5 ms·

The article states that Google Authenticator is more secure than Authy? As someone who has been using GA for a long time but thinking about moving to Authy - w

The article states that Google Authenticator is more secure than Authy? As someone who has been using GA for a long time but thinking about moving to Authy - what is the rationale behind this assessment? Is it because Authy stores your 2FA sites in the cloud? I was going to use that as a plus, as I have now had to switch phones twice, and re-setting up my GA 2FA sites on the new phone was a major PITA - I thought Authy would make that easier, but now I guess that feature could be an attack vector too?

mason55 9y ago
Because Authy is SMS-based it's subject to phone number hijacking. If someone manages to convince your mobile carrier to enable your number on their SIM then you just lost all your 2FA protection. There are also ways to hack the SMS system so that you don't even need to have your phone number ported to fall victim.
- mpswardle 9y ago
  If you put a password on the Authy backup then it cannot be restored without that. https://support.twilio.com/hc/en-us/articles/223182508-Authy-Backups-Password-Retrieval https://support.twilio.com/hc/en-us/articles/223182508-Authy... This should be the default really.
  - sowbug 9y ago
    Another default should be PIN enabled.
- cyberferret 9y ago
  Wait, is the Authy App SMS based as well? I thought it just used a clock sync to generate the keys like GA does? I could be totally wrong as I haven't set it up, but that's what I gathered from reading their site and downloading their app? I thought the main difference was that the 2FA service details were saved in the cloud so you could sync up to multiple mobile devices using the Authy app?
  - 2bluesc 9y ago
    Authy backs up the 2FA secrets to the could to enable "multi-device support". To restore the backup it's usually a matter of verifying your phone number via SMS. See how this turned bad? I'd recommend disabling multi-device support which is enabled by default or adding a backup/restore prassphrase to make it more difficult to add new devices without also cracking the prassphrase.
- SCHiM 9y ago
  SS7 which is used to route calls, sms, can be spoofed. Any person with access to a cell tower (hop over a fence, break the padlock, plug your laptop in) or access to the Telecom backbone (hack a Telecom provider, buy a link). Can hijcak any number. More: https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7 http://thehackernews.com/2017/05/ss7-vulnerability-bank-hacking.html http://thehackernews.com/2017/05/ss7-vulnerability-bank-hack...
deleted 9y ago
[deleted]
mtgx 9y ago
If you want to sync your 2FA keys in the cloud, you may be better off with LastPass Authenticator: https://blog.lastpass.com/2017/05/announcing-cloud-backup-for-lastpass-authenticator-easier-multifactor-security-for-everyone.html/ https://blog.lastpass.com/2017/05/announcing-cloud-backup-fo... I would still say it's not recommend to backup those keys in the cloud, and I hope LastPass at least has the common sense not to keep those keys on the same server as the LastPass passwords. However, a middle ground may be backing up the keys before you change/reset your phone, and then disabling the feature (I'm not sure if they actually wipe or reset those keys every time you disable the backup feature, though, but I hope they do that).
davchana 9y ago
The way I try to sort this phone-change-re-authorise Auth Codes are that I save the QR code each time I opt into some two-factor service. That way I just need to savr that QR code with service name in KeePass database, and I could scan it in any new phone to keep using the Google Autheticator.
ecesena 9y ago
Sorry, but I think some comments below contain incorrect or partial info. Authy can be used just as a SMS-based 2fa, and this is as insecure as Google SMS. Note that this is still more secure than you (or me) implementing you own code via sms, because they do intelligence on the phone numbers, especially on critical operations like changing phone/merging accounts. Then there's Authy app with the TOTP code, similar to Google Authenticator. From a security perspective it is true that having Authy on multiple devices slightly decreases your security, as an attacker could steal any device and bypass your 2fa. I'm not convinced when people say that they can turn off Authy with just a phone verification (i.e. stealing the phone number), vs you can't on Google Authenticator. The fact that you have Google Authenticator, maybe even as a default, doesn't mean you don't have SMS too as an option, so the same attack can happen on Google. Also, note that for many critical operations, in Authy and Google, you receive a notification. In particular, if you have many devices connected, you'll receive multiple notifications with an higher probability of catching the issue on time. It would be nice to see explicit examples of the attacks mentioned. If you have someone's password and phone number [], you have a lot, and you can probably fool Google, Facebook, or any big as you can fool Authy. let's also remember that 2fa is the 2nd factor. Your first factor, the password, should be strong as well.
- tptacek 9y ago
  People say "Google Authenticator" because they feel silly saying "TOTP", which is a term that no normal user knows. But you can substitute any TOTP application for Google's (Duo's is a popular alternative, and there's no phone number link in the Duo onboarding process). Facebook calls these "code generator applications" and maybe that term will catch on.
  - ecesena 9y ago
    My comment still applies. In the majority of the 2fa implementation you activate via sms, then you can set up totp. Even if you forget about sms, sms is still available to get a code and bypass 2fa. Authy itself, if you have the app, never sends you sms but push notification. I'm not sure duo is relevant in this discussion, no consumer app that i know/i'm aware of uses duo.
obeattie 9y ago
This is a bit of a tangent, but Authy allows recovery of an account without access to either the original device or the original phone number. Does anyone know what actually happens when you go through this flow? https://www.authy.com/phones/change/ https://www.authy.com/phones/change/ It says they may perform "additional security checks" in the help but what are they? The wooliness of this makes me very nervous. (I don't use Authy fwiw)

mason55 9y ago

Because Authy is SMS-based it's subject to phone number hijacking. If someone manages to convince your mobile carrier to enable your number on their SIM then you just lost all your 2FA protection. There are also ways to hack the SMS system so that you don't even need to have your phone number ported to fall victim.

