iOS/iCloud has a built-in TOTP function also. Maybe better for friends and family than some people here. https://support.apple.com/guide/iphone/automatically-fill-in...
I have been using Apple’s Passwords, it is great.
Twilio confirms data breach after hackers leak 33M Authy user phone numbers
91–100 of 408 posts
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#92I still remember how hard was the process to be hired in this company. Maybe just a mask to hide the sad truth.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#93I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credent…
If you use cloud sync I think it requires your phone number
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#94I never trusted them, I hated the fact of having to use SMS.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#95I guess this explains the recent uptick in spam...
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#96I use Authy’s iOS app to generate 2FA tokens for a few accounts. I cannot remember ever entering my phone number into it, or establishing an Authy account of any kind. Is there some other way they would have acquired my phone number? I’m trying see if the issue is some unanticipated issue with the iOS client app itself, or if it is only affecting people who created online accounts with Authy to sync their 2FA credent…
Cloudflare should probably deprecate their Authy provider, considering they support other more secure MFA options (hardware and virtual WebAuthN). I believe Wise (ex TransferWise) and Plastiq also use Authy natively for SMS OTP server side, but provide no mechanism to disable SMS 2FA (boo).
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#97My goodness, for the 100,000th time, just stop using phone numbers for 2FA. (I know you won't anyway) There are no more excuses other than asking for your phone to be sim-swapped and your bank accounts or your wallets to be drained by call centers. If this breach doesn't scare you from using phone number for 2FA, then maybe nothing ever will and AI and deep fakes will make this even worse.
It doesn’t scare me because in Authy you also set a password which without you cannot access the codes.
The phone number here just acts as a username.
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#98> due to an unauthenticated endpoint. This is truly unacceptable for an authentication product. An authentication product that doesn't implement authentication correctly in their own APIs?
IMO: I'm pretty sure this is less of an auth issue, than it is a rate limiting issue.
I haven't been able to find anything about the endpoint, but based on the data exposed[0] I think the endpoint they are talking about is the register one which requires a phone number.
I'd bet they didn't rate limit it, and someone just blasted through all phone numbers with it and stored the data for ones that didn't error out.
[0]
The CSV data columns:
account_id
phone_number
device_lock
account_status
device_count
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#99I just migrated off of Authy last week but I was probably caught in this breach, ugh. Never liked it but they make it extremely difficult to export your data. I used this project for exporting: https://github.com/alexzorin/authy EDIT: it appears this project was actually using the unauthenticated endpoint (used in breach, too) to facilitate exporting, lol. Good luck to anyone trying to get off of Authy, Twilio really…
I also just recently left for Aegis and have been very happy. I feel much better knowing that my 2FA is completely offline
Re: Twilio confirms data breach after hackers leak 33M Authy user phone numbers
#100Earlier quoted context omitted.
But one of the selling points for me was to allow multiple devices so that if one broke I'd still have access.
You can enable multi device, and have it on multiple devices, then disable it (and keep it on multiple devices - it's just that then adding yet another device needs toggling multi-device on from an existing device, a confirmation SMS is not enough).
Perfect. I can just toggle it on when I add another device. Thank you, great solution.