4 ms·
Just a few days ago I received an email from Coinbase asking to switch from Authy to Google Authenticator. The reasoning was: > Authy and SMS are vulnerable to
by avenoir 9y ago
Just a few days ago I received an email from Coinbase asking to switch from Authy to Google Authenticator. The reasoning was:
> Authy and SMS are vulnerable to phone porting attacks. Device based Authenticator apps like Google Authenticator mitigate this by being linked to your device, not your phone number.
- zwily 9y agoAuthy is not as vulnerable as SMS to phone porting, as your TOTP secrets require a passphrase to decrypt. So even if someone ports your phone number, they'll only get your encrypted TOTP credentials.
- therealmarv 9y agoRight. How big is the chance that somebody hacks all 3 barriers? Your password, your SMS and the TOTP passphrase?
- gant 9y agoPlus, if you do request the encrypted TOTP seeds from Authy you have a choice of 1. getting the download approved by another device already linked or 2. a 24 hour wait period during which Authy will send you an email every 6 hours.