by al_borland »

bonestamp2 wrote: post #147

I recently setup a focus profile on my iPhone that only lets calls ring through from knowns contacts. There is going to be an adjustment period as I discover people and companies (such as doctors/hospitals) that I want to allow calls from and add them to the whitelist. But otherwise, it has been really nice to cut down on all of the interruptions.

You can flip on the option in the settings to silence unknown callers. It does a decent job, and prevents a lot of the manual micro-managing. I will sometimes toggle it off if I’m expecting a call from an unknown number, but it will also pull numbers it sees in texts and email and known.

I manually set this up several years ago, to only ring for contract in my address book. It was annoying, but worked. At the same time, I submitted the feature request to Apple and it came to iOS about a year later.

I found my calls have gone down dramatically since using it. I used to get 3-4 calls per day. Now, even if I have the feature toggled off, I might get a couple calls in a month. Once the number appears inactive, I think it drops off a lot of lists.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#348

Post by PascLeRasc »

jordigh wrote: post #188

Took a while, but this commenter is finally correct: > Why does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. > This is not in the spirit of 2FA. https://news.ycombinator.com/ite…

Twilio has an incentive to make "the spirit of 2FA" worse, because SMS-only is how they make money. Either OTP 2FA will be more complicated and adopted less, or they'll own the entire space, like in Sendgrid's case.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#349

Post by mdaniel »

giancarlostoro wrote: post #332
jordigh wrote: post #188

Took a while, but this commenter is finally correct: > Why does Authy require I provide my cell phone number and email address? Why do I have to have a user account? This is completely ridiculous. I do not need nor want cloud syncing or backup. You are making Authy a potential target for attacks by associating a user to cloud stored 2FA information. > This is not in the spirit of 2FA. https://news.ycombinator.com/ite…

Not to go too off-topic, but that post from 2015 has a response from 2019, how is that even possible? I thought HN auto locked posts after x number of days / years.

I don't want to go through the trouble of creating a throwaway to test it, but having worked in webdev long enough makes me believe it's possible that restriction is only on the frontend and some well placed curl may sidestep it

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#350

Post by mdaniel »

qingcharles wrote: post #177
kylehotchkiss wrote: post #170

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/accoun…

Ugh. I hate that some apps require use of specific auth apps. This should not be a thing, we have great generic systems for this already.

Yeah, Steam get with the program

My recollection is that someone reversed their algorithm and they used almost TOTP which hurts me even more because that implies that they knew about the standard and still chose violence

Post reply on HN