3 ms·
Why is Authy called unsafe by the Author and Google Authenticator safe? Ever heard that it is more likely that your smartphone gets lost, broken and stolen than
by therealmarv 9y ago
Why is Authy called unsafe by the Author and Google Authenticator safe? Ever heard that it is more likely that your smartphone gets lost, broken and stolen than your precious online account getting hacked? I'm very happy I had Authy when I was in a foreign country and my Nexus 5X stopped working (BTW: damn you LG for your poor engineering!)
- homakov 9y agoAuthy service (one where they send you SMS) is centralized. It's not that it's safe or unsafe, but generally decentralized is better option.
- zwily 9y agoAuthy also can backup your TOTP tokens (encrypted with passphrase on device). This is super handy when switching devices, but weaker than Google Auth where the TOTP private bits never go back to Google in any form.
- homakov 9y agoYes, sorry, that TOTP backup thing is great. Always hated that GAuth cannot back up. But what was meant is the SMS service they make money on.
- rocqua 9y agoThere have been quite a few cases where SMS authentication proved unsafe. It's gone so far as NIST recommending against SMS as a 2nd factor. In short, providers are rather too willing to transfer a mobile phone number.
- avenoir 9y agoJust a few days ago I received an email from Coinbase asking to switch from Authy to Google Authenticator. The reasoning was: > Authy and SMS are vulnerable to phone porting attacks. Device based Authenticator apps like Google Authenticator mitigate this by being linked to your device, not your phone number.
- zwily 9y agoAuthy is not as vulnerable as SMS to phone porting, as your TOTP secrets require a passphrase to decrypt. So even if someone ports your phone number, they'll only get your encrypted TOTP credentials.
- therealmarv 9y agoRight. How big is the chance that somebody hacks all 3 barriers? Your password, your SMS and the TOTP passphrase?
- gant 9y agoPlus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.