Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

71–80 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#71

Post by tamimio »

MenhirMike wrote: post #40

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

Ente Auth or bitwarden builtin one or keepassXC builtin one.

Migrating from Authy is a headache, though you don’t have to reset the tokens. I found a way to do it (1), but I had to do it manually because Authy only exported the email/user and the token. Now, if you are like how I used to be, having the same email for different accounts, the exported JSON will be confusing and there's no way to tell which account is for which service. Only in the Authy UI can you tell. I had to follow the order of the JSON and the app, one by one, for my 700+ accounts, and verify that it works by going to the service site and testing the generated code from the new app, and also changing the email to a unique one. It took a whole week!

Edit: to add, I wouldn’t recommend using Yubico or hardware-based ones unless you will have two or more replicas, losing them is easy compared to having your tokens backed up in an encrypted KeepassXC db for example.

(1) https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#73

Post by hypeatei »

slightwinder wrote: post #42
blackeyeblitzar wrote: post #19

Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?

Some months ago, I used https://github.com/alexzorin/authy to export them. It basically creates a dummy-device to access the tokens, and then exports them to some format. But I have not figured out how to import them now into another app.

Use the plaintext export option on that project. Most TOTP apps should accept the URIs that are exported. Maybe not en-masse but individually for sure.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#75

Post by hypeatei »

conception wrote: post #26
blackeyeblitzar wrote: post #19

Authy makes it hard to migrate away. Anyone know how to get the seed of the 2FA codes? Is there really no export option?

Maybe? https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Authy desktop is no longer available and you need a specific version.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#76

Post by inhumantsar »

stogot wrote: post #68
inhumantsar wrote: post #41

Earlier quoted context omitted.

Figures. I stand corrected then. We used Authy for 2FA at my last company and migrated off it to use a complete auth platform. The amount of user (consumer and business) hostile shit we found in the process was astounding. Twilio was nice to work with way back when it was the only decent API-driven POTS connection service out there. They've steadily gotten worse over the years and acquisitions though. Wouldn't recomm…

What do you recommend now

For authentication services to integrate into apps/services, Zitadel.

For consumer password/2FA management, Bitwarden and Yubikey.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#77

Post by inhumantsar »

razakel wrote: post #62
inhumantsar wrote: post #41

Earlier quoted context omitted.

Figures. I stand corrected then. We used Authy for 2FA at my last company and migrated off it to use a complete auth platform. The amount of user (consumer and business) hostile shit we found in the process was astounding. Twilio was nice to work with way back when it was the only decent API-driven POTS connection service out there. They've steadily gotten worse over the years and acquisitions though. Wouldn't recomm…

You know, one thing I learned from my patients... they all hate the phone company. It's interesting; even the stock holders of the phone company hate the phone company!

As a former telco employee and current telco shareholder, can confirm.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#78

Post by FabHK »

ezekg wrote: post #20
Terretta wrote: post #12

Earlier quoted context omitted.

> > Even worse... Sounds like phone number is irrelevant, yet they collect it. > It's used to store and retrieve your 2fa secrets in case you lose your device The phone number doesn't store anything? But if somehow knowing that phone number is a key to getting your 2FA secrets, you'd have a bigger problem. Except it often is, and that's the problem.

Do what I do and turn off "allow multi-device." Problem solved -- even if your phone number is stolen, they can't recover your 2FA because it's locked to the device too.

You can enable multi device, and have it on multiple devices, then disable it.

https://authy.com/blog/understanding-authys-multi-device-fea...

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#79

Post by FabHK »

SketchySeaBeast wrote: post #35
ezekg wrote: post #22

Earlier quoted context omitted.

If you use Authy, turn off "allow multi-device" and SIM-swapping isn't an issue. This should be on regardless of the leak.

But one of the selling points for me was to allow multiple devices so that if one broke I'd still have access.

You can enable multi device, and have it on multiple devices, then disable it (and keep it on multiple devices - it's just that then adding yet another device needs toggling multi-device on from an existing device, a confirmation SMS is not enough).

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#80

Post by tamimio »

hypeatei wrote: post #75
conception wrote: post #26

Earlier quoted context omitted.

Maybe? https://gist.github.com/gboudreau/94bb0c11a6209c82418d01a59d...

Authy desktop is no longer available and you need a specific version.

I had that exact needed version when I migrated, if you need it, I can look it up, but there’s a slim chance that I deleted it.
Post reply on HN