Authy MFA Breach

Manky

Just a fyi for anyone who uses Authy for MFA.

https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers

Eirikr70

Hard to get used to the fact that your data gets leaked precisely by actors you trust to improve your security !

horde

More secure and private FOSS alternatives https://www.privacyguides.org/en/multi-factor-authentication/

TormentedScoreboard

horde Yeah, I just installed Graphene and discovered I couldn't sign into Authy.
So I'm in the process of switching to Aegis (I had access to Authy on a secondary device, luckily, making the process slightly easier).

Kodi

The day bitwarden gets hacked, the day I'm going offline forever. I guess it's just a matter of time

studog

TormentedScoreboard

I've just come across the same issue. How is Aegis?

[deleted]

Why don't you use something like a Yubikey, which stores MFA data on the key only?

longshots

[deleted] Because of convenience! Some of the questions asked on this forum amaze me, in that some people take their security to an incredible level, yet they use Authy, Last Pass or any other security product that works in the cloud. When they learn that "in the cloud" means "always in danger of being hacked" they may realise the error of their ways. IMHO.

TormentedScoreboard

[deleted]
For the moment, it's an economic question. It is on my to-buy-list in the near future.

studog

I don't seem to be able to edit my post, so here's a reply instead.

I am affected by the Authy breach in the OP, assuming the error message I get "doesn't meet integrity requirements" is related to Twilio fixing their breach. See https://www.reddit.com/r/Authy/comments/1dz82pr/the_device_does_not_meet_the_minimum_integrity/

I thought the issue was GrapheneOS related, because Authy is still working on my old phone without issue.

Edit: Deeply weird. My post that I'm replying to does not have the "three dots" extra menu that includes the edit option, but this post does. Not sure why the difference.

TormentedScoreboard

studog

Aegis work fine. It's non-cloud, encrypted, with the ability to export your vault, so you can back it up externally.

zzz

studog

My post that I'm replying to does not have the "three dots" extra menu that includes the edit option, but this post does. Not sure why the difference.

There's a short window after posting, in which editing is allowed to fix typos, etc.
After that short window it is no longer allowed.
Hope this helps.

de0u

studog The edit window is 10 minutes. This is to hamper spammers. It hampers legitimate posters too, but many anti-spammer techniques result in pain for legitimate users.

studog

TormentedScoreboard

After checking it out, I've started migrating to Aegis. So far so good.

Everyone

Authy has always been a failure point because they always relied on SMS Based authentication and recovery. There has been so many millions of dollars lost because of Authy where victims have been sim swapped and had their 2FA codes stolen. They use Twilio which always had vulnerabilities that they never looked into fixing. Always use a dedicated 2FA device or use a offline 2FA application such as Aegis and these attacks will not be apart of your life. Keep your eyes open.