mpswardle 9y ago
If you put a password on the Authy backup then it cannot be restored without that. https://support.twilio.com/hc/en-us/articles/223182508-Authy-Backups-Password-Retrieval https://support.twilio.com/hc/en-us/articles/223182508-Authy... This should be the default really.
- sowbug 9y ago
  Another default should be PIN enabled.
cyberferret 9y ago
Wait, is the Authy App SMS based as well? I thought it just used a clock sync to generate the keys like GA does? I could be totally wrong as I haven't set it up, but that's what I gathered from reading their site and downloading their app? I thought the main difference was that the 2FA service details were saved in the cloud so you could sync up to multiple mobile devices using the Authy app?
- 2bluesc 9y ago
  Authy backs up the 2FA secrets to the could to enable "multi-device support". To restore the backup it's usually a matter of verifying your phone number via SMS. See how this turned bad? I'd recommend disabling multi-device support which is enabled by default or adding a backup/restore prassphrase to make it more difficult to add new devices without also cracking the prassphrase.
SCHiM 9y ago
SS7 which is used to route calls, sms, can be spoofed. Any person with access to a cell tower (hop over a fence, break the padlock, plug your laptop in) or access to the Telecom backbone (hack a Telecom provider, buy a link). Can hijcak any number. More: https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7 http://thehackernews.com/2017/05/ss7-vulnerability-bank-hacking.html http://thehackernews.com/2017/05/ss7-vulnerability-bank-hack...

deleted 9y ago

[deleted]

mtgx 9y ago

If you want to sync your 2FA keys in the cloud, you may be better off with LastPass Authenticator: https://blog.lastpass.com/2017/05/announcing-cloud-backup-for-lastpass-authenticator-easier-multifactor-security-for-everyone.html/ https://blog.lastpass.com/2017/05/announcing-cloud-backup-fo... I would still say it's not recommend to backup those keys in the cloud, and I hope LastPass at least has the common sense not to keep those keys on the same server as the LastPass passwords. However, a middle ground may be backing up the keys before you change/reset your phone, and then disabling the feature (I'm not sure if they actually wipe or reset those keys every time you disable the backup feature, though, but I hope they do that).

davchana 9y ago

The way I try to sort this phone-change-re-authorise Auth Codes are that I save the QR code each time I opt into some two-factor service. That way I just need to savr that QR code with service name in KeePass database, and I could scan it in any new phone to keep using the Google Autheticator.

ecesena 9y ago

Sorry, but I think some comments below contain incorrect or partial info. Authy can be used just as a SMS-based 2fa, and this is as insecure as Google SMS. Note that this is still more secure than you (or me) implementing you own code via sms, because they do intelligence on the phone numbers, especially on critical operations like changing phone/merging accounts. Then there's Authy app with the TOTP code, similar to Google Authenticator. From a security perspective it is true that having Authy on multiple devices slightly decreases your security, as an attacker could steal any device and bypass your 2fa. I'm not convinced when people say that they can turn off Authy with just a phone verification (i.e. stealing the phone number), vs you can't on Google Authenticator. The fact that you have Google Authenticator, maybe even as a default, doesn't mean you don't have SMS too as an option, so the same attack can happen on Google. Also, note that for many critical operations, in Authy and Google, you receive a notification. In particular, if you have many devices connected, you'll receive multiple notifications with an higher probability of catching the issue on time. It would be nice to see explicit examples of the attacks mentioned. If you have someone's password and phone number [], you have a lot, and you can probably fool Google, Facebook, or any big as you can fool Authy. let's also remember that 2fa is the 2nd factor. Your first factor, the password, should be strong as well.

tptacek 9y ago
People say "Google Authenticator" because they feel silly saying "TOTP", which is a term that no normal user knows. But you can substitute any TOTP application for Google's (Duo's is a popular alternative, and there's no phone number link in the Duo onboarding process). Facebook calls these "code generator applications" and maybe that term will catch on.
- ecesena 9y ago
  My comment still applies. In the majority of the 2fa implementation you activate via sms, then you can set up totp. Even if you forget about sms, sms is still available to get a code and bypass 2fa. Authy itself, if you have the app, never sends you sms but push notification. I'm not sure duo is relevant in this discussion, no consumer app that i know/i'm aware of uses duo.

obeattie 9y ago

This is a bit of a tangent, but Authy allows recovery of an account without access to either the original device or the original phone number. Does anyone know what actually happens when you go through this flow? https://www.authy.com/phones/change/ https://www.authy.com/phones/change/ It says they may perform "additional security checks" in the help but what are they? The wooliness of this makes me very nervous. (I don't use Authy fwiw)