Twilio breach leaks over 30 million Authy-linked phone numbers
Twilio breach leaks over 30 million Authy-linked phone numbers
This is Authy's second breach in two years
Summary
- Authy is a 2FA app that recently suffered a data breach that exposed more than 33 million phone numbers.
- An unsecured API endpoint allowed threat actors to collect linked numbers.
- If you think your personal information might be among the 33 million leaked numbers, consider securing your accounts with 2FA and be wary of SMS phishing attacks.
consider securing your accounts with 2FA
But authy is the 2FA - what should their users be doing?
[This comment has been deleted by an automated system]
Yeah I was curious whether that was an AI hallucination
Not using cloud based 2fa which is dumb to begin with
Okay but they're already using it so its a bit late for that.
Lol so what do you do when the 2fa app you use to protect your accounts is breached?
[This comment has been deleted by an automated system]
Good question. You would need to start by changing all your account passwords. Next export your 2 factor auth codes. Import your auth codes in a good open source auth app. Then, one by one set new auth codes for your accounts.
This should be sufficient to protect your online accounts.
Wouldn't it be great if independent auditors were standard, responsible for holding companies accountable for their data security practices, coupled with a rating system akin to those used in the banking sector? Before paying for a service, consumers would be aware of how secure the service is. Say A++ or AAA.
It would be a pain in Silicon Valley's ass for sure, but it would go a long way toward giving consumers peace of mind and bringing about a whole new industry in the process.
coupled with a rating system akin to those used in the banking sector
No. No, that really would not be great.
Rating schemes inevitably become subject to gaming and P2W.
Service providers need to be honest about their stack and its implementation, and people need to git gud.
The real important reminder here is that you should never use SMS as your 2FA delivery method. Phone numbers aren't private and once associated with an account it's far too easy to spoof/sim swap and intercept the code.
Someone needs to convince US Banks of this
That shit drives me nuts. Wanna be trusted with my life savings, but they can't be bothered to implement modern security features until they're already being phased out. I don't know what will replace modern 2FA schemes, but I guarantee banks will adopt the current ones about three years after the replacements become standard.
Also, they're charging you a poor tax for not having enough money, whether that's a minimum balance or just accidentally spending a nickel more than you had on hand.
Twilio has a really cool API that lets you resolve phone numbers to what carrier and if it's been ported.
Shame to see they got pwned.
Just moved all my 2FA over to Bitwarden and Bitwarden Authenticator, and deleted my Authy account. I'd already been using it for passwords, so it was a natural fit.
Whoops my bad
this is why i hate 2fa.
just another attack vector.
Well that's just oversimplification.
That's like saying that the second key of a 2-key nuke launch console is an extra attack vector.
That is exactly like saying having a separate deadbolt on your door is adding another attack vector...
The breach was because of an unsecured API endpoint. No actual auth codes were leaked. without 2FA the attacker would just need your password and email to get account access.
Don't throw the baby out with the bath water