Twilio confirms data breach after hackers leak 33M Authy user phone numbers • Hacker News Board

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#391

Post by bonestamp2 » Sat, Jul 06, 2024, 5:40 PM UTC

al_borland wrote: post #347

bonestamp2 wrote: post #147

I recently setup a focus profile on my iPhone that only lets calls ring through from knowns contacts. There is going to be an adjustment period as I discover people and companies (such as doctors/hospitals) that I want to allow calls from and add them to the whitelist. But otherwise, it has been really nice to cut down on all of the interruptions.

You can flip on the option in the settings to silence unknown callers. It does a decent job, and prevents a lot of the manual micro-managing. I will sometimes toggle it off if I’m expecting a call from an unknown number, but it will also pull numbers it sees in texts and email and known. I manually set this up several years ago, to only ring for contract in my address book. It was annoying, but worked. At the same ti…

Thank you for drawing attention to this. Whenever I've scrolled past that option in the settings, I incorrectly assumed how it works and it's actually much more useful than I realized. I've adjusted my settings accordingly and I'll give it a chance. Thanks again.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#392

Post by remram » Sat, Jul 06, 2024, 8:05 PM UTC

calderwoodra wrote: post #194

kylehotchkiss wrote: post #170

Twilio requires Authy for 2fa for sendgrid and maybe even twilio itself instead of supporting more standardized 2fa that’d allow 1pass to be used. This is all the more frustrating because I was forced to use Authy to protect an account instead of my regular tooling and they still managed to screw it up. Twilio, take a hint and stop forcing people to use your custom thing https://www.twilio.com/docs/sendgrid/ui/accoun…

Even worse.. 2FA is mandatory on Twilio products, so either install authy or don't use Twilio - no exceptions.

I was able to use my standard app for Twilio, but didn't manage to use anything but Authy with SendGrid. Is there a trick?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#393

Post by denkmoon » Sun, Jul 07, 2024, 2:27 AM UTC

xolox wrote: post #386

nsajko wrote: post #343

Earlier quoted context omitted.

TLDR: use a password manager to store your secrets. An OTP secret key is just a secret.

That is not the TLDR I intended. If you store your OTP secrets in the same password store that also stores your regular passwords, you've just completely undermined the second factor of security.

and sometimes that's ok. I don't need 2fa on my twitch account. The important part is that I am back in control.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#394

Post by nsajko » Sun, Jul 07, 2024, 7:37 AM UTC

xolox wrote: post #386

nsajko wrote: post #343

Earlier quoted context omitted.

TLDR: use a password manager to store your secrets. An OTP secret key is just a secret.

That is not the TLDR I intended. If you store your OTP secrets in the same password store that also stores your regular passwords, you've just completely undermined the second factor of security.

The TLDR describes your method accurately, though. You do store your OTP secrets in a password store.

That said, the significance of using two separate password stores isn't clear to me. Under what threat model is that supposed to be an improvement over a single password store? Basically, your idea is that passwords are less essential than OTP secrets, so you take less care keeping them safe. However I think it'd make more sense to just apply proper protection for all secrets.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#395

Post by unshavedyak » Sun, Jul 07, 2024, 3:09 PM UTC

alister wrote: post #204

unshavedyak wrote: post #199

Earlier quoted context omitted.

Getting a new, out of state number can sometimes help. My phone is out of state due to my previous address, and 95% of spam i get is spoofed to that old town or the surrounding area. No doctors office/etc calls me from that area. It works pretty nice

> Getting a new, out of state number The problem with that idea is that when you make local calls, people think that you are the spammer. I too have an out-of-state number after having moved, and I can definitely confirm that when I make a local call, some people will not pick up after seeing the unusual area code on their caller ID. They told me so. There's another problem too: Even when I leave voicemail for a loca…

That's weird to me, honestly. Does everyone expect you to get a new phone number anytime you move long distances?

Everyone i know has kept their phone number for years. You'd think businesses would be used to people who moved from out of town but kept their number.

I don't call places much aside from doctors/etc tho, so i guess i just haven't had that issue personally.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#396

Post by smashah » Sun, Jul 07, 2024, 5:48 PM UTC

edward28 wrote: post #363

giancarlostoro wrote: post #330

Earlier quoted context omitted.

I have been transferring Google Authenticator from phone to phone for years though? Going back to at least 2016, and that was 8 years ago. In 2020 I copied it from Android to iOS even by doing an export I had no idea was there.

It was a manual process requiring the phone to be working, which doesn't help when you have an accident that damages the phone.

The trick is to always put the Auth codes on two devices. One you use, one you safely put away.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#397

Post by giancarlostoro » Sun, Jul 07, 2024, 6:36 PM UTC

mdaniel wrote: post #349

giancarlostoro wrote: post #332

Earlier quoted context omitted.

Not to go too off-topic, but that post from 2015 has a response from 2019, how is that even possible? I thought HN auto locked posts after x number of days / years.

I don't want to go through the trouble of creating a throwaway to test it, but having worked in webdev long enough makes me believe it's possible that restriction is only on the frontend and some well placed curl may sidestep it

I guess so, but who would force it for a dead thread, that the person you're responding to will never see? Maybe they're using a completely custom HN client tbh.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#398

Post by varjag » Mon, Jul 08, 2024, 6:33 AM UTC

darby_nine wrote: post #380

varjag wrote: post #169

Earlier quoted context omitted.

It's easy now. It was an unsolved problem two decades ago. And it's not like there's no technical means for the phones either. Just enforcing caller ID would go a long way to curtail spam. Like in our great Red Tape Europe, even with uptick in recent years we have a tiny fraction of spam calls compared to the United States.

> It's easy now. If this were true we wouldn't have spam > And it's not like there's no technical means for the phones either. Just enforcing caller ID would go a long way to curtail spam. A) this is insanely naïve given the international treaties that make up telecommunication agreements. B) "Just enforcing caller ID would go a long way to curtail spam." telecoms don't have any clue who is calling, see above comment…

> if this were true we wouldn't have spam

I was replying to the comment asserting that dealing with email spam is easier, which it most resolutely wasn't until the advent of statistical filters.

> A) this is insanely naïve given the international treaties that make up telecommunication agreements.

Fun thing about treaties and agreements is they are not laws of nature and can be entered, abandoned and amended at will. A lot of regulation is getting constantly updated.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#399

Post by pnw » Mon, Jul 08, 2024, 11:08 PM UTC

holigot wrote: post #311

pnw wrote: post #127

Earlier quoted context omitted.

I started with Keepassium but ended up with Strongbox which has been great.

Don‘t know if Strongbox is working well? Developed by a single programmer… and no Audits available.

They address that here: https://strongboxsafe.com/support/#reamaze#0#/kb/security-an...

Is Keepassium audited?

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#400

Post by KeePassium » Tue, Jul 09, 2024, 11:32 AM UTC

pnw wrote: post #399

holigot wrote: post #311

Earlier quoted context omitted.

Don‘t know if Strongbox is working well? Developed by a single programmer… and no Audits available.

They address that here: https://strongboxsafe.com/support/#reamaze#0#/kb/security-an... Is Keepassium audited?

We are undergoing the same CASA audit (required to access Google Drive API). And we do have people forking and building the project from source, so one can hope they read what they compile. Strongbox' source code is half-closed (see #784 in their repo) so source-level independent audit is impossible.

Otherwise, no. A third-party audit costs like a year of part-time developer, and at this stage the developer is more useful.