4 ms·
Worth noting that authy is on the list. So if you synced your authy authenticators during that time, it's possible all your totp secrets leaked. One would hope
by pfooti 10y ago
Worth noting that authy is on the list. So if you synced your authy authenticators during that time, it's possible all your totp secrets leaked. One would hope authy encrypts those keys (I believe they do) client side, but yiiiiikes, I'm thinking about getting a yubikey.
- pfooti 10y agoFollowup - authy's blog post confirmed what I thought: they do encryption of all the user-entered TOTP secrets on the client side and don't store decrypt keys. So anyone who was able to intercept your secret store would still have to decrypt it, which is (hopefully) Quite Difficult. link: https://www.authy.com/blog/security-notice-authy-response-to-cloudflare-cloudbleed-incident/ https://www.authy.com/blog/security-notice-authy-response-to...