Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

351–360 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#351

Post by tristor »

So fun story, I recently switched away from Authy for various reasons, but the key one was that I had to restore from a backup on a device and when I did so I realized the Authy had never actually deleted any of the 2FA/TOTP accounts I'd configured over the years, things that had been deleted on device literally 5+ years ago were still stored and available on request via their API.

In general, after that I started poking, and discovered a lot of things I hadn't bothered looking into before that make me extremely suspect of Authy's general security.

For those looking for an alternative, I use 2FAS and Yubico Authenticator with a Yubikey now. Yubikey only allows you to store up to 32 TOTP slots, which is very limiting (I have more than 60 TOTP accounts for 2FA), so I use two apps and "tier" my 2FA.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#352

Post by mdaniel »

tetha wrote: post #163
duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

Mh, I'm probably comparing apples to oranges and such. But the last 2-3 times I setup a config management, I made sure to configure the local firewalls as deny-all by default, except for some necessities, like SSH access. And then you provide some convenient way to poke the necessary holes into the firewall to make stuff work. Then you add reviews and/or linting to make sure no one just goes "everything is public to…

> necessities, like SSH access.

SSM for life. Fun fact, one can also register non-AWS assets as SSM targets, so I could imagine a world in which it makes sense to create an AWS account, wire up federated auth, just to dispense with the hoopjumpery of SSH attack surface and Internet exposure

The break-glass is always a consideration, so it's no panacea but I still hope one day the other clouds adopt the SSM protocol same as they did with S3Api

I believe a lot of folks have had good experiences with Wireguard and similar, but thus far I haven't had hand-to-hand combat with it to comment. We use Teleport for its more fine-grained access and auditing, but I've had enough onoz with it to not recommend it in the same way as SSM

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#354

Post by qingcharles »

raincole wrote: post #240
cqqxo4zV46cp wrote: post #220

Earlier quoted context omitted.

No. TOTP MFA’s mechanics make it a significant security improvement regardless of how impressively large (???) your password is. It doesn’t inherently implicate “another service”. That’s the beauty of it. This issue is SPECIFICALLY due to forced use of Authy. Forced MFA for high-value accounts is a good thing. “A long password will protect me” is 2006 thinking.

What happens when you lose your phone then? Do you have recovery code printed out? Do you carry them with you? If you do then what's the difference between this and a password?

I keep a second outdated Android phone secure with all my TOTP on it for now, plus I have another person I trust who I share my codes with.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#355

Post by vishnumohandas »

memset wrote: post #344
vishnumohandas wrote: post #164

We built ente.io/auth If you need a cross platform authenticator, do check it out. FOSS, optional e2ee backups.

I switched to this from authy months ago and never looked back. Thank you! I followed this guide - basically, run an older version of authy with devtools enabled and use the js console to export your items. https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Glad to hear Auth is being useful!

If anyone else is considering a switch, our community has documented a migration guide here: https://help.ente.io/auth/migration-guides/authy

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#356

Post by 29athrowaway »

flutas wrote: post #98
29athrowaway wrote: post #74

> due to an unauthenticated endpoint. This is truly unacceptable for an authentication product. An authentication product that doesn't implement authentication correctly in their own APIs?

IMO: I'm pretty sure this is less of an auth issue, than it is a rate limiting issue. I haven't been able to find anything about the endpoint, but based on the data exposed[0] I think the endpoint they are talking about is the register one which requires a phone number. I'd bet they didn't rate limit it, and someone just blasted through all phone numbers with it and stored the data for ones that didn't error out. [0]…

So it's wardialing via the API then.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#357

Post by WarOnPrivacy »

sneak wrote: post #273
bonestamp2 wrote: post #144

Earlier quoted context omitted.

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

I have a dedicated phone I use solely for healthcare. The number in my main phone changes every 90 days.

> The number in my main phone changes every 90 days.

I get a new starter SIM every month.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#358

Post by maerF0x0 »

original_idea wrote: post #284
m00x wrote: post #272

It's sad how awful Twilio's engineering has become. I used it super early on and it was amazing, and while they had hiccups, they were never major and they were growing pains. Today they have incidents almost every week, and now data breaches.

Yeah, its not surprising what a bunch of layoffs will do. The Authy people have been gone for a while.

Not financial advice:

Also having an investor base that demands removing as much equity compensation as possible. (Whilst, IMO, not being aggressive enough to cut executive compensation)

But it's no surprise that when you ask management/executives "who needs to be laid off", the answer is not that many managers/executives...

I do think Kho is the right person for the job though, and Aidan was surprisingly smart too, so I my[1] bet is that they'll get there.

[1]: I'm long twilio btw.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#359

Post by maerF0x0 »

It feels funny to say "Hacker" when it was just someone one using something on the open internet the way it was (defacto) designed for, and just used it a lot.

Like if I crawl hackernews and download all the somethings am I a "hacker"?

To me a hack is some kind of escalation of privilege beyond what I'm truly entitled to (such as stuffing passwords, tricking software to run a payload, crafting a payload for service A so that it tricks Service B) ...

Not using curl on a loop.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#360

Post by WarOnPrivacy »

toast0 wrote: post #180
codersfocus wrote: post #168

Earlier quoted context omitted.

Why not get a second sim? Most phones can have 2 sims active, and a phone / text only plan is dirt cheap (3-6$/m). Offer the second number with much greater discretion.

I don't know about most phones supporting that, probably depends on the market. But best I can tell, 80% of my spam calls are just war dialing; a new number would get war dialed just as much. Probably wouldn't get collections calls for my deadbeat cousin though.

> a new number would get war dialed just as much.

I switched to low population area codes and that helped a lot. Currently getting 0-3/mo.

308 is low pop. https://en.wikipedia.org/wiki/Area_code_308

Post reply on HN