Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

61–70 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#61

Post by duckmysick »

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests

How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting?

Any testing frameworks that would catch this? Something like "given endpoint /user/phone-number-validate make sure only can access it".

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#62

Post by razakel »

inhumantsar wrote: post #41
ffsm8 wrote: post #33

Earlier quoted context omitted.

The consumer app also wants your phone number... It prompts you to "backup" your codes, so that they're not gone if you reinstall the app or switch devices you probably gave them your phone number at some point if youve got authy on multiple devices. /Edit: just checked on a clean install. It prompts for a phone number instantly and won't let you scan codes without creating an account. Not sure when that happened, as…

Figures. I stand corrected then. We used Authy for 2FA at my last company and migrated off it to use a complete auth platform. The amount of user (consumer and business) hostile shit we found in the process was astounding. Twilio was nice to work with way back when it was the only decent API-driven POTS connection service out there. They've steadily gotten worse over the years and acquisitions though. Wouldn't recomm…

You know, one thing I learned from my patients... they all hate the phone company. It's interesting; even the stock holders of the phone company hate the phone company!

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#63

Post by otachack »

As alternatives: I use Authenticator Pro on my phone and keep encrypted backups whenever I modify it. I know others have pointed out Aegis.

The issue is starting the migration out of Authy. Assuming Authy has no easy export, I suggest you migrate over a few entries at a time (maybe from top down) while keeping account of transfers somehow. You can have authenticators live side by side in the meantime!

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#64

Post by jmvoodoo »

duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

One step we have taken is to build an auth system that requires you as the developer to explicitly specify the security of an endpoint using a decorator. If no decorator is provided, then the endpoint is completely locked down even to admins (effectively disabled).

If an endpoint is decorated with something that is considered dangerous (i.e. public access), that triggers additional review steps. In addition, the authentication forbids certain combinations of decorators and access patterns.

It's not perfect, but it has saved us a few times from securing endpoints incorrectly in code.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#65

Post by brunoarueira »

duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

It's a common problem. On a previous job, I'd found one unauthenticated endpoint just because I want to add some integration tests on it and my tests failed! After that, I'd created a script which lists all endpoints and curl each one with invalid credentials and expecting them to return 401.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#67

Post by cmgbhm »

otachack wrote: post #63

As alternatives: I use Authenticator Pro on my phone and keep encrypted backups whenever I modify it. I know others have pointed out Aegis. The issue is starting the migration out of Authy. Assuming Authy has no easy export, I suggest you migrate over a few entries at a time (maybe from top down) while keeping account of transfers somehow. You can have authenticators live side by side in the meantime!

You can rename them as they are migrated

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#68

Post by stogot »

inhumantsar wrote: post #41
ffsm8 wrote: post #33

Earlier quoted context omitted.

The consumer app also wants your phone number... It prompts you to "backup" your codes, so that they're not gone if you reinstall the app or switch devices you probably gave them your phone number at some point if youve got authy on multiple devices. /Edit: just checked on a clean install. It prompts for a phone number instantly and won't let you scan codes without creating an account. Not sure when that happened, as…

Figures. I stand corrected then. We used Authy for 2FA at my last company and migrated off it to use a complete auth platform. The amount of user (consumer and business) hostile shit we found in the process was astounding. Twilio was nice to work with way back when it was the only decent API-driven POTS connection service out there. They've steadily gotten worse over the years and acquisitions though. Wouldn't recomm…

What do you recommend now

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#69

Post by hypeatei »

I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data.

I used this project for exporting: https://github.com/alexzorin/authy

EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really doesn't want you to export your data for "security" reasons.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#70

Post by hypeatei »

MaxMatti wrote: post #48
MenhirMike wrote: post #40

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

I used Aegis for a while and really liked it, switched to Bitwarden now but the UX was better

I use both and make offline backups regularly.
Post reply on HN