Twilio confirms data breach after hackers leak 33M Authy user phone numbers • Hacker News Board

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#361

Post by gregcohn » Fri, Jul 05, 2024, 5:49 PM UTC

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

Anyone who has kids has to answer the phone from strangers routinely. School staff and camp counselors are routinely using their own cell phones these days to communicate with parents.

Doing it the opposite way - tying all outbound school/camp calls to a single callerID - risks blending the important with the automated reminders. LAUSD abuses their automated calling system to the extent that my wife and I have both screened calls from the front office involving an injured child, more than once.

The real issue here is getting to the root cause, which is carriers and their intermediary aggregators having incentives to carry large volumes of spam.

In a number of markets, operators have increased the cost of SMS messages to deter spam, only to find a massive increase in traffic pumping fraud that mysteriously appears in the system of trusted intermediaries. Everyone's making a goddamn fortune off it, and no one actually cares to fix it.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#362

Post by yieldcrv » Fri, Jul 05, 2024, 5:50 PM UTC

mort96 wrote: post #210

yieldcrv wrote: post #113

Earlier quoted context omitted.

and we should do product liability lawsuits on every service that only allows SMS based one time passwords, if they don't allow a client side only option

Why? 2fa doesn't meaningfully add security if you're using decent passwords, and SMS-based 2fa is no less secure than no 2fa

just because SMS is vulnerable to SS7 attacks

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#363

Post by edward28 » Fri, Jul 05, 2024, 7:04 PM UTC

giancarlostoro wrote: post #330

LtdJorge wrote: post #310

Earlier quoted context omitted.

I use Authy _because_ it provides cloud sync. At the time, Google Authenticator didn't have it, and when I had to change phones it was a real hassle. Imagine if the phone had been stolen, no way to access the account normally to get a new QR, you'd have to "recover" every account.

I have been transferring Google Authenticator from phone to phone for years though? Going back to at least 2016, and that was 8 years ago. In 2020 I copied it from Android to iOS even by doing an export I had no idea was there.

It was a manual process requiring the phone to be working, which doesn't help when you have an accident that damages the phone.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#364

Post by hansvm » Fri, Jul 05, 2024, 7:10 PM UTC

squigz wrote: post #271

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> While this sucks, my phone is in so many data breaches at this point it doesn’t matter. Yes, and this is the slope that we keep sliding down with these data breaches not being taken seriously. First it was your name and email. Now phone numbers. What's the next bit of our private info that we'll normalize leaking?

Currently, any password from more than 6 months ago, names of all my acquaintances, photos of all my paystubs over the last 6yrs (thank you Equifax and dishonest HR platforms), .... Astounding amounts of misconduct are normalized. They're just not widely known yet.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#365

Post by OkGoDoIt » Fri, Jul 05, 2024, 8:22 PM UTC

codersfocus wrote: post #168

thephyber wrote: post #156

Earlier quoted context omitted.

I recently had to help my father organize his medical visits. Dealing with his healthcare providers was a bit of a pain, but it was way worse because he has stopped answering calls, primarily because of the call spam rate. I think because he owns his own business, he never fails to hand out his contact info when he is shopping, and he owns his own business (so his contact info is published by the city). His phone pro…

Why not get a second sim? Most phones can have 2 sims active, and a phone / text only plan is dirt cheap (3-6$/m). Offer the second number with much greater discretion.

Because the new Sim card is going to be assigned a phone number that’s been used by someone else in the past and will get even more spam. That’s been my experience on several new phone numbers I’ve gotten over the last few years.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#366

Post by otterpro » Fri, Jul 05, 2024, 8:28 PM UTC

The main reason I didn't use Authy was that it requested phone number when signing up, and it didn't make any sense to me why they'd need it. Since then, I've been using 2FAS, since there's no personal data that can be leaked.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#367

Post by bozey07 » Fri, Jul 05, 2024, 9:02 PM UTC

yread wrote: post #179

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

Is this like an American thing? I'm in the Netherlands and i get like 1 spam call per two months (business internet/electricity salesperson usually)

The experience is pretty poor in Australia too. Texts are more common than calls, but the rate is roughly 1/day.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#368

Post by EasyMark » Fri, Jul 05, 2024, 9:31 PM UTC

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I feel the same way. I get far too many “hey!” Or “Hello?” “What’s up?” messages on my phone that never say another thing. Any family/friend of mine knows me well enough to try more than once to get my attention via messages, and 99% of them should probably be in my contact list already and I’ll hear the beep.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#369

Post by SAI_Peregrinus » Fri, Jul 05, 2024, 9:45 PM UTC

bonestamp2 wrote: post #144

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

> I can’t remember the last time I talked on the traditional phone network or received a legitimate call Doctors and dentists. Most of the calls I get are spam, but then the MOST important calls I get are from doctors, labs, and dentists. I do as much as possible online of course, but not all of these professionals have good online systems and phone calls are often required. Sometimes you know what number they're goi…

My dentist texts me. My doctor uses MyChart, so I get notifications. Neither one calls me on the phone.

Even if they do want to call, they all have to support deaf people using TTYs, and phones all support RTT (TTY to cell). There's no need to take voice calls from legitimate businesses in the US.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#370

Post by sebastiennight » Fri, Jul 05, 2024, 10:13 PM UTC

bad_user wrote: post #270

pembrook wrote: post #101

While this sucks, my phone is in so many data breaches at this point it doesn’t matter. The spam-to-ham ratio on my phone number is now far worse than any other channel for me. The traditional phone network is at risk of going the way of the fax machine if we don’t do something about the spam problem like we did with email. If I’m on a call, even with family, it’s now almost exclusively on FaceTime/zoom/meet/etc. I c…

I'm an European and I get zero spam calls. I used to get a couple of cold calls per year for surveys, but I got unlisted via GDPR requests and now its down to zero. Companies do try collecting your phone number, but then I answer NO to the obligatory "do you want the latest offers" question (in the EU, this is opt-in not opt-out). And it doesn't matter if my phone number leaks. This is similar to my email address use…

Everything you mentioned is the beauty of the EU privacy laws (so far), however there is another negative externality you haven't planned for maybe.

Giving your phone number out to all these services also means that it can be used as a single identifier to track you and your behavior across all those services.

I'm not sure that GDPR is helping us a lot there.