Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio confirms data breach after hackers leak 33M Authy user phone numbers

securityweek.com

Post reply on HN
Print view View original

81–90 of 408 posts

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#81

Post by hypeatei »

jmvoodoo wrote: post #64
duckmysick wrote: post #61

> Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests How do I avoid such problems in my own app? Force authentication for all requests with row-level security? Rate limiting? Any testing frameworks that would catch this? S…

One step we have taken is to build an auth system that requires you as the developer to explicitly specify the security of an endpoint using a decorator. If no decorator is provided, then the endpoint is completely locked down even to admins (effectively disabled). If an endpoint is decorated with something that is considered dangerous (i.e. public access), that triggers additional review steps. In addition, the auth…

.NET web apps / APIs have an option where you can require authorization on all controllers (and their actions) by default. If you need an anonymous controller/action, you can use the `[AllowAnonymous]` attribute on it.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#82

Post by tamimio »

drooopy wrote: post #39
deegles wrote: post #30

Earlier quoted context omitted.

You'll have to reset them one by one.

I finished that process recently for 50+ accounts. It's something that I would definitely wish on my worst enemy.

Ha! when I finished mine, I actually bought myself some treats and snacks for celebration.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#83

Post by [deleted] »

ezekg wrote: post #22
rvz wrote: post #3

My goodness, for the 100,000th time, just stop using phone numbers for 2FA. (I know you won't anyway) There are no more excuses other than asking for your phone to be sim-swapped and your bank accounts or your wallets to be drained by call centers. If this breach doesn't scare you from using phone number for 2FA, then maybe nothing ever will and AI and deep fakes will make this even worse.

If you use Authy, turn off "allow multi-device" and SIM-swapping isn't an issue. This should be on regardless of the leak.

[deleted]

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#84

Post by tamimio »

rvz wrote: post #3

My goodness, for the 100,000th time, just stop using phone numbers for 2FA. (I know you won't anyway) There are no more excuses other than asking for your phone to be sim-swapped and your bank accounts or your wallets to be drained by call centers. If this breach doesn't scare you from using phone number for 2FA, then maybe nothing ever will and AI and deep fakes will make this even worse.

> for the 100,000th time, just stop using phone numbers for 2FA.

I agree, and I say this to whoever asks me too, and I avoid any services that still use phone numbers as a way to associate it to you (Signal, I’m looking at ya!)

However, easier said than done, some services still require you to use a phone number, like banks, some government agencies, insurance companies, etc., the services that actually matter if your data get leaked. I believe there should be a regulation to prevent using the phone in any way to confirm your ID, and never force you to provide one to access such services.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#85

Post by prophesi »

MenhirMike wrote: post #40

Does anyone have a recommendation for an Open Source 2FA OTP app? That's the only thing I use Authy for, to scan the QR Codes into the App and generate the 2FA tokens, but in a way that allows me to migrate to another phone without having to re-set all the 2FA tokens on the vendor side.

For Android, if you happen to use Keepass as your password manager, I really like KeePassDX[0]. If the camera app you use doesn't support QR scanning, though, you'd need an app for that (and I don't think any FOSS camera apps implement this, as for as I can tell).

This one[1] seems the most up-to-date, by a German research group. You'd share the link as text to the KeePassDX app, search for the entry it's for, and it populates it with the HTOP/TOTP secret.

There are iOS Keepass clients that support this as well, though from what I can tell there's some drama with source code[2][3] in the landscape.

[0] https://f-droid.org/en/packages/com.kunzisoft.keepass.libre/

[1] https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

[2] https://github.com/MiniKeePass/MiniKeePass/issues/606

[3] https://keepassium.com/articles/keepass-apps-for-ios/welcome...

And other allegations under the ethics & transparency sections of KeePassium's list of iOS alternatives https://keepassium.com/articles/keepass-apps-for-ios/

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#86

Post by ilrwbwrkhv »

Jesus fucking Christ. Can these companies learn how to write software? Quality is dropping like dogs. Twilio used to be a good company and now they are utter shite. Such a shame. Leetcode and bad hiring practices have done this to our industry.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#87

Post by localfirst »

cj wrote: post #57
localfirst wrote: post #46

There really has to be steep repercussions for companies that fail to protect user data like this. At this point I can't help but feel that there is wilful neglect with the aim of exfiltrating data with unknowable aim. Our digital data must be recognized as human rights but lately the world has been vocal about it but silent when it comes to action and enforcement. More and more reason why people no longer trust clou…

I agree the US in particular should have better data protection laws and consequences. But phone numbers aren’t something I’d consider confidential in most cases. Hell, we used to publish our phone numbers in physical books and give them to the whole town for free (literally). The data was even monetized with ads plastering every page. I guess the digital age isn’t all that different from the analog age (in certain w…

that was before internet now phone number leaks can be way more troublesome due to the way all of our data is connected to it via 2FA

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#88

Post by olyjohn »

cj wrote: post #57
localfirst wrote: post #46

There really has to be steep repercussions for companies that fail to protect user data like this. At this point I can't help but feel that there is wilful neglect with the aim of exfiltrating data with unknowable aim. Our digital data must be recognized as human rights but lately the world has been vocal about it but silent when it comes to action and enforcement. More and more reason why people no longer trust clou…

I agree the US in particular should have better data protection laws and consequences. But phone numbers aren’t something I’d consider confidential in most cases. Hell, we used to publish our phone numbers in physical books and give them to the whole town for free (literally). The data was even monetized with ads plastering every page. I guess the digital age isn’t all that different from the analog age (in certain w…

We didn't use phone numbers to prove our identity back then. It was only used to call you. You often wanted it to be public so you could be reached. Now it's a critical piece of information required to access services online and prove who you say you are.

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#89

Post by [deleted] »

inhumantsar wrote: post #32
snowwrestler wrote: post #23

I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credent…

Authy is both a SaaS and a consumer-facing authenticator app. When companies integrate Authy into their system, they can use it for SMS OTP (also deliverable by phone call + TTS iirc) as well as regular TOTP, Authy's proprietary TOTP, and others. Your phone number would only be at risk if you used a service which used Authy for SMS 2FA

[deleted]

Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers

#90

Post by slightwinder »

hypeatei wrote: post #73
slightwinder wrote: post #42

Earlier quoted context omitted.

Some months ago, I used https://github.com/alexzorin/authy to export them. It basically creates a dummy-device to access the tokens, and then exports them to some format. But I have not figured out how to import them now into another app.

Use the plaintext export option on that project. Most TOTP apps should accept the URIs that are exported. Maybe not en-masse but individually for sure.

Ah, thank you, that worked in Aegis. I just missed the option for plaintext because of the long list of supported apps. So all it needs is a textfile with one otpauth://-entry per line and it imports them all at once.
Post reply on HN